0

I have what I assume to be a pretty standard setup:

  1. ServerA running a web application as ServiceAccount1
  2. ServerB running SSIS as ServiceAccount2.
  3. ServerC hosting a network share that ServiceAccount1 has permissions to read from

The web application initiates an SSIS package execution via SQL commands. The package tries to read a file from the network share and fails due to the double-hop problem (login failed on ServerC, "anonymous login".

How can I get this to work? The SPNs are already there, and I've tried granting the delegation permission but SSIS refuses to forward on the credentials.

Improve this question
5
  • According to several sources, including sqlservercentral.com/forums/topic/…, the important credentials are those of the user that starts the process, not necessarily the service account. Maybe the delegation needs to be granted to that user instead of the service account?
    – Doug Deden
    Commented Apr 15 at 22:07
  • 1
    ServiceAccount1 needs to be a domain user, ServerA and ServerB and ServerC need to be domain joined, and Kerberos Constrained Delegation (or Resource based CD) need to be setup. Speak to your IT team or whoever runs your domain. If you think you have set up delegation correctly please show.
    – Charlieface
    Commented Apr 16 at 11:16
  • Thanks Charlieface. Everything is domain joined and the service account is a gMSA. Can you point me to good instructions on confirming delegation is correctly setup? I'm the domain admin here but I have a dev background. The old parent company used to handle these things :)
    – Spivonious
    Commented Apr 16 at 14:39
  • Well what steps have you done to set up delegation?
    – Charlieface
    Commented Apr 17 at 9:13
  • I've run Set-ADAccountControl -identity ServiceAccount$ -TrustedForDelegation $true -TrustedToAuthForDelegation $false to enable unconstrained delegation (just trying to get it working at this point)
    – Spivonious
    Commented Apr 17 at 13:23

1 Answer 1

Reset to default
0

After trying all sorts of things, the answer ended up being "don't use a gmsa" (Group Managed Service Account). Set up a regular account and it all worked with no issue.

Improve this answer
1
  • Group Managed Service Accounts (gMSAs)
    – Marcello Miorelli
    Commented Apr 19 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.