Questions tagged [kerberos]
A network authentication protocol developed at MIT that allows secure authentication for both the user and the server.
62
questions
0
votes
1
answer
22
views
A fast question about kerberos and Oracle
I'm configuring Kerberos on Oracle I have 2 machines, one is a server with Oracle DB, the other is a client with oracle client(basic+sqlplus), my sqlnet.ora is like this(on server)
SQLNET....
- 183
0
votes
2
answers
186
views
PostgreSQL user mapping not working between AD user and DB user
I'm trying to setup kerberos auth between my lab RHEL PSQL 13 and my AD with some success unless I try to configure user maps in pg_ident.conf as documented.
My psql user is user and my AD user is ...
- 123
0
votes
0
answers
374
views
Kerberos - configure constrained delegation using SQL Server's virtual accounts
I'm trying to setup Kerberos constrained delegation to solve my double hop problem.
I'm using standard SQL Server configuration with Virtual Account (NT SERVICE\MSSQLSERVER) as a service account for ...
- 141
1
vote
1
answer
95
views
MS SQL server - linked server target configuration
I am setting up a linked server using kerberos authentication, but I am running into a problem that I have not seen before. I have set up linked servers using kerberos previously without problems.
On ...
1
vote
1
answer
207
views
Cannot connect to MSSQL using kerberos auth
We have a standalone SQL server [Microsoft SQL Server 2019 (RTM) - 15.0.2000.5 (X64)] that we'd like to use kerberos authentication with, to enable querying of other databases via linked servers. We'...
- 434
0
votes
1
answer
32
views
MongoDB 4.4 Enterprise and Kerberos Authentication
I am trying to setup Kerberos authentication to work with MongoDB Enterprise 4.4.
My OS is Centos 8.
I have configured SELinux as described in https://docs.mongodb.com/manual/tutorial/install-mongodb-...
- 3
0
votes
0
answers
21
views
Authenticating Postgresql users with Active Directory
Following this procedure, I've arrived at the step:
(if you do not have a ticket already, run: kinit sfrost@DOMAIN.LOCAL)
But when I do that...
$ hostname
blarg
$ kinit -V ron@EXAMPLE.COM
Using ...
- 455
0
votes
1
answer
208
views
Linked server only works if I am on the machine itself. I can't use it from my local computer. what is missing?
I have a few queries that I use to monitor log shipping. Sometimes I want to run those queries on a different server. I usually do that through a linked server.
I have a server called SQLDEV4-TS that ...
- 14.8k
0
votes
1
answer
51
views
Could I control which protocol will ODBC uses to connect MSSQL on "integrated windows authentication"
I have a Windows machine that should connect to an MSSQL instance with an ODBC driver using "windows integrated authentication".
Now according to the specifications of the login message the ...
- 125
0
votes
1
answer
591
views
Does my PostgreSQL instance support kerberos/gssapi authentication?
I installed it following instructions from digital ocean how-to-install-postgresql-on-ubuntu-20-04-quickstart:
% sudo apt install postgresql postgresql-contrib
I also did a 'show all' in psql and ...
- 111
0
votes
0
answers
47
views
SQL Server 2019 on Ubuntu Throwing security.crypto.symkey errors
I'm repeatedly seeing the following error, seemingly for every connection to SQL:
04/06/2021 16:39:25.890647613 Error [security.crypto.symkey] <0000004241/0x00000c34> Setting Variable Length ...
- 101
1
vote
1
answer
230
views
Kerberos Issue - Anonymous Login
I have a linked server that connects one SQL Server to another SQL Server. For two weeks now there has been an error when testing the connection;
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. ...
- 63
6
votes
2
answers
721
views
Intermittent SQL Delegated Authentication Errors
Here is an odd issue that is causing me to lose all my hair.
Every few days or so our delegated authentication from one SQL server to another fails with the error:
Login failed for user 'NT AUTHORITY\...
- 61
0
votes
0
answers
38
views
Oracle Kerberos LDAP authentication without KTPASS
I am working on trying to set up LDAP authentication on an Oracle 19c machine. The Active directory server I am authenticating against is a government service and they don't allow the kind of ...
1
vote
1
answer
335
views
SQL Server Linked Servers not connecting
I have configured linked servers with "connections will be made using the login's current security context", but can only make use of them when logged on to the server, not from another machine...
...
- 33
0
votes
1
answer
1k
views
SSPI Handshake failed
I am facing a strange situation... On a SQL2016 on Windows 2019, I have an application running on windows2019 that connect to the SQL server using a domain service account (same domain as the
SQL ...
- 2,759
0
votes
2
answers
254
views
pre login initialization =29237; handshake=26244
Connecting to one of my servers (no mirror or availability group running), from a local machine and I get this error message below related to handshake when the firewall is up.
when the firewall is ...
- 14.8k
2
votes
1
answer
768
views
Old ODBC app throws "cannot generate sspi context" on Windows 10
An old Access 2003 .adp project is currently running on Windows 7 machines, while SQL Server 2008 is on the backend.
Since the app is moved to a Windows 10 machine, the app will trigger "Cannot ...
- 135
0
votes
0
answers
158
views
unable to set kerberos authentication in mssql 2014 express
Hello I've recently installed MS SQL 2014 Express in MS Server 2016 Essential
I wanted to use Kerberos authentication so I've run through many pages but whenever I'm trying authentication always says ...
6
votes
1
answer
788
views
how to stop using sql server login credentials in a linked server?
I have a linked server based in Italy server_italia that connects to a server based in Oregon USA ORDB1
we are on different but trusted domains.
The connection from server_italia to ORDB1 is made ...
- 14.8k
0
votes
0
answers
109
views
mssql + sssd Ubuntu cannot login via AD group
I've got mssql 14.0.3192.2-2 setup unter Ubuntu; I have joined my machine to AD as described here.
The Windows login via SSMS and sqlcmd works if I add invididual AD users, but not if I add groups.
...
- 1
0
votes
1
answer
136
views
differences in the authentication scheme - could it be because of Kerberos?
I am using this script to check the connections to my sql server:
select
C.client_net_address,
S.host_name,
c.session_id,
c.net_transport,
c.protocol_type,
c.auth_scheme,
s.program_name
from sys....
- 14.8k
1
vote
0
answers
542
views
SSIS 2017 KerberosSupport - Double Hop Issue
I am having an issue with what appears to be a kerberos double hop issue with SSIS 2017.
The setup consists of a backend database cluster servers (DBSERVER01\02) an Application\SSIS server (...
- 11
1
vote
1
answer
336
views
Question on Enabling Kerberos Authentication using SetSPN for Availability Listener alternative DNS name
We have Availability Group, and original DNS name that was given to AG Listener, is too long (something like longername-Listener-01.mydomain.com); Its hard for us to change original DNS name of ...
- 4,408
2
votes
0
answers
631
views
Enabling Kerberos for Microsoft SQL Server Reporting Services
I am trying to enable Kerberos for MS SQL Server Reporting Services. I am fairly familiar with Windows security and how it works. However, I am new to Scale Out Deployment and Clustering of Windows ...
- 21
1
vote
3
answers
2k
views
NTLM vs Kerberos authentication - questions
We have 4 servers, all are members of the same Domain:
1. SQL 2012 on Windows Server 2016
2. SQL 2012 on Windows Server 2012
3. SQL 2017 on Windows Server 2016
4. SQL 2017 on Windows Server 2016
I ...
- 4,408
0
votes
1
answer
1k
views
How to get Kerberos working against a named SQL Server instance in Power BI Report Server?
I have a Power BI Report Server working perfectly connecting to SQL Server machines with a default instance only. I can also connect to SSAS named instances with the proper SPNs and by allowing ...
- 1,933
2
votes
1
answer
3k
views
SQL Server - register Service Principle Name without service restart?
I have a live SQL Server 2012 environment that had no SPN registered - this has previously not been an issue as Kerberos authentication wasn't required. But now it is required.
I have configured ...
- 1,404
0
votes
0
answers
1k
views
Why SQL Server Kerberos authentication does not work?
I am trying to find out why there is no Kerberos authentication on my SQL instance :
SELECT COUNT (auth_scheme) as nb, auth_scheme --net_transport, client_net_address
FROM sys.dm_exec_connections
...
- 283
2
votes
0
answers
2k
views
SQL Server SPNs not being created, state: 43
I'm trying to configure a SQL Server 2014 (12.0.5000.0) instance to use a regular user account in AD and Kerberos auth. During installation the default accounts (local system ones) were used, and the ...
- 121
3
votes
1
answer
158
views
Using DNS per application in ConnectionStrings
I have come across an idea recently when I had to migrate a ton of in-house applications to a new SQL server. The more I look at it, the more it sounds perfect, but I wanted to ask the community for ...
- 497
0
votes
1
answer
2k
views
Linked Server - Double Hop - Kerberos - TCP
I am having trouble with a Linked Server.
I would typically not use a linked server, but legacy issues are forcing my hand.
I am attempting to set up a linked server between two new production SQL ...
1
vote
0
answers
298
views
Postgresql delegated authentication with S4U2 not working
I am trying to authenticate to Postgres with Kerberos using S4U2 delegation with a service principle impersonating the user.
I have delegated the principal 'HTTP/sp01.domain' to login as 'username' ...
- 41
1
vote
0
answers
1k
views
SQL Server Kerberos Delegation on Failover Cluster Instance
I am attempting to setup kerberos delegation on a SQL Server failover cluster in order to get around the double-hop issue but have hit a roadblock.
Environment Overview:
Four SQL Servers in two ...
- 131
1
vote
1
answer
3k
views
Windows Authentication for SQL Server Linked Servers
Currently, on our project, we have a situation: there are a SQL Server 2012 instance IA in domain A and MS SQL Server 2012 instance IB in domain B. Domains A and B are trusted. IB configured as the ...
- 113
0
votes
1
answer
808
views
cannot generate sspi - None of Solution worked!
I am receiving "cannot generate sspi" error when I try to connect a sql instance remotely. I suspected the issue might be with spn and verified that spn was registered properly on the service account(...
10
votes
2
answers
19k
views
What should my SPN entries look like for each SQL instance?
I'm finding contradictory information for how exactly to format SPNs (Service Principle Names) to get the proper Kerberos connections, and how many I need for each SQL instance.
This 2017 MS document ...
- 9,584
1
vote
0
answers
831
views
Occasional Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. Reason: Token-based server access validation failed with an infrastructure error
I know that this issue has been discussed elsewhere and I already read it. Our problem is that this occurs only once a day (roughly), the rest of time everything works fine.
SERVER RS
Windows Server ...
- 11
21
votes
2
answers
74k
views
The certificate chain was issued by an authority that is not trusted
some time ago I installed SQL server 2016 developer edition on a windows 10 home edition environment (a laptop to be precise) and everything was fine.
then someone - an administrator on the box - ...
- 14.8k
4
votes
1
answer
1k
views
SSMS connections not using KERBEROS over VPN - why?
I have a very simple setup. SQL Server X (2012) and SQL Server Y (2016). X has a linked server to Y using the setting "Connections will: Be made using the login's current security context". SPNs are ...
- 1,933
1
vote
1
answer
569
views
Can I configure Oracle such that a Windows client can connect to a Linux Oracle server without a password?
I am attempting to configure Kerberos authentication to an Oracle 11.2 database from a Windows client. The goal is to have an IIS Application Pool connect to the DB via its service account ...
- 113
1
vote
1
answer
1k
views
Access - SQL Server: cannot generate SSPI context
I actually understand why this error messages pops up, but I do not know how to implement my solution.
There is a SQL Server network instance I am providing some MS Access forms to interact with, ...
- 191
4
votes
1
answer
4k
views
set SPN on SQL cluster
I have a question about how to manually set SPN for using Kerberos authentication on a SQL cluster.
Do I set one SPN on the clustername or one on each node?
I also have a default named instance, do ...
- 55
2
votes
2
answers
3k
views
Kerberos Configuration Manager - Does it work with SQL Server 2016?
I have just installed Kerberos Configuration Manager on a clustered SQL Server 2016 server and trying to connect using the app, it keeps failing.
I can connect using SSMS, but not with Kerberos ...
- 21
4
votes
1
answer
681
views
MongoDB Fails to get TGT
I've setup MongoDB enterprise on CentOS 7 with Kerberos support. Additionally I've setup a Kerberos service on CentOS 7 for the authentication. I know that Kerberos is setup correctly as I now have ...
- 141
3
votes
1
answer
627
views
What sort of SPN / AD Computer Delegation do you need for delegation of credentials to a linked server that connects to a file share?
The idea here is to perform a double hop and delegate the credentials of the client (leeand00@example.org), that have been sent to the SQL2.example.org server to SQL3.example.org (admittedly this is ...
- 1,652
5
votes
1
answer
422
views
What is a Forest?
I am reading the Microsoft article How to troubleshoot the "Cannot generate SSPI context" error message
The two quotes imply that if I know what a domain is I should know what a forest is, but I don'...
- 5,998
4
votes
2
answers
7k
views
Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'
I have an Operations server running Windows Server 2012R2 and SQL Server 2014 Enterprise back end. This server is used to deploy new code to other production servers via cmd file called by a SQL ...
- 1,465
3
votes
2
answers
1k
views
Cannot register SPN, error 0x80090350, state 4
This is my first time trying to configure kerberos. I need it for SQL Server.
Considerations
I'm running SQL Server 2008 R2 on Windows 2008 R2 server.
I have an Active Directory account for SQL ...
- 33
1
vote
0
answers
791
views
Connecting to MS SQL server from a Linux box
I am trying to connect to MS SQLServer from an application that I have written (using Qt) which runs on Linux. Here are some details of the setup:
The SQLServer box (SQLBox) is part of my domain (...
- 149