Hi,
Anybody know how use domain user instead SQL user
Anybody know how use domain user instead SQL user
-
-
Hey I might be able to help. I had to figure out same on RHEL 7 and RHEL8. What flavour of Linux are you on? -
-
There's some prep that you need first.
This is going to be a bit of a brain dump and messy because i don't have a lot of time right now.
It's intended as PoC to see if you can get connection using kerberos. Once you can, I can give additional info on how to automate it, additional fields needed to create DSN definition, etc
On the database side:
1) Ensure the database server is able to register its MSSQL SPN's with AD
From Windows command prompt: setspn -L serverName | findstr MSSQL
That comand should return some results
2) Ensure that the database auth scheme is Kerberos
Install sqlcmd.exe on a Windows server (https://learn.microsoft.com/en-us/sq...l-server-ver16)
Make your connection using AD-integrated authentication (-E). Make sure the user you're running sqlcmd.exe as has permissions to auth against the database
sqlcmd -S serverName\DBInstanceName -C -E
Run the following SQL to check what auth type was used:
SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@spid;
go
Should return Kerberos
On the Linux side:
Do you know if your CentOS box is already connected to your Windows domain? Let's assume it is and continue.
3) Install the Microsoft package that includes sqlcmd (because it allows you to test AD-integrated authentication. I don't think isql allows that)
4) Create a Kerberos Ticket Granting Ticket
Need to use kinit command (avail from krb5-workstation package)
kinit username@domain
(if signed into linux box with domain user, can also just run kinit without args to get ticket for current user account)
5) Validate you got a TGT using klist
Should get output that includes word 'krbtgt' under the Service Principle field
6) Attempt connection to database
sqlcmd -S servername\dbinstance -C -E
Let me know how you fare
Comment
Comment