Connect to SQL Server via Windows Authentication

5

Yes, or maybe more correctly (if I understood all the terms right) that Windows Domain Authentication used to run on the old NTLM protocol and some JDBC drivers supported that. The current protocol and configuration recommended by Microsoft with their own JDBC driver is Kerberos.

You are right that at the moment it’s not as straightforward as it used to be.

Below is a copy of the krb.conf I succesfully used back in November - but changed to exactly match full Windows domain LOCAL.NETWORK.ORG as given in maltobelli’s screenshot. It’s hopefully a little less confusing than the example in Microsofts own JDBC driver documentation which frankly also gets me slightly seasick :worried: .

I believe to have read domain name case is important, so: Replace 2 x UPPERCASE and 2 x lowercase versions of domain to match your environment.

After that your next step could be to check your krb.conf works with <Java path>\bin\kinit.exe [user] … as I just did below.

Template for krb.conf:

[logging]
# default = FILE:/var/log/krb5libs.log
# kdc = FILE:/var/log/krb5kdc.log
# admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
# default_realm = EXAMPLE.COM
 default_realm = LOCAL.NETWORK.ORG

[realms]
# EXAMPLE.COM = {
#  kdc = kerberos.example.com
#  admin_server = kerberos.example.com
# }
 LOCAL.NETWORK.ORG = {
  kdc = local.network.org
  admin_server = local.network.org
 }

I just re-checked the kinit step. Here’s my output when running in the directory with my krb.conf file:

C:\Hub\kerberos>"\Program Files\Java\jdk1.8.0_152\bin\kinit.exe"
Password for MYUSER@LOCAL.NETWORK.ORG:
New ticket is stored in cache file C:\Users\myuser\krb5cc_myuser
1 Like