Home | Contact Us | FAQ | Search & Site Map | Link to Us
Sign In | Join | Other 45 Sites in Network
Home
Discussion Groups
DB Engine
SQL ServerMSDESQL Server CE
Services
Analysis (Data Mining)Analysis (OLAP)DTSIntegration ServicesNotification ServicesReporting Services
Programming
CLRConnectivitySQLXML
Other Technologies
ClusteringEnglish QueryFull-Text SearchReplicationService Broker
General
Data WarehousingPerformanceSecuritySetupSQL Server ToolsOther SQL Server Topics
DirectoryUser Groups
Related Topics
MS AccessOther DB ProductsMS Server Products.NET DevelopmentVB DevelopmentJava DevelopmentMore Topics ...

SQL Server Forum / General / Security / February 2008

Tip: Looking for answers? Try searching our database.

An issue with SQL 2005 and Kerberos...

Thread view: 
Enable EMail Alerts  Start New Thread
Thread rating: 
Camilo - 16 Feb 2008 01:24 GMT
I am having trouble getting SQL 2005 to authenticate using Kerberos.
Regardless of what I try the authentication always goes through NTLM.
Following is the situation:

We have a test domain setup with a substantial amount of servers. I know
that Kerberos is properly setup in that domain because many different test
SharePoint deployments under different configurations has been successfully
setup and it all cases it has been verified that Kerberos is being used as
the authentication mechanism between servers.

However, all the connections from these SharePoint servers to the SQL Server
2005 servers are authenticating using NTLM. The way I am checking the
authentication mechanism is running the following query and checking the
value displayed in the auth_scheme column:

Use Master
select * from sys.dm_exec_connections

I tried removing IIS from the equation and tested connecting from one SQL
box in the same domain to another one using SQL Server Management Studio. The
results are the same, the server is authenticating using NTLM.

All the SQL instances I am working with are 1+1 Clusters with two active
instances. They are all installed over Windows 2003 Server and with SQL 2005
SP2 applied. I checked in the cluster administrator tool and Kerberos seems
to be enabled (the check box is selected in the cluster name resource and
everything is online).

Could someone give me some guidance on how to troubleshoot this problem?

Thanks!

Camilo
Russell Fields - 18 Feb 2008 14:45 GMT
Camilo,

One possibility is that you are the victim of a duplicate SPN.  Here are a
couple of links discussing that.
http://www.planetmagpie.com/itconsulting/technotes-060205.aspx
http://support.microsoft.com/kb/832109

I am not an expert on this, but I have experienced this problem a couple of
times and had to get a domain admin to fix it.

RLF

>I am having trouble getting SQL 2005 to authenticate using Kerberos.
> Regardless of what I try the authentication always goes through NTLM.
[quoted text clipped - 34 lines]
>
> Camilo
Camilo - 21 Feb 2008 19:57 GMT
Thank you Rusell!

At the en it was an SPN issue. They were not duplicate but htey were setup
wrong.
The first issue was that they were using the wrong FQDN, pointing to a DNS
alias that was not the physucal host and the second issue was that the they
were including the instance name in the FQDN.

Once again,

Thanks!

Camilo
Russell Fields - 21 Feb 2008 22:12 GMT
Camilo,

Very glad to hear that you were able to get it worked out.

RLF

> Thank you Rusell!
>
[quoted text clipped - 10 lines]
>
> Camilo
 
Sign In
Join
My Latest Posts
My Monitored Threads
My Blog
My Photo Gallery
My Profile
My Homepage

Start New Thread
Enable EMail Alerts
Rate this Thread



©2009 Advenet LLC   Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.