SQL Clone
SQLServerCentral is supported by Redgate
 
Log in  ::  Register  ::  Not logged in
 
 
 


Lab - Vcloud - Kerberos not working


Lab - Vcloud - Kerberos not working

Author
Message
Sarah Wagner
Sarah Wagner
SSCommitted
SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)

Group: General Forum Members
Points: 1640 Visits: 715
We have a production environment that we have used to clone into our lab environment for testing. We are using Vcloud Director to host this virtual environment. In production all of our linked servers are using Kerberos for security to use logins own context. In our VCloud environment everything looks the same as production. The problem we are having is that everything looks good as far as SPN goes and in AD the sql server service account is running under an account that uses account delegation but we are still getting the error:
Msg 18456, Level 14, State 1, Line 1 Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'
We tried to verify it is using kerberos with this query, "select net_transport, auth_scheme from sys.dm_exec_connections where session_id=@@spid". However in vcloud it returns NTLM, and production is returns Kerberos. We have tried a bunch of things and nothing seems to work. We rebooted machines, added and removed account delegation in AD, etc. Anyone else run into this?
Joie Andrew
Joie Andrew
SSCrazy
SSCrazy (2.4K reputation)SSCrazy (2.4K reputation)SSCrazy (2.4K reputation)SSCrazy (2.4K reputation)SSCrazy (2.4K reputation)SSCrazy (2.4K reputation)SSCrazy (2.4K reputation)SSCrazy (2.4K reputation)

Group: General Forum Members
Points: 2427 Visits: 2032
If you open up a command prompt and run the following, what do you get?

setspn -L <domainName>\<accountName>

Where <domainName> is the pre-Windows 2000 naming convention for the domain (ex: Famicam) and <accountName> is the name of the service account that the SQL Server service account is running under (ex: svc.sql.server). So for example one would run:

setspn -L famicam\svc.sql.server

You should get entries back for the MSSQLSvc for your SQL server.

Are connections being made directly from an application to the database, or is there more hops involved? For example like with SSRS, a user hits a report server and then the report server can relay the credentials back to the SQL Server. Just curious because depending on how many hops there are there could be several layers of delegation between different accounts/services that need to be setup.

Joie Andrew
"Since 1982"
Sarah Wagner
Sarah Wagner
SSCommitted
SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)SSCommitted (1.6K reputation)

Group: General Forum Members
Points: 1640 Visits: 715
The servers were listed in the SETSPN -L. Somehow the problem is resolved, we still aren't sure how. We removed and registered some of the servers in DNS and removed some of the SPN and re-added, eventually we must have done the right thing. It is working for us now. Thanks for your help.
Go


Permissions

You can't post new topics.
You can't post topic replies.
You can't post new polls.
You can't post replies to polls.
You can't edit your own topics.
You can't delete your own topics.
You can't edit other topics.
You can't delete other topics.
You can't edit your own posts.
You can't edit other posts.
You can't delete your own posts.
You can't delete other posts.
You can't post events.
You can't edit your own events.
You can't edit other events.
You can't delete your own events.
You can't delete other events.
You can't send private messages.
You can't send emails.
You can read topics.
You can't vote in polls.
You can't upload attachments.
You can download attachments.
You can't post HTML code.
You can't edit HTML code.
You can't post IFCode.
You can't post JavaScript.
You can post emoticons.
You can't post or upload images.

Select a forum

































































































































































SQLServerCentral


Search