SQLMuggle

Xavier,

I believe the errors being seen by peeps are due to the SPN not being set on the SQL Server. When SQL Server is run under a domain account there are certain steps a Windows Admin/SQL Server Admin has to do with the account to allow Kerberos Authentication.. Most companies don't do it because it will fall back to NTLM..

The Most important Step and one to be done by a professional at an Organization ( you can't screw this up lol, or Account could go haywire..) is allocating Permissions in Active Directory to the Service Account running SQL Server

1. Log into Domain Controller

2. Open ADSI Edit ( Extremely powerful Tool, dont screw this up) Domain Admins etc only have access

3. Find the account in question

4. Right Click Properties -> Security Tab

5.Select "SELF"

6.Click Advanced

7.Click Add

8.Click "Select Principal"

9. Search for Principal name ( What AD account runs SQL Server)

10.Scroll through and Make sure "Read servicePrincipalName" and "Read msDS-PrincipalName" are checkmarked

11.Click Ok

12.Click Apply

Steps needed to Verify if Account CHanged Worked

1. SQL Server Instance would then need to be restarted for it to take affect (Schedule a Change Control)

2.Connect to SQL SSMS or Azure Data Studio

3.Connect to Instance

4.Management -> SQL Server Logs

5.Right click the Log after the SQL Restart Time Frame -> View SQL Server Log

6.Looking for a log message that says "The SQL Server Network Interface library successfully registered the Service Principal Name (SPN) (More code in message specific to your environment)" in the message. If they don't see this then Kerberos will not work

There Mac Administrators also need to set up there krb5.conf ( https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html) - there is an example and push it out to all macs ( Obviously you cannot help with this, nor would anyone on a forum, but someone in their organization should be able to )

Now I am using on MacOS Monterey ( Previously on older versions) w/ Enterprise Edition 2021.2.14-> With all this Set up When adding our License via the SQL Server Database we run into "UserLogin Required" if we choose Integrated Security (Active Directory) - Experimental.

Work Around:

1.Change it to SQL Login ( We create a SQL Login only for initial connection Only via the app itself with I believe RO or USer Rights ) - to bypass the User Login Required ( this is probably an issue with how your code calls the connection to save the Data source, but am not sure ) ( To save the initial Data Source) ( Basically has no rights inside of SQL At all, just public access)

2.We then Modify the DataSource for this back to "Integrated Security (Active Directory) - Experimental" and Kerberos Connections Are working ( Verified on the SQL Server Itself) and able to connect to Other Windows Instances etc with credentials etc

Hope this Helps

~SQLMuggle~