dbcli / dbcli/mssql-cli

GSSAPI operation failed with error - An invalid status code was supplied (Server not found in Kerberos database).

Open
#243 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
1.4k
Forks
191
PR merge metrics
No merged PRs in 30d

Description

mssql-cli try only default_realm in /etc/krb5.conf
if mssql has another realm than default it will throw exception.

```
Error message: Cannot authenticate using Kerberos. Ensure Kerberos has been initialized on the client with 'kinit' and a Service Principal Name has been registered for the SQL Server to allow Kerberos authentication.
ErrorCode=InternalError, Exception=Interop+NetSecurityNative+GssApiException: GSSAPI operation failed with error - An invalid status code was supplied (Server not found in Kerberos database).
at System.Net.Security.NegotiateStreamPal.GssInitSecurityContext(SafeGssContextHandle& context, SafeGssCredHandle credential, Boolean isNtlm, SafeGssNameHandle targetName, GssFlags inFlags, Byte[] buffer, Byte[]& outputBuffer, UInt32& outFlags, Int32& isNtlmUsed)
at System.Net.Security.NegotiateStreamPal.EstablishSecurityContext(SafeFreeNegoCredentials credential, SafeDeleteContext& context, String targetName, ContextFlagsPal inFlags, SecurityBuffer inputBuffer, SecurityBuffer outputBuffer, ContextFlagsPal& outFlags)
at System.Data.SqlClient.SNI.SNIProxy.GenSspiClientContext(SspiClientContextStatus sspiClientContextStatus, Byte[] receivedBuff, Byte[]& sendBuff, Byte[] serverName)
at System.Data.SqlClient.SNI.TdsParserStateObjectManaged.GenerateSspiClientContext(Byte[] receivedBuff, UInt32 receivedLength, Byte[]& sendBuff, UInt32& sendLength, Byte[] _sniSpnBuffer)
at System.Data.SqlClient.TdsParser.SNISSPIData(Byte[] receivedBuff, UInt32 receivedLength, Byte[]& sendBuff, UInt32& sendLength)
```

**# sqlcmd work normal**

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the Kerberos connection with a non-default realm, comparing mssql-cli with the working sqlcmd behavior and the /etc/krb5.conf default_realm setting. Trace where the SQL Server authentication target is selected; done means mssql-cli authenticates successfully when the server uses a realm other than the default and the reported GSSAPI error no longer occurs.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, sql
Domain
authentication, cli, databases
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.