microsoft / microsoft/go-sqlcmd

How to use Kerberos ticket cache on Linux?

Open
#468 16 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement Security
Dominant language
Go
Stars
595
Forks
91
Avg merge
9h 35m
Merged PRs (30d)
1

Description

Hello,

I want to use Kerberos on Debian 11 to authenticate with SQL Server but I'm struggling to get sqlcmd to catch on with what I'm trying to accomplish.

$ sqlcmd -E -S redacted\\inst01 --driver-logging-level=64
DRIVER:Dialing with protocol tcp
DRIVER:Returning connection from protocol tcp
DRIVER:got token tokenError
DRIVER:got ERROR 18456 Login failed for user ''.
DRIVER:got token tokenDone
DRIVER:got DONE or DONEPROC status=2
mssql: login error: Login failed for user ''.
mssql: login error: Login failed for user ''.

I have krb5-user and krb5-conf packages installed.

I logged in with kinit before running sqlcmd, which created a ticket cache in /tmp/krb5cc as is evident when I run klist.

$ klist
Ticket cache: FILE:/tmp/krb5cc
Default principal: redacteduser@REDACTED.DOMAIN

Valid starting       Expires              Service principal
10/10/2023 13:53:59  10/10/2023 23:53:59  krbtgt/REDACTED.DOMAIN@REDACTED.DOMAIN
        renew until 10/17/2023 13:53:55

Is it possible integrated authentication was just not implemented for Linux? I couldn't find any references to krb5conffile or krbcache in the code (which I believe is what the driver expects according to https://github.com/microsoft/go-mssqldb/pull/35).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the sqlcmd -E -S redacted\\inst01 invocation on Debian 11 after kinit, then inspect the authentication behavior referenced in go-mssqldb PR #35. Use klist and the driver logs to establish whether the ticket cache is supported; document the working configuration and invocation, or clearly record that Linux integrated authentication is unavailable.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
authentication, cli
Issue type
Documentation
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.