microsoft / microsoft/go-sqlcmd
How to use Kerberos ticket cache on Linux?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 595
- Forks
- 91
- Avg merge
- 9h 35m
- Merged PRs (30d)
- 1
Description
Hello,
I want to use Kerberos on Debian 11 to authenticate with SQL Server but I'm struggling to get sqlcmd to catch on with what I'm trying to accomplish.
$ sqlcmd -E -S redacted\\inst01 --driver-logging-level=64
DRIVER:Dialing with protocol tcp
DRIVER:Returning connection from protocol tcp
DRIVER:got token tokenError
DRIVER:got ERROR 18456 Login failed for user ''.
DRIVER:got token tokenDone
DRIVER:got DONE or DONEPROC status=2
mssql: login error: Login failed for user ''.
mssql: login error: Login failed for user ''.
I have krb5-user and krb5-conf packages installed.
I logged in with kinit before running sqlcmd, which created a ticket cache in /tmp/krb5cc as is evident when I run klist.
$ klist
Ticket cache: FILE:/tmp/krb5cc
Default principal: redacteduser@REDACTED.DOMAIN
Valid starting Expires Service principal
10/10/2023 13:53:59 10/10/2023 23:53:59 krbtgt/REDACTED.DOMAIN@REDACTED.DOMAIN
renew until 10/17/2023 13:53:55
Is it possible integrated authentication was just not implemented for Linux? I couldn't find any references to krb5conffile or krbcache in the code (which I believe is what the driver expects according to https://github.com/microsoft/go-mssqldb/pull/35).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the sqlcmd -E -S redacted\\inst01 invocation on Debian 11 after kinit, then inspect the authentication behavior referenced in go-mssqldb PR #35. Use klist and the driver logs to establish whether the ticket cache is supported; document the working configuration and invocation, or clearly record that Linux integrated authentication is unavailable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- authentication, cli
- Issue type
- Documentation
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100