microsoft / microsoft/vscode-mssql

Cannot authenticate using Kerberos in MacOS

Open
#18,943 6 comments 3 reactions 1 assignee Claimed by @Benjin View on GitHub
Area - Connection Bug Pri: 2 Triage: Done
Dominant language
TypeScript
Stars
1.9k
Forks
610
Avg merge
2d 3h
Merged PRs (30d)
97

Description

* MSSQL Extension Version: 1.29.1
* VSCode Version: 1.98.0
* OS Version: MacOS 15.2

Cannot use Windows Authentication to connect to an SQL server in VS Code. Kerberos with exact the same conf file was working on the Azure Data Studio. Now I get the following error:

> Cannot authenticate using Kerberos. Ensure Kerberos has been initialized on the client with 'kinit' and a Service Principal Name has been registered for the SQL Server to allow Kerberos authentication. ErrorCode=InternalError, Exception=Interop+NetSecurityNative+GssApiException: GSSAPI operation failed with error - An unsupported mechanism was requested (unknown mech-code 0 for mech unknown). at System.Net.Security.NegotiateStreamPal.GssInitSecurityContext(SafeGssContextHandle& context, SafeGssCredHandle credential, Boolean isNtlm, SafeGssNameHandle targetName, GssFlags inFlags, Byte[] buffer, Byte[]& outputBuffer, UInt32& outFlags, Int32& isNtlmUsed) at System.Net.Security.NegotiateStreamPal.EstablishSecurityContext(SafeFreeNegoCredentials credential, SafeDeleteContext& context, String targetName, ContextFlagsPal inFlags, SecurityBuffer inputBuffer, SecurityBuffer outputBuffer, ContextFlagsPal& outFlags) at Microsoft.Data.SqlClient.SNI.SNIProxy.GenSspiClientContext(SspiClientContextStatus sspiClientContextStatus, Byte[] receivedBuff, Byte[]& sendBuff, Byte[][] serverName) at Microsoft.Data.SqlClient.SNI.TdsParserStateObjectManaged.GenerateSspiClientContext(Byte[] receivedBuff, UInt32 receivedLength, Byte[]& sendBuff, UInt32& sendLength, Byte[][] _sniSpnBuffer) at Microsoft.Data.SqlClient.TdsParser.SNISSPIData(Byte[] receivedBuff, UInt32 receivedLength, Byte[]& sendBuff, UInt32& sendLength)

Steps to Reproduce:
1. Followed the steps here https://github.com/microsoft/vscode-mssql/blob/main/extensions/mssql/KERBEROS_HELP.md
2. Ran kinit
3. Verify that there is a ticket created with klist on the specific domain
4. Try to create a new connection with the server name and the Windows Authentication selected

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.