无法让 Kerberos 身份验证从 linux 工作到 Windows 上的 MS-SQL 服务器。在 AD 中添加了新用户。
New-ADUser -Name "user" -GivenName "user" -SamAccountName "user" -UserPrincipalName "[email protected]" –AccountPassword (ConvertTo-SecureString "password" -AsPlainText -force) -Enabled $true
生成的密钥表文件。
ktpass -out krb5.keytab -mapUser [email protected] -pass password -crypto AES256-SHA1 -ptype KRB5_NT_PRINCIPAL -princ MSSQLSvc/sql.my.domain:[email protected]
将 krb5.conf 的配置添加到 linux 服务器
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_ccache_name = KEYRING:persistent:%{uid}
default_realm = MY.DOMAIN
[realms]
MY.DOMAIN = {
}
[domain_realm]
my.domain = MY.DOMAIN
.my.domain = MY.DOMAIN
将 keytab 复制到 linux serv
做过 kinit
kinit -k MSSQLSvc/sql.my.domain:[email protected]
klist 节目
klist
Ticket cache: FILE:/etc/krb/cache
Default principal: MSSQLSvc/sql.my.domain:[email protected]
Valid starting Expires Service principal
05/27/21 07:24:27 05/27/21 17:24:27 krbtgt/[email protected]
renew until 06/03/21 07:24:27
和失败...
/opt/mssql-tools/bin/sqlcmd -S sql.my.domain
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : SSPI Provider: Message stream modified.
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Cannot generate SSPI context.