Enable double-hop kerberos authentication for SQL queries and SQL Reports

Question

Enable double-hop kerberos authentication for SQL queries and SQL Reports

kevin_nikolai

SSCarpal Tunnel

Points: 4343
More actions
July 1, 2012 at 1:59 pm

#260664

Want to run sql queries from my desktop PC (SQL 2008 R2) via ServerA (SQL 2008 R2) on ServerB (SQL 2008 R2). Heard they call this double-hop kerberos authentication. Will be using Windows Authentication. How do you accomplish this ?

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply

Evil Kraig F SSC Guru Points: 100851 More actions · Answer 1

Your sysadmin will need to do it. Google it up, the list of instructions is long and intricate. Basically you need to end up having kerberos on Machine B trust Kerberos on Machine A.

- Craig Farrell

Never stop learning, even if it hurts. Ego bruises are practically mandatory as you learn unless you've never risked enough to make a mistake.

For better assistance in answering your questions[/url] | Forum Netiquette
For index/tuning help, follow these directions.[/url] |Tally Tables[/url]
Twitter: @AnyWayDBA

kevin_nikolai SSCarpal Tunnel Points: 4343 More actions · Answer 2

Both (ServerA - SQL Report Server + database) and (ServerB - SQL Cluster) have kerberos enabled.

Clients PC's connect to ServerA to run SQL Reports.

ServerA Report opens SQL stored procedure/s on ServerA, then connects to ServerB to fetch data.

When testing Kerberos ServerB always passes test but ServerA seldom does:

select net_transport, auth_scheme

from sys.dm_exec_connections

where session_id=@@spid

Jeff Moden SSC Guru Points: 1004312 More actions · Answer 3

Don't be surprised if you SysAdmin refuses to fix the "problem". It's actually a pretty good security "feature".

--Jeff Moden

RBAR is pronounced "ree-bar" and is a "Modenism" for Row-By-Agonizing-Row.
First step towards the paradigm shift of writing Set Based code:
________Stop thinking about what you want to do to a ROW... think, instead, of what you want to do to a COLUMN.

Change is inevitable... Change for the better is not.

Helpful Links:
How to post code problems
How to Post Performance Problems
Create a Tally Function (fnTally)