All Apps and Add-ons

DB Connect 2 connection is not using integrated authentication with SQL Server

trevorgould
Explorer

I have set up an identity (with username: MYDOMAINNAME backslash myusername) and a sql server connection (MS-SQL Server using generic driver) but am getting an error when a connection is attempted.

I can log onto the SQL Server itself with SSMS and see in the logs that the login is failing with this error:

Reason: Attempting to use an NT account name with SQL Server Authentication

I see no way in the DB CONNECTION 2 configuration screen to specify to use Integrated Authentication. From posts I've read here, entering the username in the form domain\username will cause it to use integrated authentication, but that seems to not be the case.

Tags (1)

jcoates_splunk
Splunk Employee
Splunk Employee

This is a deep pile of issues, so I'll try to summarize.

  1. DB Connect 1.1.x with Java 7 and the jTDS driver should work for your use case. However, Java 7 is now out of support by Oracle, and you should really be considering how to get off of it.
  2. DB Connect 1.2.x requires Java 8, but that breaks the jTDS driver. That's actually okay because the Microsoft JDBC driver performs better and has more features, and should be able to do this.
  3. DB Connect 2.0.x also requires Java 8 and Microsoft JDBC driver, but we messed up the ability to use Windows authentication instead of SQL authentication. That's getting fixed soon.... if you're desperate and on Windows there's a complex work-around that should really involve a support ticket.

bosburn_splunk
Splunk Employee
Splunk Employee

Documentation has been updated on how to set up integrated authentication:
DBX V2 Troubleshooting - Windows Authentication

trevorgould
Explorer

To be clear: This is for the jTDS driver driver as opposed to the Microsoft driver, correct?

0 Karma

jcoates_splunk
Splunk Employee
Splunk Employee

yes, the driver's mentioned in the jdbc url... but it will only work with a DBX 2 install, not a DBX 1.2 install.

0 Karma

halr9000
Motivator

Looking at posts like this one, I think they are DB Connect v1, which was a different codebase. It's possible that this is done differently in v2, but I don't know the right answer.

0 Karma

Richfez
SplunkTrust
SplunkTrust

I haven't had time to investigate further, but in initial testing we also had some serious problems with DB Connect 2 using integrated authentication. We could not seem to make it work regardless of how we configured things.

We have 20 or 30 inputs of various sorts (both integrated and local auth) against SQL server in DB Connect v1 with nary a problem. But in v2, we can't get a one of those to work no matter how we try to configure them. Switching those inputs to a local SQL auth works perfectly regardless of v1 or v2.

Not an ideal solution, but again, we haven't had the time to look into it further and we'll get it working before we start actually deploying things using v2.

0 Karma

trevorgould
Explorer

So is V1 just fine or are there feature/performance benefits to V2 that one should wait for?

0 Karma

halr9000
Motivator

I learned later last night that this is a known issue with dbx2, and a workaround should be posted within a few days.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...