question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Add constrained delegation support

See original GitHub issue

I am able to obtain a service ticket for SQL Server using an impersonated credential with Java 8 but when I try to use this with the driver I am getting the next error:

KrbException: The ticket isn’t for us (35)

It seems that the problem is in the KerbAuthentication class inside the method intAuthInit(). In this class a context is created for the authentication and this context requests that the initiator’s credentials be delegated to the acceptor during context establishment. This behavior is not possible within a constrained delegation scenario.

The service ticket obtained using the impersonated credential is not a forwardable ticket and is not usable for the driver. Changing the next set to false makes the authentication works.

peerContext.requestCredDeleg(true);

I understand this is not the right change since the SQL Server can need to use a delegated credential in order to connect to other SQL Server instances using open delegation, but a change is necessary to set this property to false in a constrained delegation scenery.

Issue Analytics

  • State:closed
  • Created 7 years ago
  • Comments:14 (12 by maintainers)

github_iconTop GitHub Comments

2reactions
Suraiya-Hameedcommented, Mar 7, 2017

Support for constrained delegation is added in #178. Can you please review and test it?

You can add GSSCredential to the driver connection property and pass impersonated credential as value.

1reaction
jacobovazquezcommented, Mar 9, 2017

I tried both, 4.1 and 4.2, and it is working. Thanks!

Read more comments on GitHub >

github_iconTop Results From Across the Web

How to configure Kerberos Constrained Delegation for Web ...
Scenario 1: Configure constrained delegation for a custom service account · 1. Add an SPN to the service account · 2. Configure the...
Read more >
Configure Constrained Delegation in Active Directory
Constrained delegation is configured on the web server's account in Active ... Network Service, Local System, or Local Service), constrained delegation is ...
Read more >
How to Configure Kerberos Constrained Delegation
Starting in SAS 9.4M6, is support for constrained delegation. Prior to enabling Kerberos ... Click Add, and then click Users and Computers.
Read more >
Configuring Kerberos constrained delegation for out ... - IBM
Open the Delegation tab in the user account. · Select the Trust this user for delegation to specified services only radio button. ·...
Read more >
Enable Kerberos Constrained Delegation for the AD ...
Use the SetSpn command to set a Service Principal Name (SPN) for the AD Connector service account in the on-premises AD. · Open...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found