Connect Azure Data Studio to SQL Server using Kerberos
Azure Data Studio supports connecting to SQL Server by using Kerberos.
To use integrated authentication (Windows Authentication) on macOS or Linux, you need to set up a Kerberos ticket that links your current user to a Windows domain account.
Prerequisites
To get started, you need:
Access to a Windows domain-joined machine to query your Kerberos domain controller.
SQL Server should be configured to allow Kerberos authentication. For the client driver running on Unix, integrated authentication is supported only by using Kerberos. For more information, see Using Kerberos integrated authentication to connect to SQL Server. There should be service principal names (SPNs) registered for each instance of SQL Server you're trying to connect to. For more information, see Register a Service Principal Name for Kerberos Connections.
Check if SQL Server has a Kerberos setup
Sign in to the host machine of SQL Server. From the Windows command prompt, use setspn -L %COMPUTERNAME% to list all the SPNs for the host. Verify there are entries that begin with MSSQLSvc/HostName.contoso.com. These entries mean that SQL Server has registered an SPN and is ready to accept Kerberos authentication.
If you don't have access to the host of the SQL Server instance, then from any other Windows OS joined to the same Active Directory, you could use the command setspn -L <SQLSERVER_NETBIOS>, where <SQLSERVER_NETBIOS> is the computer name of the host of the SQL Server instance.
Get the Kerberos Key Distribution Center
Find the Kerberos Key Distribution Center (KDC) configuration value. Run the following command on a Windows computer that's joined to your Active Directory domain.
Run nltest from the command line, and replace "DOMAIN.CONTOSO.COM" with your domain's name.
nltest /dsgetdc:DOMAIN.CONTOSO.COM
Output is similar to the following sample:
DC: \\dc-33.domain.contoso.com
Address: \\2111:4444:2111:33:1111:ecff:ffff:3333
...
The command completed successfully
Copy the DC name that's the required KDC configuration value. In this case, it's dc-33.domain.contoso.com.
Join your OS to the Active Directory domain controller
sudo apt-get install realmd krb5-user software-properties-common python-software-properties packagekit
Edit the /etc/network/interfaces file so that your Active Directory domain controller's IP address is listed as dns-nameserver. For example:
<...>
# The primary network interface
auto eth0
iface eth0 inet dhcp
dns-nameservers **<AD domain controller IP address>**
dns-search **<AD domain name>**
Note
The network interface (eth0) might differ for different machines. To find out which one you're using, run ifconfig and copy the interface that has an IP address and transmitted and received bytes.
After editing this file, restart the network service:
sudo ifdown eth0 && sudo ifup eth0
Now check that your /etc/resolv.conf file contains a line like the following one:
nameserver **<AD domain controller IP address>**
Join to the Active Directory domain:
sudo realm join contoso.com -U 'user@CONTOSO.COM' -v
Here's the expected output:
<...>
* Success
Test the ticket granting ticket retrieval
Get a Ticket Granting Ticket (TGT) from KDC.
kinit username@DOMAIN.CONTOSO.COM
View the available tickets by using klist. If the kinit was successful, you should see a ticket.
klist
Here's the expected output:
krbtgt/DOMAIN.CONTOSO.COM@ DOMAIN.CONTOSO.COM.
Connect by using Azure Data Studio
Create a new connection profile.
Select Windows Authentication as the authentication type.
For the Server, enter a fully qualified host name, in the format
hostname.DOMAIN.CONTOSO.COM.Complete the connection profile, and select Connect.
After successfully connecting, your server appears in the SERVERS sidebar.
Feedback
Coming soon: Throughout 2024 we will be phasing out GitHub Issues as the feedback mechanism for content and replacing it with a new feedback system. For more information see: https://aka.ms/ContentUserFeedback.
Submit and view feedback for