vscode-mssql/KERBEROS_HELP.md

In order to use Integrated Authentication (aka Windows Authentication) on macOS or Linux you will need to setup a Kerberos ticket linking your current user to a Windows domain account. A summary of key steps are included below.

Setup Kerberos on Mac

Requirements

Access to a Windows domain-joined machine in order to query your Kerberos Domain Controller

Steps to set up Integrated Authentication

Step 1: Find Kerberos KDC (Key Distribution Center)

• Run on: Windows, Windows command line
• Action: nltest /dsgetdc:DOMAIN.COMPANY.COM (where “DOMAIN.COMPANY.COM” maps to your domain’s name)
• Sample Output

  DC: \\dc-33.domain.company.com
  Address: \\2111:4444:2111:33:1111:ecff:ffff:3333
  ...
  The command completed successfully
  

• Information to extract The DC name, in this case dc-33.domain.company.com

Step 2: Configuring KDC in krb5.conf

• Run on: MAC

• Action: Edit the /etc/krb5.conf in an editor of your choice. Configure the following keys

  [libdefaults]
    default_realm = DOMAIN.COMPANY.COM
   
  [realms]
  DOMAIN.COMPANY.COM = {
     kdc = dc-33.domain.company.com
  }
  

  Then save the krb5.conf file and exit

  Note Domain must be in ALL CAPS

Step 3: Testing the Ticket Granting Ticket retrieval

• Run on: Mac
• Action:
  • Use the command kinit username@DOMAIN.COMPANY.COM to get a TGT from KDC. You will be prompted for your domain password.
  • Use klist to see the available tickets. If the kinit was successful, you should see a ticket from krbtgt/DOMAIN.COMPANY.COM@ DOMAIN.COMPANY.COM.

Step 4: Connect in VSCode

• Create a new connection profile
• Choose Integrated as the authentication type
• If all goes well and the steps above worked, you should be able to connect successfully!

Setup Kerberos on Linux

Step 0: Install krb5-user package

• Run on: Linux
• Action: apt-get krb5-user

Step 1: Find Kerberos KDC (Key Distribution Center)

• Run on: Windows command line
• Action: nltest /dsgetdc:DOMAIN.COMPANY.COM (where “DOMAIN.COMPANY.COM” maps to your domain’s name)
• Sample Output

  DC: \\dc-33.domain.company.com
  Address: \\2111:4444:2111:33:1111:ecff:ffff:3333
  ...
  The command completed successfully
  

• Information to extract The DC name, in this case co1-red-dc-33.domain.company.com

Step 2: Configuring KDC in krb5.conf

• Run on: Linux

• Action: Edit the /etc/krb5.conf in an editor of your choice. Configure the following keys

  [libdefaults]
    default_realm = DOMAIN.COMPANY.COM
   
  [realms]
  DOMAIN.COMPANY.COM = {
     kdc = dc-33.domain.company.com
  }
  

  Then save the krb5.conf file and exit

  Note Domain must be in ALL CAPS

Step 3: Testing the Ticket Granting Ticket retrieval

• Run on: Linux
• Action:
  • Use the command kinit username@DOMAIN.COMPANY.COM to get a TGT from KDC. You will be prompted for your domain password.
  • Use klist to see the available tickets. If the kinit was successful, you should see a ticket from krbtgt/DOMAIN.COMPANY.COM@ DOMAIN.COMPANY.COM.

Step 4: Connect in VSCode

• Create a new connection profile
• Choose Integrated as the authentication type
• If all goes well and the steps above worked, you should be able to connect successfully!