SSPI Provider: Server not found in Kerberos database-CodePudding

I'm trying to connect from Ubuntu 20.04 client to the MS SQL Server 2014 located on windows server 2012R2.

Realm joins and Kinit are fine.

# sudo realm discover org.internal --install=/
org.internal
  type: kerberos
  realm-name: ORG.INTERNAL
  domain-name: org.internal
  configured: kerberos-member
  server-software: active-directory
  client-software: sssd
  required-package: sssd-tools
  required-package: sssd
  required-package: libnss-sss
  required-package: libpam-sss
  required-package: adcli
  required-package: samba-common-bin
  login-formats: %[email protected]
  login-policy: allow-realm-logins

# kinit -V [email protected]
Using default cache: /tmp/krb5cc_0
Using principal: [email protected]
Password for [email protected]:
Authenticated to Kerberos v5


# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: [email protected]

Valid starting     Expires            Service principal
12/17/21 10:49:31  12/17/21 20:49:31  krbtgt/[email protected]
        renew until 12/24/21 10:49:24
12/17/21 10:51:21  12/17/21 20:49:31  MSSQLSvc/ws2012r2:[email protected]
        renew until 12/24/21 10:49:24
12/17/21 10:51:57  12/17/21 20:49:31  [email protected]
        renew until 12/24/21 10:49:24
12/17/21 10:52:30  12/17/21 20:49:31  MSSQLSvc/ws2012r2.org.internal:[email protected]
        renew until 12/24/21 10:49:24

When I do sqlcmd, I got below error. Note if I specify username and password (sql authentication) it will work.

# sqlcmd -S 20.12.34.567
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : SSPI Provider: Server not found in Kerberos database.
Sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Cannot generate SSPI context.


SPN is below
setspn -L user

Registered ServicePrincipalNames for CN=User ABC,CN=Users,DC=org,DC=internal: 
        MSSQLSvc/ws2012r2:1433

Any help is much appreciated!

One question here, I did generate a keytab file. However what's the command to tell SQL Server 2014 on windows server 2012r2 to use the keytab file?

CodePudding user response：

Accessing the server via IP won't allows DNS name-based SPN to work. The SPN with the IP address is not registered. Use the domain name of the server.