search

microsoft / azuredatastudio

Azure Data Studio is a data management and development tool with connectivity to popular cloud and on-premises databases. Azure Data Studio supports Windows, macOS, and Linux, with immediate capability to connect to Azure SQL and SQL Server. Browse the extension library for more database support options including MySQL, PostgreSQL, and MongoDB.
https://learn.microsoft.com/sql/azure-data-studio
MIT License
7.56k stars 900 forks source link

Authentication with Domain Credential on macOS #24665

Closed oguzhankircali closed 11 months ago

oguzhankircali commented 12 months ago

Type: Authentication with Domain Credential on macOS

Hi there, I want to use Azure Data Studio instead of my current DB client, but I can not connect. I have a domain credential and I need to use it in order to connect the database from macOS but there is no authentication option for that. My macOS is not belong a domain.

Azure Data Studio version: azuredatastudio 1.46.0 (39449bbe88a0bc4092c9b205cad10d0a556beffd, 2023-09-16T01:40:22.177Z) OS version: Darwin x64 23.0.0 Restricted Mode: No Preview Features: Enabled Modes:

cheenamalhotra commented 12 months ago

Hi @oguzhankircali

May I know what is the current DB client you're able to connect with and which authentication mode are you using?

Secondly, when you say Domain Credential, is it of the format: HOSTDOMAIN\myname?

And lastly, have you tried setting up Kerberos on this machine as instructed here: https://learn.microsoft.com/en-us/sql/azure-data-studio/enable-kerberos?view=sql-server-ver16&tabs=mac#join-your-os-to-the-active-directory-domain-controller (3rd tab)

oguzhankircali commented 11 months ago

My database client is DataGrip. Here is the properties of my connection:

CleanShot 2023-10-25 at 21 58 49@2x

cheenamalhotra commented 11 months ago

Datagrip seems to be using the old third-party jTDS driver that supports NTLM, but Microsoft's SqlClient driver used by ADS doesn't support it due to it being insecure.

Kerberos authentication is the only possible way to login with domain credentials in Unix platforms, and for that you need to login with the domain user in a domain joined machine, setup for Kerberos, generate a Kerberos ticket and then authenticate.