mithrandyr / SimplySql

PowerShell module for querying various SQL databases
MIT License
197 stars 31 forks source link

Open-SQLConnection -Credential to support windows auth #128

Closed insomniacc closed 6 months ago

insomniacc commented 7 months ago

Feature idea: I may be wrong, but it seems currently Open-SQLConnection only supports SQL auth and not Windows auth? I've tested with domain\username & username@domain but each time it's rejected. It would be good to be able to use windows auth via this method also, I think the only way currently is running this commands in the context of that user - which in my current case isnt feasible (this will be run non-interactively from a system context and I'd love to be able to pass a windows auth credential to -credential).

Btw - love the module, thanks for the work you've put in to this!

mithrandyr commented 7 months ago

@insomniacc -- Open-SQLConnection does support windows authentication, but not providing credentials, it will automatically use your existing credentials. If you want to use Windows Auth with a different set of credentials, then you need to run the powershell process under that account. Unfortunately, I'm not aware of a way for powershell running under UserA to connect to SQL Server by windows authentication (but of UserB). Theoretically, I could look at implementing some form of impersonation -- but that complicates things. So what is the exact scenario that you have?

insomniacc commented 7 months ago

Ah, thought it might be something I was missing but obviously sounds like there's a lot more complexity to it. I've also found some other issues to my environment which have also complicated matters around this one.

To give you more context, I'm building out a powershell universal instance (web apps & automation framework). It's running in the system context and any PS scripts on the platform also execute in that context too by default. There is a method to run them in the context of other users - so I'll just look into that as you've suggested. Although right now, due to another complication relating with outbound access (I know - it's a bizarre one), that option isn't available, but I'll wait on my networking team to help me resolve that.