search

ultorg / public_issues

Public issue tracker for the Ultorg Desktop application
12 stars 0 forks source link

"PKIX path building failed" when connecting to Microsoft SQL Server #2

Open eirikbakke opened 2 years ago

eirikbakke commented 2 years ago

When connecting Ultorg to a Microsoft SQL Server instance, some users reported an error in the New Connection Wizard starting "PKIX path building failed".

One workaround is to add ";trustServerCertificate=true" to the end of the JDBC URL.

The connection will still be encrypted, but the client won't try to verify the identity of the server. Alternatively, the latter security feature can be configured with the trustStore property.

More information on these settings here: https://docs.microsoft.com/en-us/sql/connect/jdbc/connecting-with-ssl-encryption?view=sql-server-ver15 https://docs.microsoft.com/en-us/sql/connect/jdbc/understanding-ssl-support?view=sql-server-ver15 https://docs.microsoft.com/en-us/sql/connect/jdbc/configuring-the-client-for-ssl-encryption?view=sql-server-ver15

The TODO for Ultorg will probably be to document these properties within the connection UI. Or perhaps the "-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT" property should be set at the application level; I noticed that DBeaver does this by default.

davrax commented 2 years ago

Ran into this error today- the workaround unblocked me. One thing I would've looked for is the ability to configure SQL Server Auth in the Ultorg Connection UI- specifying Windows Auth vs SQL Server Auth, SSL Enabled Y/N, etc.

I'm one of (presumably few) users working from an Apple Silicon Mac and MS SQL Server, so the ODBC/JDBC driver situation alone is complex.

eirikbakke commented 2 years ago

@davrax Yeah, I'd love to simplify the connection experience. The challenge is, there are so many different combinations of setups, and it would be hard to test them all.

A short-term solution I'm thinking of is to add a sidebar with a FAQ/documentation in the connection dialog itself, e.g. so that workarounds like these could be documented right next to where you need to type them in. And I could add links to the official documentation etc.

By the way, in your case, was there any problems with the bundled JDBC driver?

davrax commented 2 years ago

@eirikbakke Understandable- I think that'd be sufficient for your current group of users. No issues with your bundled JDBC driver (the issues I mentioned were with another vendor's software), and thanks for compiling a native ARM64 .dmg!

eirikbakke commented 2 years ago

Great! Yeah, the new MacBooks are super fast when you give them the right binaries... I want one now.