JDBC: This driver is not configured for integrated authentication




I’ve had about 4 cases in the last two months that centered around the following error when trying to use Windows Integrated authentication with JDBC.

java.sql.SQLException: This driver is not configured for integrated authentication

The key environment point on this was that they were trying to do this on a Linux platorm and not a Windows platform.  Specifically they were running WebSphere on a Linux platform.  The last one I worked on was running WebSphere 8.5.

There is only one location within the JDBC Driver where this particular error is raised.  It is when we are trying to use Kerberos and the Authentication Scheme is set to NativeAuthentication, which is the default setting for this property. Starting in the JDBC 4.0 driver, you can use the authenticationScheme connection property to indicate how you want to use Kerberos to connect to SQL.  There are two settings here.

NativeAuthentication (default) – This uses the sqljdbc_auth.dll and is specific to the Windows platform.  This was the only option prior to the JDBC 4.0 driver.

JavaKerberos – Makes use of the Java API’s to invoke kerberos and does not rely on the Windows Platform.  This is java specific and not bound to the underlying operating system, so this can be used on both Windows and Linux platforms.

So, if you are receiving the error above, there are three possibilities that could be causing it to show up.  First, you actually specified authenticationScheme=NativeAuthentication in your connection string and you are on a Linux Platform.  Second, you specified integratedSecurity and omitted authenticationScheme, which defaulted to NativeAuthentication, and you are on a Unix/Linux Platform.  Third, you are using a version of the JDBC Driver prior to the 4.0 driver and trying to use Integrated Authentication on a Unix/Linux platform.  In the third case, even if you specify authenticationScheme=JavaKerberos, it won’t help as the older drivers aren’t aware of it, so it is ignored.

The following document outlines how to use Kerberos with the JDBC Driver and walks through what is needed to get JavaKerberos working properly.

Using Kerberos Integrated Authentication to Connect to SQL Server
http://msdn.microsoft.com/en-us/library/gg558122%28v=sql.110%29.aspx

Another aspect that was discovered was the that it appears that the WebSphere 8.5 release comes with the 3.0 version of the SQL JDBC Driver.  This will not honor the JavaKerberos setting and you will get the error listed above.

Configuration

So, you will need to make sure your driver is updated to the 4.0 driver or later.  After that is done, you will need to make sure that the Kerberos Configuration file (krb5.ini or krb5.conf) is configured properly on your platform.  In the above referenced documentation we have a sample of what that should look like.  You will also need to generate keytab files for the platform to reference.  A login configuration file also needs to be setup.  If you don’t have one, the driver will automatically configure it using the Krb5LoginModule.  If you need to use a different Login Module, you will need to make sure that is configured for your environment.  Assuming all of that is in place, the driver should work using JavaKerberos to connect.

The following blog does a good job of walking through the steps to get this setup for Java.  It indicates Weblogic, but really it just goes through the java aspects.  It walks through how to create the keytab files and what to do with the krb5.ini file.

Configure Kerberos with Weblogic Server (really just a Java reference)
https://blogbypuneeth.wordpress.com/configure-kerberos-with-weblogic-server/

Known Limitation

If you have a multiple domain environment with SQL Servers in different domains that you are trying to hit, you will run into issues.  We found that in order to get it to work properly, you need to set the default domain within the Kerberos configuration file, to the domain that the SQL Server resides in.  You can only have one default domain, so if you have multiple SQL Servers in different domains, you are going to have to pick one.

SQL JDBC Driver Versioning and Files

I’ve also heard a lot of questions and seen confusion on the file versioning, file name and system requirements.  Here is a table where I tried to highlight what comes with what driver for reference.

JDBC Driver Version

JAR Files

JDBC API Support

Supported JVM

2.0

sqljdbc.jar

3.0

1.5

sqljdbc4.jar

4.0

1.6 or later

3.0

sqljdbc.jar

3.0

1.5

sqljdbc4.jar

4.0

1.6 or later

4.0

sqljdbc.jar

3.0

1.5

sqljdbc4.jar

4.0

1.6 or later

4.1

sqljdbc.jar

3.0

1.5

sqljdbc4.jar

4.0

1.6 or later

sqljdbc41.jar

4.0

1.7 or later

Also, we have documentation regarding the System Requirements that you can look at that goes a little further into this.

System Requirements for the JDBC Driver
http://msdn.microsoft.com/en-us/library/ms378422(v=sql.110).aspx

Hopefully this will help clear things up for you when using the SQL JDBC Driver on a Unix/Linux Platform.

 

Adam W. Saxton | Microsoft SQL Server Escalation Services
https://twitter.com/awsaxton

 

Comments (12)

  1. Gregory says:

    This is what I did to make it work

    When using Windows Authentication Integrated Security

    unjar sqljdbc.jar

    copy

    .. sqljdbc_4.0/enu/auth/x64/sqljdbc_auth.dll to

    .. Java/jre7/bin and to

    .. Java/jre7/lib

    Note:

    My connection was working fine, then I upgraded the Java JDK and I lost the above

    1. Vathsala says:

      Thanks, even I was facing the same issue when I updated JDK, the solution helped me.. Thanks Gregory..

  2. Gregory A says:

    When you install the driver for the first time you have to copy this file

    /Program Files/Microsoft JDBC Driver 4.0 for SQL Serversqljdbc_4.0/enu/auth/x64/sqljdbc_auth.dll

    to the Java Run Time Environment bin folder jre1.x.x_xx then later if you upgrade your java to a higher version, you have to copy the file again and so on.  

  3. George Alvarez says:

    As it turns out, I got integrated authentication to work when I put sqljdbc_auth.dll in Windows>SysWOW64.  I guess that before I did that, it was able to find the dll, but not run it?  Not sure, I can't see all the java error reporting, as it is hidden by IBM Data Studio.

    All's well that ends well.

  4. Scott Queen says:

    I’m getting this error on a Windows Server 2012 box. Starting the service with this command:

    java -Djava.library.path=C:/sqljdbcDependency -jar service.jar

    and sqljdbc_auth.dll is in the C:/sqljdbcDependency folder.

    Any other ideas what to do?

  5. Hello I am using Rational Functional Tester which has an eclipse interface, I am getting
    com.microsoft.sqlserver.jdbc.SQLServerException: This driver is not configured for integrated authentication. ClientConnectionId:86f18e13-f645-44ac-b17a-f7494b4244a0

    I have read that file sqljdbc_auth.dll needs be placed in another path, the only question is I am not sure where to place it.
    I have placed the file in C:\Program Files (x86)\IBM\SDP\jdk\jre\bin
    also tried
    C:\Program Files (x86)\IBM\SDP\FunctionalTester\bin

    but still get the same error ? can you advise where it may go ?

  6. Raje08 says:

    Hi Adam,

    This is really nice, I am trying to connect SQL Server from Unix but unable to do that.

    Tried to us Kerberos mode but still facing some issues and received error as mentioned below.

    Error while creating database connection: com.microsoft.sqlserver.jdbc.SQLServerException: Integrated authentication failed. ClientConnectionId:96e7eee4-5b11-41db-98c4-2588b9022149

    Please let me know if any changes need to setup on Unix.. I tried to change etc\krb5.config but unable to update it… Please let me know the steps and details.

    1. Raje08 says:

      Sorry Error I received was as mentioned below.
      Error while creating database connection: java.sql.SQLException: I/O Error: GSS Failed: No valid credentials provided (Mechanism level: Failed to find any Kerberos tgt)

  7. Michael Starks says:

    Is the problem with multiple domains still an issue with drivers versions 4.2 or 6.0?

  8. Kumar says:

    Hi Adam,

    Nice article on the issue related to authenticationScheme connection property.

    I have tested as below
    sqljdbc42.jar and JDK 1.8
    DataSource Class: com.microsoft.sqlserver.jdbc.SQLServerDataSource
    integratedSecurity=true;authenticationScheme=JavaKerberos

    Please help if anything else has to be done in my application to connect from application hosted on Linux to connect to SQL Server hosted on Windows using Windows Integrated authentication with JDBC.

  9. Kumar says:

    Sorry forgot to post error details

    Error details
    [ART.118.5036] Adapter Runtime (Connection): Unable to configure connection manager.
    [ADA.1.204] Cannot connect to the database with DataSource class “com.microsoft.sqlserver.jdbc.SQLServerDataSource”.
    Integrated authentication failed. ClientConnectionId:8160e5b4-a18c-404b-aa66-11484fbf5a8e
    Caused by: com.wm.pkg.art.error.DetailedException: [ART.118.5063] Adapter Runtime (Connection): Unable to start connection mdm_table_test:mdm_test: after 1 attempt(s).

  10. Jeff says:

    Thank you for this article. It makes a whole lot of sense. I was able to use this article to help figure out what was wrong.

Skip to main content