Additional Information

This section describes the additional information related to the Microsoft SQL Server Connector.

Microsoft SQL Server Windows Service Account

Managed service accounts and Group-managed service accounts must be created in the Active Directory by the domain administrator.

For more information, refer to Configure Windows service accounts and permissions - SQL Server.

Windows Authentication and Kerberos

The following topics contain information for configuring a connection to the SQL server source using Windows authentication and the Kerberos authentication protocol that supports it.

Windows Authentication

Windows authentication can go by many names. Some of the most common names include:

• Windows authentication
• Windows domain authentication
• Domain authentication
• Integrated authentication
• Kerberos authentication

In this topic, the terms "Windows authentication" and "Kerberos" are used.

When you connect using a Windows user account, the SQL Server source validates the account name and password using the Windows principal token in the operating system. In other words, the user identity is validated by Windows, not the source. The source doesn't ask for a password and it doesn't validate the identity. Windows authentication is the default authentication mode. It is much more secure than SQL Server authentication. A connection made using Windows authentication is sometimes called a trusted connection, because SQL Server trusts the credentials provided by Windows.

Windows authentication supports the following:

• The Kerberos authentication scheme
• Password policy enforcement with regard to complexity validation for strong passwords
• Account lockout
• Password expiration

To properly support Windows authentication, the Virtual Appliance must be able to resolve the SQL server host, the key distribution center (KDC), and the default Kerberos realm.

By using Windows authentication, Windows groups can be created at the domain level and a login can be created on the SQL Server source for the entire group. Managing access at the domain level can simplify account administration.

For more information, refer to Connecting through Windows Authentication in the Microsoft documentation.

Windows Authentication Compatibility Check

To properly support Windows authentication, the Virtual Appliance must be able to resolve the SQL server host, the key distribution center (KDC), and the default Kerberos realm.

To check if the VA can resolve the necessary components, run the following command, replacing <host_fqdn> with each component's fully qualified domain name:

nslookup <host_fqdn>

For example:

• Verify resolvability with the SQL server:

  nslookup MYSQLSERVER.EXAMPLE.COM
  

• Verify resolvability with the KDC:

  nslookup MYKDC.EXAMPLE.COM
  

• Verify resolvability with the Kerberos realm:

  nslookup EXAMPLE.COM
  

Kerberos

The SailPoint SQL Server connector supports Windows authentication using the Kerberos authentication scheme as an underlying protocol for authentication information exchange.

To provide a Login Module Configuration File and a Kerberos Configuration File, refer to Base Configuration.

Prerequisites

• The SQLJDBCDriver.config and krb5.config files should be uploaded to the source

• Update the useMssqlKerberosAuth parameter in the source XML using the REST API.

  useMssqlKerberosAuth

  • Boolean
  • Default - false

  This parameter should be set to true when you need to connect to a Microsoft SQL server database with Kerberos authentication.

  [
      {
          "op": "add",
          "path": "/connectorAttributes/useMssqlKerberosAuth",
          "value": true
      }
  ]
  

  Note

  For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

Login Module Configuration File

Filename - SQLJDBCDriver.config

A login module configuration file consists of one or more entries, each specifying which underlying authentication technology should be used for a particular application or applications. The login module configuration file for this connector allows the SQL JDBC driver to acquire Kerberos credentials.

Each login module configuration file entry consists of a name followed by one or more login module-specific entries. Each entry is terminated by a semicolon. Groups of entries are enclosed by braces.

For more information, refer to Creating a login module configuration file in Using Kerberos integrated authentication to connect to SQL Server in the Microsoft documentation.

Kerberos Configuration File

Filename - krb5.config

The krb5.config file contains the Kerberos configuration information, including the locations of key distribution centers (KDCs), administration daemons for the Kerberos realms of interest, defaults for the current realm and for the Kerberos applications, and mappings of host names onto the Kerberos realms. This file must reside on all Kerberos clients.

The format of the krb5.config consists of section headings in square brackets. Each section can contain zero or more configuration variables (called relations), of the form:

relation = relation-value

or

relation-subsection = {
    relation= relation-value
    relation= relation-value

For more information, refer to Creating a Kerberos configuration file in the Microsoft documentation.

Upload Configuration Files

You can upload the required configuration files, SQLJDBCDriver.config and krb5.config, from the Base Configuration tab. This is the recommended method for providing these files.

Alternatively, you can upload the file with the following process:

1. Using FTP, SFTP, or any other transport means upload the file to one of the following locations in the Virtual Appliance:

   • /opt/sailpoint/ccg/
   • /home/sailpoint/ccg/custom/

2. Map the connector to the selected file location by adding the following entry into the source XML using the REST API, replacing <config_file_path> with your selected file location:

   Attribute - configFilePath

   Value - <config_file_path>

   For example:

   Attribute - configFilePath

   Value - /opt/sailpoint/ccg/

   Note

   When Cloud Gateway is configured with MS SQL server connector, ensure the file specified in the configFilePath is also present on the Cloud Gateway machine at the same location.

   For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.

   Important

   Do not skip the / at the end of the path value.

   Once you upload the file to the selected location, the CCG service needs to be restarted on the Virtual Appliance. This is to make sure that the previous cached configuration file - if one exists - is removed and a fresh configuration file is used.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.