Quantcast
Channel: Microsoft Drivers for PHP for SQL Server forum
Viewing all articles
Browse latest Browse all 391

FastCGi Impersonation not recognized for Kerberos delegation in 3.2?

$
0
0

Hi, i'm currently totally stumped. i recently deployed a new development server and i cant't get sqlsrv_connect to delegate the kerberos authentication to the SQLServer.

Here ist the setup

SQL-Server
Name: ATLNZDB11 (SQL 2012)

Webserver: ATVIEDEV01 (Windows 2012 R2)
SQL Driver 3.2
PHP: 5.6 (Fastcgi)
fastcgi.impersonate = 1
Hostname for site: http://boilerplate-dev-sluftensteiner (CNAME entry for ATVIEDEV01)
The ApplicationPool for the Site is running as NETWORK SERVICE
AnonymousAuthentication is disabled
WindowsAuthentication is enabled (Kernel Mode, Negotiate as only provider)

ATVIEDEV01 is trusted for any kerberos delegation

this is the result of setspn -l for ATVIEDEV01 (domain.com is the stand-in for our domain)

HTTP/atviedev01.domain.com
HTTP/atviedev01
HTTP/boilerplate-dev-sluftensteiner
HTTP/boilerplate-dev-sluftensteiner.domain.com
TERMSRV/ATVIEDEV01
TERMSRV/ATVIEDEV01.domain.com
WSMAN/ATVIEDEV01.domain.com
WSMAN/ATVIEDEV01
RestrictedKrbHost/ATVIEDEV01
HOST/ATVIEDEV01
RestrictedKrbHost/ATVIEDEV01.domain.com
HOST/ATVIEDEV01.domain.com


i wrote the following test-script:

<?php

exec("whoami", $output);
echo $output[0]."\n";

$theFile="\\\\differenthost\\share_i_have_access_to\\test.txt";
$handle = fopen($theFile, "r");
if($handle){
    while (!feof($handle)){
        $buffer = fgets($handle);
        echo $buffer."\n";
    }
}

$connectionOptions = array(
		  "Database" => "Boilerplate"
		, "ReturnDatesAsStrings" => true
		, "CharacterSet"  => "UTF-8"
	);
$conn = sqlsrv_connect( "ATLNZDB11", $connectionOptions);
if (!$conn){
	$error = sqlsrv_errors();
	echo $error[0]["message"]."\n";
}

?>


which gives me the follwing output:

domain\sluftensteiner (=the user logged in on the client machine where the browser is used to access the script)
textfilecontent (=the content of the text file read in the script)
[Microsoft][ODBC Driver 11 for SQL Server][SQL Server]Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'

these results make me think, that the impersonation is basically working, since i get access to the fileshare and whoami returns my actual credentials. Still the SQL-Connection does not work and thinks i'm an anonymous user...

on a different server which is running Windows 2008 R2 Server and PHp 5.4.6 the same script works as expected. there is no discernible difference in den SPNs or other Delegation Settings

Does anyone have any idea if this is a Bug with the driver or am i missing something in my setup?

Any help would be greatly appreciated.


Viewing all articles
Browse latest Browse all 391

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>