[macOS] Integrated authentication no longer requests Kerberos delegation in 6.1.x

Aperta
  • Qualcosa non va?
#5,040 9 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
csharp, macos, sql
Ambito
authentication, databases

Direzione di ricerca

Start by comparing the Unix SNI path in src/Microsoft.Data.SqlClient/netcore/src/Microsoft/Data/SqlClient/SNI/SNIProxy.cs at 5.1.7 with src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SSPI/NegotiateSspiContextProvider.cs at 6.1.5, then check how AllowedImpersonationLevel is configured. Reproduce with Integrated authentication and the linked-server query in the issue; the target SQL Server environment is needed. Done means confirming the cause and intended delegation behavior, then documenting or fixing it without requiring unconstrained delegation.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Describe the bug

On macOS, a SQL Server connection using Integrated authentication negotiates Kerberos for the first hop, but a query against a SQL Server linked server fails because the remote hop receives an anonymous identity. This appeared when the VS Code SQL Server extension moved from its SqlClient 5.1.7 bundle to SqlClient 6.1.x, although the behavior is not currently consistent across retests.

The observed SQL Server error in the extension is:

Msg 7314, Level 16, State 1
The OLE DB provider "MSOLEDBSQL" for linked server "<LINKED_SQL_SERVER>" does not contain the table ""<REMOTE_DATABASE>"."dbo"."<TABLE>"". The table either does not exist or the current user does not have permissions on that table.

A first-hop diagnostic returned auth_scheme = KERBEROS and the expected domain login. The same SQL query succeeded in an earlier run using extension 1.39.0, failed with 1.40.0 and 1.47.0, and later also failed with 1.39.0 after reinstall/reload. The extension registry reported 1.39.0 installed and pinned for that later test. Azure Data Studio had succeeded in an earlier comparison; it has not yet been retested against the latest failure.

To reproduce

The issue was observed from the VS Code mssql extension on macOS with an Integrated-auth connection to SQL Server 2019. A minimal query that exercises the failing linked-server object is:

SELECT TOP (0) MasterPersonID
FROM [<LINKED_SQL_SERVER>].<REMOTE_DATABASE>.dbo.<TABLE>;

The actual application script uses a four-part linked-server name to join a remote table. The target database environment is required to reproduce this reliably; a standalone reproduction project is not yet available.

Relevant package comparison from the extension bundles:

  • mssql 1.39.0: SQL Tools Service 5.0.20260114.1, SqlClient 5.1.7, .NET 8 runtime
  • mssql 1.40.0: SqlClient 6.1.3
  • mssql 1.47.0: SQL Tools Service 6.0.20261002.1, SqlClient 6.1.5, .NET 10 runtime

In SqlClient 5.1.7, the Unix SNI path requests ContextFlagsPal.Delegate (source). In 6.1.5, NegotiateSspiContextProvider constructs NegotiateAuthenticationClientOptions with Package and TargetName but leaves AllowedImpersonationLevel unset (source); .NET's default is TokenImpersonationLevel.None (source). This suggests a possible delegation regression, but the inconsistent 1.39 retest means this is a hypothesis, not a confirmed root cause.

Expected behavior

Integrated authentication should preserve the documented/previous delegation behavior needed for linked-server queries when the environment is configured to allow constrained delegation. Please confirm whether omitting AllowedImpersonationLevel in the newer path is intentional, and whether SqlClient should preserve the prior behavior or provide a supported opt-in. Any fix should avoid requiring unconstrained delegation.

Further technical details
  • Microsoft.Data.SqlClient versions: 5.1.7 (extension 1.39.0), 6.1.3 (extension 1.40.0), 6.1.5 (extension 1.47.0)
  • .NET runtime bundled with SQL Tools Service: 8.0 for extension 1.39.0; 10.0 for extension 1.47.0
  • SQL Server: 2019, first-hop auth scheme Kerberos
  • Operating system: macOS (exact version and architecture not recorded)
  • Authentication: Integrated

Internal server names, database names, domain names, usernames, and customer/account values have been replaced with placeholders.

Lingua principale
C#
Stelle
1k
Fork
352
Merge medio
2g 18h
PR unite (30g)
133

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di dotnet/SqlClient

Tutte le issue di dotnet/SqlClient

Issue simili

Altre issue su C#

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.