Blog Post

SQL Server Blog
2 MIN READ

Introducing adutil - A tool to ease configuration of AD authentication for SQL on Linux/Containers

amvin87's avatar
amvin87
Icon for Microsoft rankMicrosoft
Dec 11, 2020

We are excited to introduce adutil in public preview, this is a CLI based utility developed to ease the AD authentication configuration for both SQL Server on Linux and SQL Server Linux containers. AD authentication enables domain-joined clients on either Windows or Linux to authenticate to SQL Server using their domain credentials and the Kerberos protocol.

 

Until today, when configuring the AD authentication for SQL on Linux, for creation of "AD user for SQL Server and setting SPNs" you needed to switch from Linux to Windows machine and then switch back to Linux machine to continue with the rest of steps. With adutil released we aim to make this experience seamless, where from the Linux machine itself you can interact and manage the Active Directory domains through the CLI.

 

Overall adutil is a utility for interacting with and managing Active Directory domains through the CLI. adutil is designed as a series of commands and subcommands, with additional flags that can be specified for further input. Each top-level command represents a category of administrative functions. Each subcommand is an operation within that category. Using adutil you can manage  with users, SPNs, keytabs, groups etc.

 

To start using adutil please see adutil installation for the install steps

 

For details on how you can configure AD authentication with adutil for SQL on Linux and containers please refer below:

 

Configure Active Directory authentication for SQL Server on Linux using adutil

Configure Active Directory authentication for SQL Server on Linux containers using adutil

 

Thanks,

Engineering lead: Mike Habben

Engineering: Dylan Gray; Dyllon (Owen) Gagnier; Ethan Moffat; Madeline MacDonald

Amit Khandelwal Senior Program Manager

Updated Dec 11, 2020
Version 1.0
sqlserverprotocols
sqlserversecurity
SQLServerTiger

12 Comments

Show More
  • nicorac's avatar
    nicorac
    Copper Contributor
    Mar 19, 2021

    Additional info:

    both directory

    '/var/run/secrets/keytabs/adutil'

    and file

    '/root/.adutil/adutil.json'

    are missing

  • nicorac's avatar
    nicorac
    Copper Contributor
    Mar 19, 2021

    When running create user command I receive an error:

     

    # adutil user create --distname CN=user,OU=Users,DC=DOMAIN,DC=ORG --password 'password' --debug

adutil Configuration:
        KeytabDir: '/var/run/secrets/keytabs/adutil'
        UseLdaps: 'false'
        IsWindowsDomain: 'true'
        OUDistinguishedName: ''
        UseDefaultSystemCCache: 'true'
Using configuration file from /root/.adutil/adutil.json
Detected parameters:
            Debug: true
             Name: mssql2019
     NameDistName: CN=mssql2019,DC=DOMAIN,DC=ORG
Checking for valid kerberos ticket
UserHasKrb5Credentials: Enumerating credentials in default system CCache
UserHasKrb5Credentials: Found local TGT for realm DOMAIN.ORG
UserHasKrb5Credentials: Found valid credentials
Running command: create user
Attempting to get password from --password flag
Creating user account mssql2019 (CN=mssql2019,DC=DOMAIN,DC=ORG) in DOMAIN.ORG
Failed interactive bind to 'DOMAIN.ORG' in CreateLdapConnection: Local error
Failed to connect to 'DOMAIN.ORG' when adding object 'CN=mssql2019,DC=DOMAIN,DC=ORG'

Failed to connect to 'DOMAIN.ORG' when adding object 'CN=mssql2019,DC=DOMAIN,DC=ORG'

     

    "kinit" runs correctly and also does "id" and "getent".

     

    What's wrong?

    I actually can't install SQLServer 2019 since I can't use the "setspn" commands (no Windows servers here, AD is on Samba4...).