Announcing the Saviynt Knowledge Exchange unifying the Saviynt forums, documentation, training,
and more in a single search tool across platforms. Read the announcement here.

Saviynt server setup for DB connector to connect target with AD service account

sangitaladi
Regular Contributor
Regular Contributor

Hi Saviynt Product Team

 

We have a MS SQL target DB and have setup Saviynt OOTB DB connector. When we are trying to connect the DB with AD service accounts, the connectivity fails.

We followed this link has the steps to configure Saviynt to use AD based service account that uses Kerberos, and this is our case.  – Section Connecting Active Directory Domain Accounts with MS SQL Database using Kerberos

https://docs.saviyntcloud.com/bundle/Database-v23x/page/Content/Appendix.htm#top

 

Attached krb5.txt and krb5.keytab file in the below incident:

[#2028860] DB Connector - Login failed for user svc_xxxxx : Saviynt Inc

and we need saviynt server team assistance to complete the next steps at server end.

But the agent working on the incident has requested to create  a forum post , so  the product team will assist us to perform the next steps.

Awaiting from your team to work and finish this setup, and then we can complete the connector setup.

 

Thanks,
Sangita Ladi

Update:

We have tested both the below URL as requested by the support agent and it did not work. We have the corresponding logs in case you need.

[This post has been edited by a Moderator to merge two posts.]

46 REPLIES 46

Dave
Community Manager
Community Manager

Hello @sangitaladi 

I am one of the moderators on the Saviynt Community Forums (forums.saviynt.com) and I noticed a few things about your post that I wanted to clarify.

First, you addressed your forum post to "Hi Saviynt Product Team" -- Close to 99% of the questions asked on the Saviynt Community Forums are answered by Saviynt users just like you.

The Saviynt Community Forums is a place where Saviynt partners, customers, and employees can brainstorm together and help solve difficult how-to questions.

That is probably why the support agent referred you to the forums, if you are asking a "how-to" question.

If there is any setup or configuration that Saviynt needs to do on the backend, that all needs to happen on the ticket, not here.

More information on requesting a service can be found here:
https://forums.saviynt.com/t5/announcements/introducing-our-new-quot-request-a-service-quot-feature-...

I hope that will help clarify things. And if your question is a "how-to" question, I am sure one of our forum users will jump in to share their expertise. 

Best regards,
Dave

rushikeshvartak
All-Star
All-Star

There is no dependency with saviynt support on this issue in EIC . You need to upload files on file directory - connector files and restart services


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

Hi

As per the DB connector guide, there are several files that are required to be configured on Saviynt side. Here are the files

jeytab file, krb5.conf, SQLJDBCDriver.conf, Update the JDBC driver to mssql-jdbc-7.0.0.jre10.jar

Here is the link for the steps:

https://docs.saviyntcloud.com/bundle/Database-v23x/page/Content/Appendix.htm#top

If you can go through the steps in the above link, can you confirm if we can perform these steps using Saviynt UI and dont need any help from the product team.

We have a ticket opened for this and the response we go on the ticket is this:

sunilrashinkar_0-1716826922191.png

[This message has been edited by moderator to mask sensitive info]

As mentioned files needs to be uploaded in connector files .

avoid adding agent name on public forums


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

Hi

We will try uploading the necessary files in the connector folder, but who will perfrom the following steps for us? We dont have access to Saviynt servers:

sunilrashinkar_0-1716828678321.png

 

 

As mentioned this is not needed in EIC and its preconfigured in EIC


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

We are at v23.1 and may go to v24.4. I dont think this is is EIC.

Anything beyond v2021 is EIC


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

So I am assuming v23.x or 24.x is beyond v2021 and we dont have to perform the jdbc driver jar and the  Catalina startup.sh file steps.

and I assume we will need a restart once we upload the files.

We will go ahead and test the steps and document it and provide the steps here, if it works.

Yes we have done same and it works


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

Hi Rushikesh

I see we have the following 3 files for this setup to the configured:

krb5.keytab
krb5.conf
SQLJDBCDriver.conf

Do you want us to upload all the three files under the connector folder through Saviynt File Directory UI?

sunilrashinkar_0-1716914318162.png

In the SQLJDBCDriver.conf file, we need to specify the path of krb5.keytab. Now this file krb5.keytab file is uploaded under connector folder, so what would be it path which I can update it in the SQLJDBCDriver.conf file file?

 

Tks

Sunil

 

rushikeshvartak_0-1716916311845.png

rushikeshvartak_1-1716916348524.png

 


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

Hi,

I uploaded all the 3 files under Connector Files folder:

sunilrashinkar_0-1716916906548.png

 

Also the file contents for SQLJDBCDriver.conf is this:

SQLJDBCDriver {
com.sun.security.auth.module.Krb5LoginModule required useTicketCache=false useKeyTab=true doNotPrompt=false keyTab="/saviynt_shared/saviynt/ConnectorFiles/krb5.keytab" principal="svc_SaviyntADReader@domain.com";
};

 

Updated the JDBCL URL and tries the test connection and it failed with this error from debug log:

"2024-05-28T17:05:01.868+00:00","ecm","provisoning.DBProvisioningService","http-nio-8080-exec-9-7sb6w","ERROR","Creating connection failed: "
"2024-05-28T17:05:02.178+00:00","ecm","","null-7sb6w","","com.microsoft.sqlserver.jdbc.SQLServerException: Integrated authentication failed. ClientConnectionId:35f99f02-deef-4bbc-8156-aadef021d372 at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:1667) at com.microsoft.sqlserver.jdbc.KerbAuthentication.intAuthInit(KerbAuthentication.java:140) at com.microsoft.sqlserver.jdbc.KerbAuthentication.GenerateClientContext(KerbAuthentication.java:268) at com.microsoft.sqlserver.jdbc.SQLServerConnection.sendLogon(SQLServerConnection.java:2691) at com.microsoft.sqlserver.jdbc.SQLServerConnection.logon(SQLServerConnection.java:2234) at com.microsoft.sqlserver.jdbc.SQLServerConnection.access$000(SQLServerConnection.java:41) at com.microsoft.sqlserver.jdbc.SQLServerConnection$LogonCommand.doExecute(SQLServerConnection.java:2220) at

Any thoughts on what else is not setup properly?

[This post has been edited by a Moderator to remove sensitive information.]

Ask saviynt support to restart from backend 


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

After the Saviynt agent restarted our Saviynt from backend, we are still getting the same error.

Error While Test connection: Integrated authentication failed. ClientConnectionId:84cbf738-4cb0-4eaa-9356-5af730c25647

I tried different formats of the username but still same error:

svc_SaviyntADReader

svc_SaviyntADReader@domain.com

The full DN value of svc_SaviyntADReader

sunilrashinkar_0-1716925704734.png

Anything else we can try?

[This post has been edited by a Moderator to remove sensitive information.]

Username should

domain/username

url - jdbc:sqlserver://MUNTSD-S-71084.rushicom\\INS01;databaseName=Ryshu_TEST;authenticationScheme=JavaKerberos;integratedSecurity=true;userName=${USERNAME};password=${PASSWORD}


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

Did they restarted connector services ?


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

Yes Saviynt support team did restart the application. here is the comments from the team on my ticket

sunilrashinkar_0-1716929345957.png

Also I tried with the service account in the format EXACTSCIENCES/svc_SaviyntADReader but i got the same error

Error While Test connection: Integrated authentication failed. ClientConnectionId:5b7c0ebb-8dfd-455c-8718-bea1aa26e839

Here is the screenshot of the connection form for the DB connector

sunilrashinkar_1-1716929678299.png

[This post has been edited by a Moderator to remove sensitive information.]

‼️‼️⚠️Keep company-specific private information masked on public forums, such as the name and URL.⚠️‼️‼️


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

I have asked them to restart the connector services too. Waiting for their response...

sunilrashinkar
New Contributor III
New Contributor III

Connector services were restarted. But same error after that too.

Share all config files


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

Attached are the config files for your reference. Extension added as .txt

I have not attached the keytab file, let me know if you need that too.

[This message has been edited by moderator to mask sensitive info from an attached file]

Your conf file domain is not matching 

[libdefaults]
default_realm = CAPITAL.COM
dns_lookup_realm = true 
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[domain_realm]
.small.com = CAPITAL.COM

[realms]
CAPITAL.COM = {
kdc = use1-dc-ps1.es.local
default_domain = es.com
}

 

please keep exact case capital or small

 

config file need restart


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

Thanks, I will make the change and have the application and connector services restarted and test it again.

sunilrashinkar
New Contributor III
New Contributor III

After making the change in the krb5.conf file to lower case and restarting Saviynt and connector services, test connection is still failing.

Attached (extension .txt added to the attachment) is the updated file for your reference

[This message has been edited by moderator to mask sensitive information from an attached file]

Your configuration are still not capital and small and domain is ending with local which should be .com

[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[domain_realm]
.domain.com = DOMAIN.COM

[realms]
DOMAIN.COM = {
kdc = use1-dc-ps1.domain.local
default_domain = domain.com
}

 

Change domain keyword to actual client name


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

We made this change and we go the error unable to locate KDC for realm domain.com

Here is the debug log error:

sunilrashinkar_0-1717028233249.png

So looks like the below value is there for a reason

[libdefaults]
default_realm = DOMAIN.LOCAL

[This message has been edited by moderator to mask sensitive info]

Your keytab does not match with domain it should be

default_realm = ES.COM

  • List keytab content à ktab -l -e -t -k  C:\Users\Rushikesh.Vartak\krb5.keytab

Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

Yes, we will have a troubleshooting session with the respective teams to fix this. Will update in case we see any issue further.

 

Regards

Sangita Ladi

Please confirm if this is resolved


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

its not resolved yet. we will update.

sangitaladi
Regular Contributor
Regular Contributor

Hi Rishi

updated below in krb5.conf file:

[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_realm = true
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[domain_realm]
.domain.com = DOMAIN.COM

[realms]
DOMAIN.COM = {
kdc = use1-dc-ps1.domain.local
default_domain = domain.com
}

 

 

but the authentication still fails. below is the debug log error:

sangitaladi_0-1717515328095.png

 

the error message says: Unable to locate KDC for realm domain.com.

Your relam in config and krb5 file does not match 


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

We tried the below two krb5.conf config files and it did not work.

Sample 1:

[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[domain_realm]
.domain.com = DOMAIN.COM

[realms]
DOMAIN.COM = {
kdc = USE1-DC-PS1.domain.local
default_domain = domain.com
}

Sample 2:

[libdefaults]
default_realm = DOMAIN.LOCAL
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[domain_realm]
.domain.com = DOMAIN.LOCAL

[realms]
DOMAIN.COM = {
kdc = USE1-DC-PS1.domain.local
default_domain = domain.com
}

 Can we tell us exactly what this krb5.conf file should contain based on the keytab file we have. We have been going in circles on this one.:

Check the krb5.conf (Linux/Unix) configuration file.

Ensure the [realms] section has the correct KDC information for the specified realm.

Example configuration:

 

[realms]

DOMAIN.COM = {

    kdc = kdc1.domain.com

    kdc = kdc2.domain.com

    admin_server = kdc1.domain.com

}


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

Hi Rishi

as per your recommendation, here is the updated krb5.conf file. We are getting the same error 'Unable to locate KDC for realm domain.com'

[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[domain_realm]
.domain.com = DOMAIN.COM

[realms]
DOMAIN.COM = {
kdc = USE1-DC-PS1.domain.com
default_domain = domain.com
}

Did you validated keytab file content . command is provided in previous reply


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

Here is the output of the Ktab command:

sunilrashinkar_0-1717686096401.png

[This post has been edited by a Moderator to remove sensitive information.]

This principle and connection username & conf file principle should match

‼️‼️⚠️Keep company-specific private information masked on public forums, such as the name and URL.⚠️‼️‼️


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

yes ,it matches.

sunilrashinkar
New Contributor III
New Contributor III

Hi Rishi

This principle, connection username & conf file principle is matching and still the test connection is failing

Here is the conf. file:

[libdefaults]
default_realm = DOMAIN.COM
dns_lookup_realm = false
dns_lookup_kdc = true
ticket_lifetime = 24h
forwardable = yes

[domain_realm]
.domain.com = DOMAIN.COM

[realms]
DOMAIN.COM = {
kdc = USE1-DC-PS1.domain.com
default_domain = domain.com
}

Here is the DB Connection form on Saviynt:

sunilrashinkar_0-1717787779033.png

 

And here is the keytab file contents:

sunilrashinkar_1-1717787835887.png

 

See if you find anything wrong here. The error on the test connection is:

Error While Test connection: Integrated authentication failed. ClientConnectionId:9b555d3d-3375-4df4-84ee-70f1cab7ea99

The error in the debug log is:

"2024-06-07T20:04:15.535+00:00","ecm","provisoning.DBProvisioningService","http-nio-8080-exec-7-pvqhn","ERROR","Creating connection failed: "
"2024-06-07T20:04:16.216+00:00","ecm","","null-pvqhn","","com.microsoft.sqlserver.jdbc.SQLServerException: Integrated authentication failed. ClientConnectionId:9b555d3d-3375-4df4-84ee-70f1cab7ea99 at com.microsoft.sqlserver.jdbc.SQLServerConnection.terminate(SQLServerConnection.java:1667) at com.microsoft.sqlserver.jdbc.KerbAuthentication.intAuthInit(KerbAuthentication.java:140) at com.microsoft.sqlserver.jdbc.KerbAuthentication.GenerateClientContext(KerbAuthentication.java:268) at com.microsoft.sqlserver.jdbc.SQLServerConnection.sendLogon(SQLServerConnection.java:2691) at com.microsoft.sqlserver.jdbc.SQLServerConnection.logon(SQLServerConnection.java:2234) at com.microsoft.sqlserver.jdbc.SQLServerConnection.access$000(SQLServerConnection.java:41) at com.microsoft.sqlserver.jdbc.SQLServerConnection$LogonCommand.doExecute(SQLServerConnection.java:2220) at com.microsoft.sqlserver.jdbc.TDSCommand.execute(IOBuffer.java:5696) at com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(SQLServerConnection.java:1715) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:1326) at com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:991) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:827) at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1012) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:208) at com.saviynt.provisoning.DBProvisioningService.getConnection(DBProvisioningService.groovy:198) at com.saviynt.ImportExternalDbService.connectToDB(ImportExternalDbService.groovy:649) at com.saviynt.ImportExternalDbService.testDBConnection(ImportExternalDbService.groovy:667) at com.saviynt.ecm.integration.ExternalConnectionCallService.testExternalConnection(ExternalConnectionCallService.groovy:926) at com.saviynt.ecm.utility.domain.EcmConfigController$_closure21.doCall(EcmConfigController.groovy:769) at grails.plugin.springsecurity.web.filter.GrailsAnonymousAuthenticationFilter.doFilter(GrailsAnonymousAuthenticationFilter.java:53) at com.saviynt.webservice.SaviyntRestAuthenticationFilter.doFilter(SaviyntRestAuthenticationFilter.groovy:155) at grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter.doFilter(MutableLogoutFilter.java:62) at grails.plugin.springsecurity.web.SecurityRequestHolderFilter.doFilter(SecurityRequestHolderFilter.java:59) at com.mrhaki.grails.plugin.xframeoptions.web.XFrameOptionsFilter.doFilterInternal(XFrameOptionsFilter.java:69) at com.brandseye.cors.CorsFilter.doFilter(CorsFilter.java:82) at java.lang.Thread.run(Thread.java:750)Caused by: javax.security.auth.login.LoginException: Cannot locate KDC at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:810) at com.sun.security.auth.module.Krb5LoginModule.login(Krb5LoginModule.java:618) at javax.security.auth.login.LoginContext.invoke(LoginContext.java:755) at javax.security.auth.login.LoginContext.access$000(LoginContext.java:195) at javax.security.auth.login.LoginContext$4.run(LoginContext.java:682) at javax.security.auth.login.LoginContext$4.run(LoginContext.java:680) at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680) at javax.security.auth.login.LoginContext.login(LoginContext.java:587) at com.microsoft.sqlserver.jdbc.KerbAuthentication.intAuthInit(KerbAuthentication.java:133) ... 25 moreCaused by: KrbException: Cannot locate KDC at com.sun.security.auth.module.Krb5LoginModule.attemptAuthentication(Krb5LoginModule.java:782) ... 33 moreCaused by: KrbException: Generic error (description in e-text) (60) - Unable to locate KDC for realm exactsciences.com ... 34 more"
"2024-06-07T20:04:15.538+00:00","ecm","generic.GenericValidationService","http-nio-8080-exec-7-pvqhn","DEBUG","Inside validateCommonErrorResponse"
"2024-06-07T20:04:15.538+00:00","ecm","saviynt.ImportExternalDbService","http-nio-8080-exec-7-pvqhn","ERROR","Error while saving the Connection: Target Error Message: [com.microsoft.sqlserver.jdbc.SQLServerException: Integrated authentication failed. ClientConnectionId:9b555d3d-3375-4df4-84ee-70f1cab7ea99"
"2024-06-07T20:04:16.216+00:00","ecm","","null-pvqhn",""," ]"
"2024-06-07T20:04:15.538+00:00","ecm","domain.EcmConfigController","http-nio-8080-exec-7-pvqhn","ERROR","Integrated authentication failed. ClientConnectionId:9b555d3d-3375-4df4-84ee-70f1cab7ea99"

 

 

 

 

It does not seems application restarted properly and updated files taken 


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.

sunilrashinkar
New Contributor III
New Contributor III

If you see the above stack trace, I see the error --> Cannot locate KDC

Are you saying since the application was not restarted properly, we might be getting this cannot locate KDC error?

If you update any configuration restart is must. Make sure no leading /trailing space in configs


Regards,
Rushikesh Vartak
If you find the response useful, kindly consider selecting Accept As Solution and clicking on the kudos button.