Database access using windows authentication

We are updating our Applications to use single sign on and are running into a problem with database access. We are using CF11 Enterprise and SQL Server 2008 on IIS 7.5.
We have set up the ColdFusion Application Service to run under an AD service account and have created the data sources in CFAdmin leaving the username and password blank. The data sources verify and all seems good. The problem comes when running a query. The credential passed to the database is the service account and not the windows authenticated user. As such the query fails. What are we missing to get CF to pass the Windows Authenticated user credential instead of the service account?
Thanks
Tim

ColdFusion does not pass user's credentials to the database connections by default, and cannot pass Windows Authentication credentials that way. It only sends the service account's credentials (if you leave username/password blank as you have done). The only way to pass user credentials is to put them into the individual query calls themselves, and even then you can't pass Windows Authentication credentials. You would have to use SQL Server Logins, and create accounts for each user.
I think most people are using either a dedicated SQL Server login for ColdFusion and run all queries under that account, or they do as you have already done and use Windows Authentication along with the ColdFusion service account. If you need an audit trail, then pass usernames into the insert/update queries and store them manually along with the other data you are inserting/updating.
-Carl V.

Similar Messages

Impersonate user when accessing Microsoft SQL Server from powershell using Windows Authentication

Hi All,
Below is the powershell script to connect a SQL DB using windows authentication by impersonating a user. The user should have login access to the server. Script can be highly useful when service id is used to access DB using powershell.
[reflection.assembly]::LoadWithPartialName("Microsoft.SqlServer.Smo") | Out-Null
$ds=$null
$conn = New-Object -typeName Microsoft.SqlServer.Management.Smo.Server -argumentList "Servername"
$db = New-Object Microsoft.SqlServer.Management.Smo.Database
$conn.ConnectionContext.ConnectAsUser = $true
$conn.ConnectionContext.LoginSecure=$true
$conn.ConnectionContext.ConnectAsUserName = "username"
$conn.ConnectionContext.ConnectAsUserPassword ="password
$conn.Loginmode
$db = $conn.Databases.Item("dbname")
$ds = $db.ExecuteWithResults("select top 10 Name from Tablename")
Foreach ($t in $ds.Tables)
Foreach ($r in $t.Rows)
Foreach ($c in $t.Columns)
Write-Host $c.ColumnName "=" $r.Item($c)

That is OK when you want to manage the instance biut it wojn't work if the tools are not installed.
This works from anywhere all of the time and is simpler:
$datasource='MyServerInstance'
$database='NorthWind'
$connStr='Data Source={0}; Database={1}; Trusted_Connection=True;' -f '$datasource,$database
$conn=New-Object System.Data.SQlClient.SQlConnection($connStr)
$conn.Open()
$cmd=$conn.CreateCommand()
$cmd.CommandText='select * from products'
$rdr=$cmd.ExecuteReader()
0..($rdr.FieldCount-1) | %{$rdr.GetName($_)}
$conn.Close()
If you want credentials just add them.
$connStr='Data Source={0}; Database={1}; Trusted_Connection=True;UID={2};PWD={3};' -f $datasource,$database,uid,$pwd
¯\_(ツ)_/¯

Deploying the Cloud service using Windows Authentication

Hi,
I have a VPN Connectivity established to other VM Server where the DB is also installed. Now I a have created an application with DB connectivity
I am able to connect the DB server using SQL authentication but how can I connect using Windows Authentication?
What configuration changes I have to do in web.config or I have to modify any more changes else where?
Thanks & Regards,
Suresh Sahu

Hi,
Based on your description, you have connected to DB server using SQL authentication, I suggest your read the following link, and do some change in SQL that installed in the VM, hope it helps. If I misunderstand, please feel free to let me know.
#http://msdn.microsoft.com/en-us/library/dd787978.aspx
Best Regards

Claims Authentication Error connecting to BCS - but we're using Windows Authentication

We currently have an External List with a SQL Server SProc as a source in a SharePoint 2010 site. It has been working great for months now. I need to make a change to the External Content Type - and I have made changes in the past - but now strange things
are happening.
I can't view the external content type (or any) in SPD. I can create a new Secure Store Service Target Application in SPCentralAdmin and everything seems fine, but I can't consume the application in SPD. I get an error that BCS has rejected the
request. This is new and curious; I'm a Farm Administrator.
Looking at the logs, I find I get a Claims Authentication error that my ID can't be found (the error is below). This is also new and is very, very curious as we're not using Claims authentication for any of our sites. They all use Windows authentication.
I am also getting recent reports from users who are repeatedly challenged for credentials and wonder if this is related.
In my research, I've found suggestions from starting the CWTS Service (I was dubious, I can start the service, and it doesn't resolve the problem) to setting Metadata Store Permissions in SPCentralAdmin (I was again dubious as I'm a farm administrator -
and I get the same error when I try to make this assignment!) So I'm at a loss.
Here is the error (the X'd out information was correct in the trace):
SPSecurityContext.WindowsIdentity: Could not retrieve a valid windows identity for NTName='XXXXX\XXXXXX', UPN='[email protected]'. UPN is required when Kerberos constrained delegation is used. Exception: System.ServiceModel.EndpointNotFoundException:
There was no endpoint listening at net.pipe://localhost/s4u/022694f3-9fbd-422b-b4b2-312e25dae2a2 that could accept the message. This is often caused by an incorrect address or SOAP action. See InnerException, if present, for more details. ---> System.IO.PipeException:
The pipe endpoint 'net.pipe://localhost/s4u/022694f3-9fbd-422b-b4b2-312e25dae2a2' could not be found on your local machine. --- End of inner exception stack trace --- Server stack trace:
at System.ServiceModel.Channels.PipeConnectionInitiator.GetPipeNam...
We're not using Kerberos at all. We're using good, old-fashioned Windows Authentication. The only changes made to the platform recently have been updates. The error could, of course, be erroneous and I may be charging down the wrong path.
But although I find many links when I Bing the error, all the links pertain to sites using Claims authentication - even the Error Category in my log is "Claims Authentication" - but we're not using Claims Authentication...
Again, any help at all will be appreciated. Thanks!

Hi Kevin,
From the error message, we might be missing user permissions to the BCS Metadata Store. Please perform the steps below and test the issue again:
1. Open the SharePoint Central Administration website with either a Farm administrator account or an account that has been delegated permissions to administer the Business Data Connectivity Service Applications.
2. On the Quick Launch, click Application Management.
3. On the Application Management page, under Service Applications, click Manage service applications.
4. In the list of services, select the row of the Business Data Connectivity Service Application that you created in Create the Business Data Connectivity service application and then click Manage and then Set Metadata Store Permissions.
5. Enter the Farm Administrator account and any other delegate administrators if you have them and then click Add.
6. For each account or group that you added that is an administrator of the Business Data Connectivity Service Application, select the Edit, Execute, Selectable In Clients, and Set Permissions checkboxes.
7. Select the Propagate permissions to all BDC Models, External Systems and External Content Types in the BDC Metadata Store. Doing so will overwrite existing permissions checkbox.
8. Click OK.
Also, make sure your account is added as local administrator.
Regards,
Rebecca Tu
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

IOS 8 Safari not working with sites using Windows Authentication (again)

A testbed of iPhones and iPads were updated to iOS 8 today. When trying to access intranet sites in our company that use Windows (IIS) Authentication, it challenges for the login and password 2 or 3 times, then nothing - just hangs. These sites work fine on iOS 7 devices - and worked on the same devices that were upgraded.
Windows Authentication was broken in iOS 7.0 also and not fixed until a later update. Why does this keep getting broken?

This was a thread that discussed this when it was broken in iOS 7.0...
https://discussions.apple.com/thread/5327078?start=0&tstart=0
I just tested with Chrome on the iPhone upgraded to iOS 8 and it works fine. It is Safari that is broken again.
Of course, Apple won't give us a way to make Chrome the default browser when links are clicked in emails, so it's not exactly a solution.

How can I connect to oracel-10 using windows authentication?

Hi,
in Oracle 9 I could do this:
Put the windows user in the group ORA_DBA, then:
set ORACLE_SID=MySID
sqlplus /nolog
connect / as sysdba
With oracle 10 it always seems to ask for username and Password.
Is there a way around this?
Can I log in thru windows authentification somehow like this
set ORACLE_SID=MySID
sqlplus /nolog
connect as sysdba
without now being asked for username and password now?
How can I accomplish this?
I would not want to specify the password in an sql file; this would be much worse than being able to connect thru windows authentication.
Thank you for letting me know.
Sincerely
Andreas

Hi,
thank you all for answering first of all.
I thought that connecting with the slash as sysdba:
connect / as sysdba
was an old syntax of oracle9.
But you are right, obviously it is not.
However, oracle10 gives me now the message:
SQL> connect / as sysdba
ERROR:
ORA-01031: insufficient privileges
How come you don't get this message?
Are you using Oracle-9 or oracle-10?
I was logged on as user oracle; and this user is member of the administrators group and also the group ORA_DBA.
How come then that it still throws the insufficient privileges message?
Could you please let me know, what you do differently or what I forgot?
Regards
Andreas

How to scroll up and down in IBM client access using windows 7 on mac running bootcamp

How to scrool up and down in Client Access 5250 (AS/400 emulator) using windows 7 on Mac running boot camp. The key board does not function within the client access 5250 session?

You can also share a printer between the Mac/PC as well as files and mounted Volumes, see the Tiger articles here
http://www.ifelix.co.uk/tech/
You may want to use Bonjour for Windows on your PC
http://www.apple.com/macosx/features/bonjour/
Then there are VNC clients for Mac/PC that also allow you to actually control the other machine, if they aren't in the same room and you just need to check something quick that can be handy, it's kind of slow though for regular use.
The main benefit of partitioning is being able to have different versions of bootable OS on them. You can try out Leopard on a new partition, while keeping your Tiger partition intact, you can have a XP/Vista partition for parallels or BootCamp, etc... other than that drives are pretty much fast enough, having smaller partitions probably won't realize any significant speed ups over searching the whole large drive.

Block database access using toad or other tools

We have a forms application running on oracle database 10g release 2, with the users created in the application the database can be accessed using the same id's through sql plus or any other tool. We have already restricted sql plus access by product_user_profile. Is there any other way to make sure toad or any other tool can be stopped from accesing the database.
Thanks
Eric

eric_in wrote:
We have a forms application running on oracle database 10g release 2, with the users created in the application the database can be accessed using the same id's through sql plus or any other tool. We have already restricted sql plus access by product_user_profile. Is there any other way to make sure toad or any other tool can be stopped from accesing the database.
Thanks
EricHi Eric
I've a blog post on this issue. You can look for .exe extentsion of the program which connects to the database
http://kamranagayev.wordpress.com/2009/10/04/block-developers-from-using-toad-and-other-tools-on-production-databases/

Help...create database(access) using java

i had developed an java application that capture packet using Jpcap but i dont know how to keep the packet captured into database(access).i can save the packet captured in text file but not in database(access).i already had the database conectivity but i don't know how to insert the packet caputred in the table in access, is it using sql statement like INSERT INTO? or else?i realy don't know.can someone help me....?

i can save the packet captured in to text file but not in database(access).I guess that you wish to get a databse file with your data, not a simple insert sql question.
1. commercial solution: HXTT Access(http://www.hxtt.com/access.html), which supports create database, create table sql, and batch insert data from any JDBC driver.
2. free solution: jdbc-odbc bridge and dsn-less jdbc url, you need to prepare a blank mdb file with blank table, then copy that blank mdb file into new mdb file, then repeat insert sql for that new mdb file.

Jsp database access using odbc - please help

Hi friends,
I�m trying a very simple database access program in jsp data base access using odbc. Odbc has to be used because thin driver or other drivers may not be available in every system of our college and as you know it's not that easy to make changes to those systems. My problem is so simple. I always get an exception in my program.
My jsp content is as simple as:
<%@ page import="java.lang.*,java.sql.*,java.io.*,registerbean" %>
<jsp:useBean id="db" class="registerbean" scope="session"/>
<%
String str="insert into reg values('" + db.getName() + "','" + db.getUname() + "','" + db.getPass() + "'," + db.getAge() + ",'" + db.getSex() + "','" + db.getAdd() + "','" + db.getUgcourse() + "','" + db.getUgqual() + "'," + db.getPer() + ",'" + db.getIadd() + "')";
try
Class.forName("sun.jdbc.odbc.JdbcOdbcDriver");
Connection con=DriverManager.getConnection("jdbc:odbc:yogaesh","scott","tiger");
Statement stmt=con.createStatement();
stmt.executeUpdate(str);
}catch(Exception e1){out.println(str);};
%>
the table reg has the structure:
Name Null? Type
CNAME VARCHAR2(20)
UNAME VARCHAR2(20)
CPSWD VARCHAR2(20)
CONFPASS VARCHAR2(20)
CAGE NUMBER
CSEX VARCHAR2(5)
CADD VARCHAR2(100)
COURSE NUMBER
CQUAL VARCHAR2(10)
CPER NUMBER
IADD VARCHAR2(100)
The registerbean.java file is as below: (This seems to work fine because I tried printing the values using <%= %> tag and it worked out fine and moreover the query string is intact.)
import java.io.*;
import java.util.*;
import java.lang.*;
public class registerbean
private String name,uname,pass,cpass,age,sex,add,ugcourse,ugqual,per,iadd,otherugqual,ccode;
public void setName(String a)
name=a;
public void setUname(String a)
uname=a;
public void setPass(String a)
pass=a;
public void setCpass(String a)
cpass=a;
public void setAge(String a)
age=a;
public void setSex(String a)
sex=a;
public void setAdd(String a)
add=a;
public void setOtherugqual(String a)
otherugqual=a;
public void setCcode(String a)
ccode=a;
public void setUgcourse(String a)
ugcourse=a;
public void setUgqual(String a)
ugqual=a;
public void setPer(String a)
per=a;
public void setIadd(String a)
iadd=a;
public String getName()
return(name);
public String getUname()
return(uname);
public String getPass()
return(pass);
public String getCpass()
return(cpass);
public String getAge()
return(age);
public String getCcode()
return(ccode);
public String getSex()
return(sex);
public String getAdd()
return(add);
public String getUgcourse()
return(ugcourse);
public String getUgqual()
return(ugqual);
public String getPer()
return(per);
public String getIadd()
return(iadd);
public String getOtherugqual()
return(otherugqual);
I initially thought the problem was with str but then str seems to be perfect and I get a string of the form �insert into reg values('c','c','c',98,'Male','c','B.Tech, Applied Artificial Neural Networks','HSC',9898,'h')� which I verified through a javascript debugger. The session scope used is to get values through the db bean from another jsp file. The problem is in the executeUpdate() line of this code. I even tried changing the updation table, but in vain. What could be done to rectify this? Please help me out and please do remember that I have no option but to use odbc.
Thanks in advance.
R. Yogaesh.

I didn't verify the type of exception and i'm now going to do that, but then when the string is as perfect as needed, what is the need for a prepared statement? What is the basic difference between the two? And basically what is the problem with this piece of code which creates an exception? Please reply as soon as possible.
Thankyou very much.
R. Yogaesh.

Users using Windows Authentication unable to login after upgrade to SQL Server 2012 SP2 CU1

We upgraded from SQL Server 2008 R2 to SQL Server 2012 SP2 CU1. Upgrade was successful. Users that have SQL Server Management Studio 2012 can successfully log in via Windows Authentication, but users with an older version of SQL Server Management
Studio are unable to log in via Windows Authentication.
The error they receive is listed below:
Connect not connect to XXXXXXX
Login Failed. The login is from an untrusted domain and cannot be used with Windows Authentication.
(Microsoft SQL Server, Error: 18452)
If we switch to Mixed authentication, users can log in via SQL Server Authentication.
Our security policy prohibits SQL Authentication.
Outside of having the staff upgrade to SQL Server 2012 SQL Server Management Studio, is there any setting I can set/unset to allow older version of SQL Server Management studio to connect to SQL Server 2012?
Thanks.
DJ

Glad to see that you were able to resolve the issue yourself, but for the curious, could you explain what this
Extended Protection is?
Erland Sommarskog, SQL Server MVP, [email protected]

Can I use Windows authentication with Firefox?

My company has a website that I need to login to on a daily basis. With IE I can set up Windows Authentication to have a "single sign-on" for this website and it automatically logs me in when I open the site. I do not see any options for authentication under the Tools menu. Using Firefox's password memory does not give the same functionality.

You can do it by adding the server host name to a list of trusted host names. Obviously you need to be very careful about not adding untrustworthy servers to the list. See this article for how: [http://support.mozilla.com/en-US/kb/Firefox%20asks%20for%20user%20name%20and%20password%20on%20internal%20sites Firefox asks for user name and password on internal sites | Troubleshooting | Firefox Help].

How to use windows authentication to MSSQL2008 from oim running in Linux

Hi All,
We have developed the code (in eclipse) in local windows machine to call sample stored procedures in MSSQL.The code works fine from client and are able to create, update users in MSSQL from windows.
We have OIM 11g R2 installed in Linux 6 on local VM. The question is while building the jar from the code and placing it in Java task directory of OIM, calling thr Code we need sql.dll file to implement the windows authentication(no user name & pwd) to connect to MSSQL, but this is not possible in Linux since the jar don't support.
Can any one please give suggestions on this to implement windows authentication from Linux through OIM server.
Edited by: 970422 on Nov 8, 2012 11:39 PM

I have no idea, but you might find it helpful to read Redhat's documentation concerning this subject:
http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/Deployment_Guide/ch-ldap.html

Database access using LDAP (AD) credentials

I am looking for any information about how to allow users access to a database and underlying applications that rely on DB authentication methods, to be able to access without specifying username/password credentials.
I know that OP$ accounts can be used in which case a user does not need to specify username/password credentials... but last I checked on this I thought there were security concerns related to this and this approach was not generally recommended.
We want users to be able to access databases and applications without login since they have already authenticated to the network using their credentials as authenticated via AD... So my quesrion is...
Is there a way that credentials can be passed from AD/OID using network login credentials of users to allow access to the database and applications? Is there a way to have an Oracle database talk directly to an AD LDAP solution or is it required that you implement OID and SSO?
I hope that makes sense.... Bottom line is we want to not require username/password authentication to every Oracle database application for users. We would like a way to use their AD credentials....
Is this possible?
Or can it only be accomplished with an OID/SSO inplemenetation?
Or is this essentially OPS$ accounts? are there security concerns with ops$ accounts.
Thanks.

This can be achieved by means of an enterprise user.
You may want to read this HowTo Document: How to set up Enterprise User Security.
~ Madrid

Database access using DAO

I'm new to Struts and would like to know about accessing database in struts
using Data Access Object (DAO) pattern.
It would be better If anybody can point me to any good source on how to write the DAO
and how to configure the Struts-Config.xml in order to use the DAO pattern,
Any sample would be better too.
Any help pretty much appreciated. Thanks in advanced.

I'm new to Struts and would like to know about
accessing database in struts
using Data Access Object (DAO) pattern.
It would be better If anybody can point me to any
good source on how to write the DAO
and how to configure the Struts-Config.xml in order
to use the DAO pattern,
Any sample would be better too.
Any help pretty much appreciated. Thanks in advanced.Hi,
I am developing a web application with struts and DAO pattern.
If you study this pattern you will know that it makes connection to database. and there is two way to obtain a connection object from your action class:
1. througth DriverManageras mention in java tutorial JDBC Basics:
2. througth Datasource as mention in java 1.3 turorial, chapter 31 "Resource Connections", sections "DataSource Objects and Connection Pools" and "Database Connections". This tutorial show you how to set up Datasource for Sun Java System Application Server Platform througth the j2ee deployment tool.
in the case of having an different platform from Sun Java System Application Server you must know how to correctly set up the datasource object with your web or ejb container.
I have chosen the second solution for my webApp. I am using tomcat co-bundle with netbeans 4.0. those ares the configuration files of my web app (according to netbeans 4.0 help context "Setting Up a Tomcat Database Connection Pool"):
file server.xml
<Resource name="jdbc/WebForumDB" type="javax.sql.DataSource"/>
<ResourceParams name="jdbc/WebForumDB">
<parameter>
<name>validationQuery</name>
<value>select * from "PBPUBLIC"."USER_ACCOUNT_TAB"</value>
</parameter>
<parameter>
<name>maxWait</name>
<value>5000</value>
</parameter>
<parameter>
<name>maxActive</name>
<value>4</value>
</parameter>
<parameter>
<name>password</name>
<value>PBPUBLIC</value>
</parameter>
<parameter>
<name>url</name>
<value>jdbc:pointbase://localhost:9092/WebForumDB</value>
</parameter>
<parameter>
<name>driverClassName</name>
<value>com.pointbase.jdbc.jdbcUniversalDriver</value>
</parameter>
<parameter>
<name>maxIdle</name>
<value>2</value>
</parameter>
<parameter>
<name>username</name>
<value>PBPUBLIC</value>
</parameter>
</ResourceParams>
file context.xml
<ResourceLink name="jdbc/WebForumDB"
type="javax.sql.DataSource"
global="jdbc/WebForumDB"/>
file web.xml
<resource-ref>
<description>Web Forum Database</description>
<res-ref-name>jdbc/WebForumDB</res-ref-name>
<res-type>javax.sql.DataSource</res-type>
<res-auth>Container</res-auth>
</resource-ref>
after all configuration work your DAOFactory class should nearly looks like this (my DAO pattern obtain connection througth Datasource object):
public class PointbaseDAOFactory
extends DAOFactory {
private static DataSource ds = null;
private static String dbJndiName = "java:comp/env/jdbc/WebForumDB";
/** Creates a new instance of PointbaseDAOFactory */
public PointbaseDAOFactory(){}
public static Connection createConnection()
throws DAOException {
InitialContext ic = null;
Connection conn = null;
try {
//lookup datasource
ic = new InitialContext();
log.info("method: createConnection, lookup dataSource jndi name: " + dbJndiName);
ds = (DataSource) ic.lookup(dbJndiName);
if (ds == null){
throw new DAOException("method: createConnection, null Datasource from jndi lookup");
// get connection
conn = ds.getConnection();
} catch (SQLException e){
throw new DAOException("method: createConnection, SQLException",e.getMessage());
} catch (NamingException e){
throw new DAOException("method: createConnection, NamingException",e.getMessage());
return conn;
hope this help you. :-)

Database access using windows authentication

Similar Messages

Maybe you are looking for