4 ms·

Does anyone know whether Analysis Services and Integration Services are also going to be available on Linux? What about Windows Authentication mechanism - is it

Does anyone know whether Analysis Services and Integration Services are also going to be available on Linux? What about Windows Authentication mechanism - is it going to be available, if yes then how would a Linux box join AD domain?

voltagex_ 9y ago
No idea about the Services, but AD is covered in https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-active-directory-authentication https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-...
Neeek 9y ago
I thought because Kerberos was OS agnostic you could already have Linux interacting with Windows AD?
- polskibus 9y ago
  Microsoft has two extensions to Kerberos, impersonation and delegation. To use WA in a multi-tier set up (app, dB) you need those. I'm not sure if those extensions are available on Linux.
  - lukeh 9y ago
    They've been in MIT Kerberos for years now (since 2009 I think?). And at least partly in Heimdal for around the same time.
  - Neeek 9y ago
    Ah, thank you for clarifying :)
gaius 9y ago
Whst is and is not included: https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-release-notes https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-...
noinsight 9y ago
> how would a Linux box join AD domain? By using Red Hat's sssd which handles it pretty much seamlessly. You get fully working Kerberos with that which should work with SQL server probably.
- cjsuk 9y ago
  You get mostly working Kerberos. It's not quite that reliable.
  - noinsight 9y ago
    What issues have you run into? I haven't encountered any problems. Admittedly I mostly use it for logging into servers with AD accounts (it will autocreate homedirs too!) and access controls via AD groups. You can permit SSH/sudo access through AD group memberships. SSH works with Kerberos SSO.
    - cjsuk 9y ago
      Mainly periodic random unexplainable KDC_ERR_C_PRINCIPAL_UNKNOWN which appears to be the Kerberos equivalent of "fuck you!"
      - dijit 9y ago
        Check your ntp; this happens when kerberos loses trust with the principle. Happens on Windows too but they mitigate it by _forcing_ you to use NTP against the AD servers.
        cjsuk 9y ago
        We already use NTP (chrony) against the DCs. We did have some problems with timedatectl being a dick in the early days of CentOS 7 which reported NTP as enabled but it wasn't. That caused the same issue but we resolved that one and it still periodically happens. I can't quote for the state of the DC's though; they're not mine and I don't want them! :)

voltagex_ 9y ago

No idea about the Services, but AD is covered in https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-active-directory-authentication https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-...

Neeek 9y ago

I thought because Kerberos was OS agnostic you could already have Linux interacting with Windows AD?

polskibus 9y ago
Microsoft has two extensions to Kerberos, impersonation and delegation. To use WA in a multi-tier set up (app, dB) you need those. I'm not sure if those extensions are available on Linux.
- lukeh 9y ago
  They've been in MIT Kerberos for years now (since 2009 I think?). And at least partly in Heimdal for around the same time.
- Neeek 9y ago
  Ah, thank you for clarifying :)

gaius 9y ago

Whst is and is not included: https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-release-notes https://docs.microsoft.com/en-us/sql/linux/sql-server-linux-...

noinsight 9y ago

> how would a Linux box join AD domain? By using Red Hat's sssd which handles it pretty much seamlessly. You get fully working Kerberos with that which should work with SQL server probably.

cjsuk 9y ago
You get mostly working Kerberos. It's not quite that reliable.
- noinsight 9y ago
  What issues have you run into? I haven't encountered any problems. Admittedly I mostly use it for logging into servers with AD accounts (it will autocreate homedirs too!) and access controls via AD groups. You can permit SSH/sudo access through AD group memberships. SSH works with Kerberos SSO.
  - cjsuk 9y ago
    Mainly periodic random unexplainable KDC_ERR_C_PRINCIPAL_UNKNOWN which appears to be the Kerberos equivalent of "fuck you!"
    - dijit 9y ago
      Check your ntp; this happens when kerberos loses trust with the principle. Happens on Windows too but they mitigate it by _forcing_ you to use NTP against the AD servers.
      - cjsuk 9y ago
        We already use NTP (chrony) against the DCs. We did have some problems with timedatectl being a dick in the early days of CentOS 7 which reported NTP as enabled but it wasn't. That caused the same issue but we resolved that one and it still periodically happens. I can't quote for the state of the DC's though; they're not mine and I don't want them! :)