Is it possible for the MSSQL JDBC driver to connect to a SQL SERVER using a GMSA account? If it is, what should the connection string look like? Can the connection URL include the GMSA account name, such as "jdbc:sqlserver://<server>:<port>;databaseName=<database>;user=<GMSA account name>" ?

Yes, you can connect with a GMSA account - but only if you log on to Windows with that account. (Which would imply that your Java program is running as a service.) When you log with Window authentication, you first need to log on Windows with that Windows user. You cannot log on SQL Server with a different Windows user.

Hi @Chiru A 64-bit architecture is required to run the Windows PowerShell commands used to administer group Managed Service Accounts. Please refer to this doc for more details: Getting Started with Group Managed Service Accounts . Best regards, Cosmog Hong If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our Documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Can the MSSQL JDBC driver connect to a SQL SERVER using a GMSA account?

Accepted answer

Erland Sommarskog 107.2K Reputation points

2023-10-20T22:09:33.1933333+00:00

Yes, you can connect with a GMSA account - but only if you log on to Windows with that account. (Which would imply that your Java program is running as a service.)

When you log with Window authentication, you first need to log on Windows with that Windows user. You cannot log on SQL Server with a different Windows user.
Please sign in to rate this answer.
Chiru 20 Reputation points

2023-10-23T04:13:37.01+00:00

GMSA account being a non-interactive user, can we logon to windows with that account?

Doesn't the driver take care of "log on to Windows with the GMSA account" with any of the authentication schemes present?

Erland Sommarskog 107.2K Reputation points

2023-10-23T21:03:39.29+00:00

GMSA account being a non-interactive user, can we logon to windows with that account?

Depends on whom you mean as "we". As I suggested in my response above, the Java program needs to run as a service with that account as the service account. The service will log in with the GMSA account.

Doesn't the driver take care of "log on to Windows with the GMSA account" with any of the authentication schemes present?

It does. It's not any different from a regular Windows account. Except, then, that you can only log in with the gMSA account through a service.

It may help if you give a background to your question.

Chiru 20 Reputation points

2023-11-08T08:06:51.9+00:00

Thank you for the details.

I ran the java program with the gmsa service account and then was able to connect to the sql server using IntegratedSecurity.

Erland Sommarskog 107.2K Reputation points

2023-11-08T22:24:48.18+00:00

Great to hear that it worked out!

Chiru 20 Reputation points

2023-11-09T06:15:04.8766667+00:00

SQL JDBC Driver supports Windows Authentication using NTLM. Does it support Windows authentication with GMSA credentials using NTLM currently? If not, any plan to support in future?

Erland Sommarskog 107.2K Reputation points

2023-11-09T19:35:07.6133333+00:00

Again, there is no difference between logging in with a user account of a gMSA - it's the same Windows authentication.

Chiru 20 Reputation points

2023-11-14T03:40:53.5366667+00:00

How about from a Linux machine? Tried connecting from a Linux machine but SQL JDBC driver is not working with GMSA from Linux machine

Erland Sommarskog 107.2K Reputation points

2023-11-14T05:22:58.8266667+00:00

gMSA is a Windows thing. I'm not sure how you could use a gMSA on Linux. Then again, I don't do much with Linux, so maybe I'm missing something.

Chiru 20 Reputation points

2023-11-20T05:59:43.95+00:00

From a linux machine, I'm able to connect using Windows Authentication with NTLM authscheme (connecting using windows user credentials)

Can the same be achieved using GMSA as well(accountname with empty password)? I'm trying to find if there is any such support present?

Erland Sommarskog 107.2K Reputation points

2023-11-20T09:18:32.3133333+00:00

I don't know exactly how your login from Linux (I don't have any such setup to test with), but it isi really no different. You need username and password. And for a gMSA, the password is managed by Windows, so it can be difficult.

What are you really trying to achieve?

Chiru 20 Reputation points

2023-11-21T04:56:11.0633333+00:00

ok.

I was trying to see if I can run a java program with local system account and use GMSA credentials (account-name with empty password) in the JDBC url string with NTLM as we do for windows accounts.

So, trying to find out if any such support is present.

Erland Sommarskog 107.2K Reputation points

2023-11-21T21:04:59.73+00:00

And why were you trying to do that? That is, what is the underlying requirement that you are trying to address.

In any case, as far as I know, a gMSA account does not have an empty password, but a password managed by windows. So attempts to login with blank password cannot succeed.
Sign in to comment

Share via

Can the MSSQL JDBC driver connect to a SQL SERVER using a GMSA account?

1 additional answer