This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(156.8, 98%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EC%3C/text%3E%3C/svg%3E)
Is it possible for the MSSQL JDBC driver to connect to a SQL SERVER using a GMSA account? If it is, what should the connection string look like? Can the connection URL include the GMSA account name, such as "jdbc:sqlserver://<server>:<port>;databaseName=<database>;user=<GMSA account name>" ?
Yes, you can connect with a GMSA account - but only if you log on to Windows with that account. (Which would imply that your Java program is running as a service.)
When you log with Window authentication, you first need to log on Windows with that Windows user. You cannot log on SQL Server with a different Windows user.
GMSA account being a non-interactive user, can we logon to windows with that account?
Depends on whom you mean as "we". As I suggested in my response above, the Java program needs to run as a service with that account as the service account. The service will log in with the GMSA account.
Doesn't the driver take care of "log on to Windows with the GMSA account" with any of the authentication schemes present?
It does. It's not any different from a regular Windows account. Except, then, that you can only log in with the gMSA account through a service.
It may help if you give a background to your question.
Thank you for the details.
I ran the java program with the gmsa service account and then was able to connect to the sql server using IntegratedSecurity.
Great to hear that it worked out!
SQL JDBC Driver supports Windows Authentication using NTLM. Does it support Windows authentication with GMSA credentials using NTLM currently? If not, any plan to support in future?
Again, there is no difference between logging in with a user account of a gMSA - it's the same Windows authentication.
How about from a Linux machine? Tried connecting from a Linux machine but SQL JDBC driver is not working with GMSA from Linux machine
gMSA is a Windows thing. I'm not sure how you could use a gMSA on Linux. Then again, I don't do much with Linux, so maybe I'm missing something.
From a linux machine, I'm able to connect using Windows Authentication with NTLM authscheme (connecting using windows user credentials)
Can the same be achieved using GMSA as well(accountname with empty password)? I'm trying to find if there is any such support present?
I don't know exactly how your login from Linux (I don't have any such setup to test with), but it isi really no different. You need username and password. And for a gMSA, the password is managed by Windows, so it can be difficult.
What are you really trying to achieve?
ok.
I was trying to see if I can run a java program with local system account and use GMSA credentials (account-name with empty password) in the JDBC url string with NTLM as we do for windows accounts.
So, trying to find out if any such support is present.
And why were you trying to do that? That is, what is the underlying requirement that you are trying to address.
In any case, as far as I know, a gMSA account does not have an empty password, but a password managed by windows. So attempts to login with blank password cannot succeed.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 26%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
@Chiru Can you please share the JDBC connection string & the required connection properties you have used to connect to the SQL Server using gmsa account?
It follows from the above that the connection string is the same as with any other connection with integrated security.
Thanks @Erland Sommarskog for the response. I started both my java application service & the SQL server service account using the gmsa account. Now I am trying to connect to the SQL Server with the below JDBC URL with empty password.Below is the code snippet of my jdbc connection part.
String driverName="com.microsoft.sqlserver.jdbc.SQLServerDriver";
String url = "jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb";
Properties dbConProp = new Properties();
dbConProp.setProperty("integratedSecurity","true");//NO I18N
dbConProp.setProperty("authenticationScheme","NTLM");//NO I18N
dbConProp.setProperty("driverName", driverName);
dbConProp.setProperty("url", url);
dbConProp.setProperty("userName", userName);
dbConProp.setProperty("passWord", password);
Connection con = DriverManager.getConnection(url,dbConProp_jdbc);
I provided empty password for the connectivity but i get the below error.
url : jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb dbConProp : {integratedSecurity=true, password=, url=jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb, driverName=com.microsoft.sqlserver.jdbc.SQLServerDriver, authenticationScheme=NTLM, userName=svc_sql$} Unable to connect to MsSQL server while using the url-> jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb and user svc_sql$ com.microsoft.sqlserver.jdbc.SQLServerException: "User" (or "UserName") and "Password" connection properties must be specified for NTLM authentication. at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:2698) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1971) at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1263) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:208) at com.adventnet.appmanager.server.mssql.datacollection.ScheduleMsSQLDataCollection.main(ScheduleMsSQLDataCollection.java:834) Unable to connect to MsSQL server while using the url-> jdbc:sqlserver://10.10.10.11:1433;databaseName=master;domain=apmkerb and user svc_sql$ com.microsoft.sqlserver.jdbc.SQLServerException: "User" (or "UserName") and "Password" connection properties must be specified for NTLM authentication. at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:2698) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1971) at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1263) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:208) at com.adventnet.appmanager.server.mssql.datacollection.ScheduleMsSQLDataCollection.main(ScheduleMsSQLDataCollection.java:847)
Please let me know the misconfiguration done here if any.
This was the first sentence of my accepted answer on the top of this subthread:
Yes, you can connect with a GMSA account - but only if you log on to Windows with that account.
It seems that you failed to read this part.
I repeat: you first need log on to Windows with the gMSA account, and then you log in with Windows authentication. It is exactly the same as when logging in with any other Windows account.
As a newbie to gMSA, this is a bit confusing. gMSAs can't be used to log in to Windows and are only used as logon service accounts, right?
Sorry to bother. If possible can you please explain this briefly.
I repeat: you first need log on to Windows with the gMSA account, and then you log in with Windows authentication. It is exactly the same as when logging in with any other Windows account.
gMSAs can't be used to log in to Windows and are only used as logon service accounts, right?
I believe that is the case, at least in practice, since getting hold of the password can be difficult. Then again, why would you use a gMSA account, unless your program is running as a service?
If you want to know more about gMSA as such, you are better off asking with a Windows tag, as it is a Windows feature.
Hi @Chiru
A 64-bit architecture is required to run the Windows PowerShell commands used to administer group Managed Service Accounts.
Please refer to this doc for more details: Getting Started with Group Managed Service Accounts.
Best regards,
Cosmog Hong
If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our Documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Hi @CosmogHong-MSFT,
Thank you for the GMSA document.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(211.20000000000002, 61%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
To use a GSMA account, which is a domain account, you need to use trusted security, not Sqlserver standard security (name=) to connect. The Java application should be running under this account.
I started both my java application service & the SQL server service account using the gmsa account. Now I am trying to connect to the SQL Server with the below JDBC URL with empty password. Below is the code snippet of my jdbc connection part.
String driverName="com.microsoft.sqlserver.jdbc.SQLServerDriver";
String url = "jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb";
Properties dbConProp = new Properties();
dbConProp.setProperty("integratedSecurity","true");//NO I18N
dbConProp.setProperty("authenticationScheme","NTLM");//NO I18N
dbConProp.setProperty("driverName", driverName);
dbConProp.setProperty("url", url);
dbConProp.setProperty("userName", userName);
dbConProp.setProperty("passWord", password);
Connection con = DriverManager.getConnection(url,dbConProp_jdbc);
I provided empty password for the connectivity but i get the below error.
url : jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb dbConProp : {integratedSecurity=true, password=, url=jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb, driverName=com.microsoft.sqlserver.jdbc.SQLServerDriver, authenticationScheme=NTLM, userName=svc_sql$} Unable to connect to MsSQL server while using the url-> jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb and user svc_sql$ com.microsoft.sqlserver.jdbc.SQLServerException: "User" (or "UserName") and "Password" connection properties must be specified for NTLM authentication. at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:2698) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1971) at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1263) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:208) at com.adventnet.appmanager.server.mssql.datacollection.ScheduleMsSQLDataCollection.main(ScheduleMsSQLDataCollection.java:834) Unable to connect to MsSQL server while using the url-> jdbc:sqlserver://10.10.10.11:1433;databaseName=master;domain=apmkerb and user svc_sql$ com.microsoft.sqlserver.jdbc.SQLServerException: "User" (or "UserName") and "Password" connection properties must be specified for NTLM authentication. at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:2698) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1971) at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1263) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:208) at com.adventnet.appmanager.server.mssql.datacollection.ScheduleMsSQLDataCollection.main(ScheduleMsSQLDataCollection.java:847)
Please let me know the misconfiguration done here if any.
I started both my java application service & the SQL server service account using the gmsa account. Now I am trying to connect to the SQL Server with the below JDBC URL with empty password. Below is the code snippet of my jdbc connection part.
String driverName="com.microsoft.sqlserver.jdbc.SQLServerDriver";
String url = "jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb";
Properties dbConProp = new Properties();
dbConProp.setProperty("integratedSecurity","true");//NO I18N
dbConProp.setProperty("authenticationScheme","NTLM");//NO I18N
dbConProp.setProperty("driverName", driverName);
dbConProp.setProperty("url", url);
dbConProp.setProperty("userName", userName);
dbConProp.setProperty("passWord", password);
Connection con = DriverManager.getConnection(url,dbConProp_jdbc);
I provided empty password for the connectivity but I get the below error.
url : jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb dbConProp : {integratedSecurity=true, password=, url=jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb, driverName=com.microsoft.sqlserver.jdbc.SQLServerDriver, authenticationScheme=NTLM, userName=svc_sql$} Unable to connect to MsSQL server while using the url-> jdbc:sqlserver://apm-kerb-1.apmkerb.com:1433;databaseName=master;domain=apmkerb and user svc_sql$ com.microsoft.sqlserver.jdbc.SQLServerException: "User" (or "UserName") and "Password" connection properties must be specified for NTLM authentication. at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:2698) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1971) at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1263) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:208) at com.adventnet.appmanager.server.mssql.datacollection.ScheduleMsSQLDataCollection.main(ScheduleMsSQLDataCollection.java:834) Unable to connect to MsSQL server while using the url-> jdbc:sqlserver://10.10.10.11:1433;databaseName=master;domain=apmkerb and user svc_sql$ com.microsoft.sqlserver.jdbc.SQLServerException: "User" (or "UserName") and "Password" connection properties must be specified for NTLM authentication. at com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:2698) at com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:1971) at com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1263) at java.sql.DriverManager.getConnection(DriverManager.java:664) at java.sql.DriverManager.getConnection(DriverManager.java:208) at com.adventnet.appmanager.server.mssql.datacollection.ScheduleMsSQLDataCollection.main(ScheduleMsSQLDataCollection.java:847)
Please let me know the misconfiguration done here if any.
With trust connections a user name and password are not used. See the docs for connecting. On windows a dll needs to be installed, on other o/s you need to use Kerberos.
https://learn.microsoft.com/en-us/sql/connect/jdbc/building-the-connection-url?view=sql-server-ver16
I started both my java application service & the SQL server service account using the gmsa account. Now I am trying to connect to the SQL Server with the below JDBC URL with empty password.
Again: you log in as you would log with any other Windows user. That is, you specify Integrated Security and you don't specify any username or password.
@Bruce (SqlWork.com) Thanks for the response. I am logged into my windows machine with a normal AD account and started my java application & SQL Server using gmsa account. Upon using dll file without user name and password, JDBC connection is established using the system logged in AD account. I want to make connection with gmsa account. How to achieve this?
start the application with the runas option and specify the GMA account.
If you want the application to login as the GMA account then you use thread impersonation. This requires calling the win32 login api to get the GMA login token, and calling the impersonation api.
https://learn.microsoft.com/en-us/windows/win32/com/impersonation
note: typically you use GMA accounts when the application is running as a service, not when a user runs the application.
start the application with the runas option and specify the GMA account.
But that would require knowledge of the password for the gMSA account, wouldn't it?
note: typically you use GMA accounts when the application is running as a service, not when a user runs the application.
Yup.