How to enable SQL Server linked server credential delegation on Linux?

Question

I have two SQL Server instances, "main" and "linked", deployed on Docker, and both are configured for Active Directory authentication using a local test AD. I want to add "linked" as a linked server on "main", and have "main" delegate the credentials of the current Windows login when running queries against the linked server. However, I can't seem to make it work: whenever I run a linked server query, I always get "Login failed for user 'DOMAIN\serviceaccount-of-main'."

1. Setup : two instances running in Docker, seeing each other through a shared docker network.

The "linked's" DNS name (linked.test-domain.com) is added to the "main's" /etc/hosts. I then followed KB https://support.microsoft.com/en-US/servicing/SQL/sql-server-2019/cumulative-update/kb4538382-implement-support-for-kerberos-constrained-delegation-in-sql-server-2019-on-linux : /etc/krb5.conf has "forwardable = true" , and delegation is configured in Active Directory itself.

1. Create Windows LOGIN "DOMAIN\test" on "main", give it sysadmin role.
2. Login into "main" with "DOMAIN\test" . I'm using VS Code with the "SQL Server (mssql)" extension.
   1. Verified with "klist -ef" that the created Service Ticket has the "Forwardable" flag set ("Flags: FRA")
   2. Verified that I'm indeed authenticated with Kerberos via "SELECT auth_scheme FROM sys.dm_exec_connections WHERE session_id = @@SPID;"
3. Add linked server:

      exec sp_addlinkedserver @server = N'linked.test-domain.com', @srvproduct = N'SQL Server'
   

4. Enable credential forwarding:

      exec sp_addlinkedsrvlogin @rmtsrvname = N'linked.test-domain.com', @locallogin = NULL, @useself = N'True';
   

5. Try to query the linked server:

      select * from [linked.test-domain.com].master.sys.databases;
   

This fails:

 Msg 18456, Level 14, State 1, Line 44
 Login failed for user 'DOMAIN\service-account-of-a'.

Debugging I tried:

• Enabled the PAL log per https://learn.microsoft.com/en-us/sql/linux/security/authentication/troubleshoot-active-directory?view=sql-server-ver16 . No obvious errors, it does log a successful ImpersonateSecurityContext.

    07/28/2026 08:46:17.463140201 Debug [security.kerberos.libos] <0000000937/0x00000220> ImpersonateSecurityContext() return value: 0x00000000
    07/28/2026 08:46:17.482526645 Debug [security.kerberos.libos] <0000000937/0x00000220> AcquireCredentialsHandle(): EmptyPrincipalName: true, fCredentialUse: 00000002, CurrentImpersonationHandle: 00007FBA8456BDA0, Package: negotiate
    07/28/2026 08:46:17.482568698 Debug [security.kerberos.libos] <0000000937/0x00000220> Calling host extension version of AcquireCredentialsHandle().
  

• Tried temporarily creating a login in "linked" for "DOMAIN\service-account-of-a": this made the linked query succeed i.e. the Windows login from "main" to "linked" appears to work correctly.
• Did a packet capture: the TGS-REQ of "main" has neither the "constrained delegation" flag, nor "additional tickets" in the body, i.e. it seems like "main" is not even attempting to delegate.

I'm at my wits end here. I'm using SQL Server 2022, while the original KB is for SQL Server 2019 -- is it possible the constrained delegation support was simply never ported to 2022?

Answer 1

On the Vscode host, also check if ssh config has ticket forwarding, the ssh server allows forwarding and vscode msal config is set to integrated security.