Login failed for user 'NT AUTHORITY\ANONYMOUS LOGIN'

Question

I'm facing a very specific issue on my SQL server instance. Recently I had to create a linked server (referencing server B) in my server A, to connect to a database in B through A. Everything worked and works well when I'm in the server A (accessing via remote desktop).

I need to query the server A through an Apache application, it always worked. But when I need to query the server B through the A using Apache (not in remote desktop, where it works), the query fails to complete, so I open SSMS, execute the same query and it returns the following error:

"Login failed for user 'NT AUTHORITY\ANONYMOUS LOGIN'"

What really concerns me is that it's not an authentication error (even though the message says it), because when I access the server A via RD, execute the query and come back to the Apache application, then I am able to query, which makes no sense at all.

It looks like it's an intermittent issue, and sometimes I just can't force it.

Answer 1

Hi @Pedro Fernandes ,

What you describe is a classic double hop scenario. an Apache application->Server A –linked server -> Server B

Please make sure delegation has to set for the middle tier SQL instance service account(server A). This means that make sure SQL Server service account was trusted for delegation in AD.

You can go to domain controller -> open active directory users and computers -> users -> right-click the SQL Server Service account in users folder -> Properties.
Then go to delegation tab in the Properties dialog box, ensure that "Trust this user for delegation to any service (Kerberos only)" or "Trust this user for delegation to specified services (Kerberos only) – Use Kerberos only "is selected. If you choose the " Trust this user for delegation to specified services (Kerberos only)", please add the SQL Server service. ( please do the same for the delegation tab in the Properties of server's computer object in active directory users and computers.)

Then go to the account tab in properties and ensure that the "account is sensitive and cannot be delegated" option is not selected.

Please refer to this blog or this one.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

Hey guys! Follow this below article for detail about configuration and all the related settings.

If you are new to this kind of error, then possibly this article will help from basic to advanced understanding of the issue and also further troubleshooting.

https://kingfishertechtips.in/kerberos-issue-nt-anonymous-login-failed/

Answer 3

Hey guys! Follow this below article for detail about configuration and all the related settings.

If you are new to this kind of error, then possibly this article will help from basic to advanced understanding of the issue and also further troubleshooting.

https://kingfishertechtips.in/kerberos-issue-nt-anonymous-login-failed/