Skip to content

Commit 87df594

Browse files
markingmynamemarkingmyname
committed
Merge branch 'release-data-studio' of https://github.com/MicrosoftDocs/sql-docs-pr into newads
2 parents 096ca7f + 44e0845 commit 87df594

1,533 files changed

Lines changed: 3240 additions & 3013 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.openpublishing.redirection.json‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -17300,11 +17300,6 @@
1730017300
"redirect_url": "/sql/database-engine/deprecated-database-engine-features-in-sql-server-version-15",
1730117301
"redirect_document_id": true
1730217302
},
17303-
{
17304-
"source_path": "docs/toc/previous-versions-sql-server.md",
17305-
"redirect_url": "/sql/sql-server/sql-server-help-installation",
17306-
"redirect_document_id": false
17307-
},
1730817303
{
1730917304
"source_path": "docs/integration-services/lift-shift/ssis-azure-connect-with-windows-auth.md",
1731017305
"redirect_url": "https://docs.microsoft.com/azure/data-factory/ssis-azure-connect-with-windows-auth",

‎docs/2014/database-engine/configure-managed-backup-sql-server-management-studio.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: "Configure Managed Backup (SQL Server Management Studio) | Microsoft Docs"
3+
description: Use the Managed Backup dialog box to configure SQL Server Managed Backup to Azure default setting. Learn about the options you need to consider.
34
ms.custom: ""
45
ms.date: "08/23/2017"
56
ms.prod: "sql-server-2014"

‎docs/2014/database-engine/continue-with-restore.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: "Continue with Restore | Microsoft Docs"
3+
description: In SQL Server, use the Continue with Restore dialog box to indicate whether you want to restore the next backup set.
34
ms.custom: ""
45
ms.date: "06/13/2017"
56
ms.prod: "sql-server-2014"

‎docs/2014/database-engine/monitor-sql-server-managed-backup-to-windows-azure.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: "Monitor SQL Server Managed Backup to Azure | Microsoft Docs"
3+
description: This article describes tools that you can use to determine the overall health of backups using SQL Server Managed Backup to Azure and identify errors.
34
ms.custom: ""
45
ms.date: "03/08/2017"
56
ms.prod: "sql-server-2014"

‎docs/2014/database-engine/setting-up-sql-server-managed-backup-to-windows-azure-for-availability-groups.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: "Setting up SQL Server Managed Backup to Azure for Availability Groups | Microsoft Docs"
3+
description: This tutorial shows you how to configure SQL Server Managed Backup to Microsoft Azure for databases participating in Always On Availability Groups.
34
ms.custom: ""
45
ms.date: "06/13/2017"
56
ms.prod: "sql-server-2014"

‎docs/2014/database-engine/sql-server-managed-backup-to-windows-azure-interoperability-and-coexistence.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: "SQL Server Managed Backup to Azure: Interoperability and Coexistence | Microsoft Docs"
3+
description: This article describes SQL Server Managed Backup to Microsoft Azure interoperability and coexistence with several features in SQL Server 2014.
34
ms.custom: ""
45
ms.date: "03/07/2017"
56
ms.prod: "sql-server-2014"

‎docs/2014/database-engine/sql-server-managed-backup-to-windows-azure-retention-and-storage-settings.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: "SQL Server Managed Backup to Azure - Retention and Storage Settings | Microsoft Docs"
3+
description: This topic describes how to configure SQL Server Managed Backup to Microsoft Azure for a database and to configure default settings for the instance.
34
ms.custom: ""
45
ms.date: "08/23/2017"
56
ms.prod: "sql-server-2014"

‎docs/2014/database-engine/troubleshooting-sql-server-managed-backup-to-windows-azure.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
---
22
title: "Troubleshooting SQL Server Managed Backup to Azure | Microsoft Docs"
3+
description: This article describes the tasks and tools you can use to troubleshoot errors that may occur during SQL Server Managed Backup to Microsoft Azure operations.
34
ms.custom: ""
45
ms.date: "03/08/2017"
56
ms.prod: "sql-server-2014"

‎docs/big-data-cluster/troubleshoot-ad-login-failed-untrusted-domain.md‎

Lines changed: 201 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,201 @@
1+
---
2+
title: AD mode login fails - untrusted domain
3+
titleSuffix: SQL Server Big Data Cluster
4+
description: Fix behavior - clients fail to Authenticate when endpoints DNS entries are configures as CNAME pointing to an alias name.
5+
author: MikeRayMSFT
6+
ms.author: mikeray
7+
ms.reviewer: mikeray
8+
ms.date: 05/01/2020
9+
ms.topic: how-to
10+
ms.prod: sql
11+
ms.technology: big-data-cluster
12+
---
13+
14+
# Symptom: AD mode login fails - untrusted domain (Big Data Clusters)
15+
16+
On a SQL Server Big Data Cluster (BDC) in Active Directory mode, a connection attempt may fail and the connection attempt returns the following error:
17+
18+
`Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.`
19+
20+
This can happens when you have configured DNS entries as CNAME pointing to an alias name of reverse proxy that distributes the traffic to Kubernetes nodes.
21+
22+
## Root cause
23+
24+
When the endpoints are configured with DNS entries with CNAME pointing to an alias name of reverse proxy that distributes the traffic to Kubernetes nodes:
25+
26+
- Kerberos authentication process looks for a service principal name (SPN) that matches the entry for CNAME; not the true SPN registered by BDC in active directory
27+
- Authentication fails
28+
29+
## Confirm root cause
30+
31+
After authentication fails, check the cache of Kerberos tickets.
32+
33+
To check the cache of tickets, use `klist` command.
34+
35+
Look for a ticket with an SPN matching the endpoint you tried to connect to.
36+
37+
The expected ticket is not there.
38+
39+
In this example, a master endpoint, `bdc-sql` DNS record is CNAME set to reverse proxy named `ServerReverseProxy`
40+
41+
```PowerShell
42+
Resolve-DnsName bdc-sql
43+
```
44+
45+
The following section shows the results from the previous command.
46+
47+
```
48+
Name Type TTL Section NameHost
49+
---- ---- --- ------- --------
50+
bdc-sql.mydomain.com CNAME 3600 Answer ReverseProxyServer.mydomain.com
51+
52+
Name : ReverseProxyServer.mydomain.com
53+
QueryType : A
54+
TTL : 3600
55+
Section : Answer
56+
IP4Address : 193.168.5.10
57+
```
58+
59+
>[!NOTE]
60+
>The following section references [`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html). `tshark` is a command line utility installed as part of [Wireshark](https://www.wireshark.org/docs/) network tracing utility).
61+
62+
To see the SPN requested from active directory, use `tshark`. The following command limits network tracing capture to Kerberos protocol communication and shows only `krb-error (30)` messages. These messages should contain failed SPN request messages.
63+
64+
```bash
65+
tshark -Y "kerberos && kerberos.msg_type == 30" -T fields -e kerberos.error_code -e kerberos.SNameString
66+
```
67+
68+
From a different command shell, try to connect to the master pod:
69+
70+
```bash
71+
klist purge
72+
73+
sqlcmd -S bdc-sql.mydomain.com,31433 -E
74+
```
75+
76+
See the following example output.
77+
78+
```bash
79+
klist purge
80+
81+
Current LogonId is 0:0xf6b58
82+
Deleting all tickets:
83+
Ticket(s) purged!
84+
85+
sqlcmd -S bdc-sql.mydomain.com,31433 -E
86+
sqlcmd: Error: Microsoft ODBC Driver 17 for SQL Server : Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.
87+
```
88+
89+
Check the `tshark` output.
90+
91+
```bash
92+
Capturing on 'Ethernet 3'
93+
25 krbtgt,RLAZURE.COM
94+
7 MSSQLSvc,ReverseProxyServer.mydomain.com:31433
95+
2 packets captured
96+
```
97+
98+
Notice the client requests `SPN MSSQLSvc,ReverseProxyServer.mydomain.com:31433` which doesn’t exist. The connection attempt eventually fails with error 7. Error 7 means `KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN Server not found in Kerberos database`.
99+
100+
In the correct configuration, the client requests the SPN registered by BDC. In the example, the correct SPN would have been `MSSQLSvc,bdc-sql.mydomain.com:31433`.
101+
102+
>[!NOTE]
103+
>Error 25 means `KDC_ERR_PREAUTH_REQUIRED` - additional pre-authentication required. It can safely be ignored. `KDC_ERR_PREAUTH_REQUIRED` is returned on the initial Kerberos AD request. By default, the Windows Kerberos Client is not including pre-authentication information in this first request.
104+
105+
To see the list of SPN registered by BDC for master endpoint, run `setspn -L mssql-master`.
106+
107+
See the following example output:
108+
109+
```bash
110+
Registered ServicePrincipalNames for CN=mssql-master,OU=bdc,DC=mydomain,DC=com:
111+
MSSQLSvc/bdc-sqlread.mydomain.com:31436
112+
MSSQLSvc/-sqlread:31436
113+
MSSQLSvc/bdc-sqlread.mydomain.com
114+
MSSQLSvc/bdc-sqlread
115+
MSSQLSvc/bdc-sql.mydomain.com:31433
116+
MSSQLSvc/bdc-sql:31433
117+
MSSQLSvc/bdc-sql.mydomain.com
118+
MSSQLSvc/bdc-sql
119+
MSSQLSvc/master-p-svc.mydomain.com:1533
120+
MSSQLSvc/master-p-svc:1533
121+
MSSQLSvc/master-p-svc.mydomain.com:1433
122+
MSSQLSvc/master-p-svc:1433
123+
MSSQLSvc/master-p-svc.mydomain.com
124+
MSSQLSvc/master-p-svc
125+
MSSQLSvc/master-svc.mydomain.com:1533
126+
MSSQLSvc/master-svc:1533
127+
MSSQLSvc/master-svc.mydomain.com:1433
128+
MSSQLSvc/master-svc:1433
129+
MSSQLSvc/master-svc.mydomain.com
130+
MSSQLSvc/master-svc
131+
```
132+
133+
In the results above the reverse proxy address should not be registered.
134+
135+
## Resolve
136+
137+
This section shows two ways to resolve the issue. After making the appropriate changes, run `ipconfig -flushdns` and `klist purge` in your client. Then attempt to connect again.
138+
139+
### Option 1
140+
141+
Remove the CNAME record for each BDC endpoint in DNS and replace with multiple `A` records that points to each Kubernetes node or each Kubernetes master if you have more than one master.
142+
143+
>[!TIP]
144+
>The script described below uses PowerShell. See [Installing PowerShell on Linux](/powershell/scripting/install/installing-powershell-core-on-linux) for more information.
145+
146+
You can use the following PowerShell Script to update DNS endpoints records. Run the script from any computer connected to the same domain:
147+
148+
```powershell
149+
#Specify the DNS server, example contoso.local
150+
$Domain_DNS_name=mydomain.com'
151+
152+
#DNS records for bdc endpoints
153+
$Controller_DNS_name = 'bdc-control'
154+
$Managment_proxy_DNS_name= 'bdc-proxy'
155+
$Master_Primary_DNS_name = 'bdc-sql'
156+
$Master_Secondary_DNS_name = 'bdc-sqlread'
157+
$Gateway_DNS_name = 'bdc-gateway'
158+
$AppProxy_DNS_name = 'bdc-appproxy'
159+
160+
#Performing Endpoint DNS records Checks..
161+
162+
#Build array of endpoints
163+
$BdcEndpointsDns = New-Object System.Collections.ArrayList
164+
165+
[void]$BdcEndpointsDns.Add($Controller_DNS_name)
166+
[void]$BdcEndpointsDns.Add($Managment_proxy_DNS_name)
167+
[void]$BdcEndpointsDns.Add($Master_Primary_DNS_name)
168+
[void]$BdcEndpointsDns.Add($Master_Secondary_DNS_name)
169+
[void]$BdcEndpointsDns.Add($Gateway_DNS_name)
170+
[void]$BdcEndpointsDns.Add($AppProxy_DNS_name)
171+
172+
#Build arrary for results
173+
$BdcEndpointsDns_Result = New-Object System.Collections.ArrayList
174+
175+
foreach ($DnsName in $BdcEndpointsDns) {
176+
try {
177+
$endpoint_DNS_record = Resolve-DnsName $DnsName -Type A -Server $Domain_DNS_IP_address -ErrorAction Stop
178+
foreach ($ip in $endpoint_DNS_record.IPAddress) {
179+
[void]$BdcEndpointsDns_Result.Add("OK - $DnsName is an A record with an IP $ip")
180+
}
181+
}
182+
catch {
183+
[void]$BdcEndpointsDns_Result.Add("MisConfiguration - $DnsName is not an A record or does not exists")
184+
}
185+
}
186+
187+
#show the results
188+
$BdcEndpointsDns_Result
189+
```
190+
191+
### Option 2
192+
193+
Alternatively, it's possible to work around the issue by modifying the CNAME to point to the IP address of the reverse proxy rather than the name of the reverse proxy.
194+
195+
## Confirm Resolution
196+
197+
After resoling the fix with one of the options above, confirm the fix by connecting to Big Data Cluster with active directory.
198+
199+
## Next steps
200+
201+
[Verify reverse DNS entry (PTR record) for domain controller](deploy-active-directory.md#verify-reverse-dns-entry-for-domain-controller).

‎docs/database-engine/availability-groups/windows/active-secondaries-readable-secondary-replicas-always-on-availability-groups.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ ms.author: mathoma
9898

9999
- The DBCC SHRINKFILE operation on files containing disk-based tables might fail on the primary replica if the file contains ghost records that are still needed on a secondary replica.
100100

101-
- Beginning in [!INCLUDE[ssSQL14](../../../includes/sssql14-md.md)], readable secondary replicas can remain online even when the primary replica is offline due to user action or a failure. However, read-only routing does not work in this situation because the availability group listener is offline as well. Clients must connect directly to the read-only secondary replicas for read-only workloads.
101+
- Beginning in [!INCLUDE[ssSQL14](../../../includes/sssql14-md.md)], readable secondary replicas can remain online even when the primary replica is offline due to user action or a failure, for example, synchronization was suspended due to a user command or a failure, or a replica is resolving status due to the WSFC being offline. However, read-only routing does not work in this situation because the availability group listener is offline as well. Clients must connect directly to the read-only secondary replicas for read-only workloads.
102102

103103
> [!NOTE]
104104
> If you query the [sys.dm_db_index_physical_stats](../../../relational-databases/system-dynamic-management-views/sys-dm-db-index-physical-stats-transact-sql.md) dynamic management view on a server instance that is hosting a readable secondary replica, you might encounter a REDO blocking issue. This is because this dynamic management view acquires an IS lock on the specified user table or view that can block requests by a REDO thread for an X lock on that user table or view.

0 commit comments

Comments
 (0)