Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We're running a PHP 5.4 application on Server 2008 R2. We would like to connect to a SQL Server 2008 database, on a separate server, using Windows authentication (must be Windows authentication--the DB admins won't let us connect any other way). I have downloaded the SQL Server drivers for PHP and installed them. IIS is configured for Windows authentication, and anonymous authentication has been disabled. $_SERVER['AUTH_USER'] reports our currently logged on Windows account. In php.ini, we have set fastcgi.impersonate = 1.

When we setup a connection using the following code from Microsoft:

$serverName = "sqlserver\sqlserver";
$connectionInfo = array( "Database"=>"some_db");

/* Connect using Windows Authentication. */
$conn = sqlsrv_connect( $serverName, $connectionInfo);
if( $conn === false )
{
     echo "Unable to connect.</br>";
     die( print_r( sqlsrv_errors(), true));
}

We are presented with the following error message:

Unable to connect.
Array ( [0] => Array ( [0] => 28000 [SQLSTATE] => 28000 [1] => 18456 [code] => 18456 [2] => [Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. [message] => [Microsoft][SQL Server Native Client 11.0][SQL Server]Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'. )

Is it possible to connect to SQL Server 2008 via PHP using Windows authentication? Are there any additional required settings we need to make on IIS, SQL Server, or any other component (like a domain controller)?

share|improve this question
    
Since you ask about the need for a domain controller, are the machines currently in a workgroup? –  Chris McKeown Jul 10 '12 at 21:08
    
No--everything is on a Windows domain. –  Jeff Jul 10 '12 at 21:11
    
I think this is probably a delegation of rights issue. Although you're authenticating with the IIS server using your Windows login, that probably won't have the rights to hop over the network using those credentials. I'm not putting this in an answer though since I'm not certain about this. –  Chris McKeown Jul 10 '12 at 21:18
    
Actually, I'm fairly certain this is what you're seeing, I'll put an answer in. –  Chris McKeown Jul 10 '12 at 21:26
add comment

2 Answers

up vote 1 down vote accepted

This is very probably a delegation issue. Although the client will authenticate with your IIS server using their domain credentials, it will not be trusted for delegation to access network resources.

This has a good explanation of the issue. Also see here

share|improve this answer
    
I'm going to try this tomorrow and see if that fixes. What exactly needs to be configured for trusted delegation--the IIS server or the domain user accounts? Thanks! –  Jeff Jul 11 '12 at 1:41
    
I believe the IIS server itself will need to be configured to allow delegation of credentials to backend servers. The tool referenced in my first link is probably a good place to start. –  Chris McKeown Jul 11 '12 at 22:06
    
Having said the above, do you need to connect to the backend SQL server as the user? If your app could authenticate as the machine account (as per Wyatt's answer), would that be OK? –  Chris McKeown Jul 12 '12 at 8:50
add comment

A few ways to skin this, but basically the trick is to make the PHP process run in the right context.

If you are already running as NETWORK SERVICE then you can get the machine account added to the database server; the username is DOMAIN\COMPUTERNAME$.

You could also configure the application pool to use a different named user if that is easier.

Configuring PHP to impersonate probably won't help here unless the requirement is to have users pass-through authenticate against the database.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.