[NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Like (0) Share

Report

Posted on 1 Feb 2018 17:21:54 by panasys

Currently, our NAV server is 2-tier with the SQL database residing on the same server as the application/services. Now we're breaking it out to have the database be on a 3rd tier. We're first testing moving our DEV database to a DEV SQL server. But, so far we've been unable to make that happen due to issues with the web services and impersonation.

When we try to connect to the web services, we get the error: "The login failed when connecting to SQL Server DEVSQLSRV". When looking in the log on the SQL server's windows event log, it shows Anonymous authentication from the NAV server. In the same event, it shows "Package Name (NTLM only): NTLM V1". But, when testing with SQLCMD (see below), it connects with Kerberos from the NAV Server using the NAV server service.

The NAV RTC and Classic client seem to work fine. So it really seems like I'm missing some configuration with the web service. But, not sure exactly what.

Also, the web service works with Internet Explorer -- but nothing else -- and if I go to it with Internet Explorer first, then other browsers work until it times out. Obviously this won't work for services that rely on the web services.

The URL we're testing it with: navsrv.domain.local/.../Services

Below is our setup:

NAV Server Setup (NAVSRV):

All of the NAV services run as a domain user "DOMAIN\navservice"
The SPNs have been setup
- setspn -L DOMAIN\navservice
  - NAVPROD/NAVSRV:7046
  - NAVPROD/NAVSRV.DOMAIN.local:7046
  - NAVDEV/NAVSRV:7046
  - NAVDEV/NAVSRV.DOMAIN.local:7046
  - HTTP/NAVSRV
  - HTTP/NAVSRV.DOMAIN.local
  - HTTP/NAVSRV:7047
  - HTTP/NAVSRV.DOMAIN.local:7047
- Both NAV instances share same tcp port
Delegation has been enabled (unconstrained for now until setup is finalized)
User has been allowed in local Windows Security Policy for "Impersonate a client after authentication" for "DOMAIN\navservice"
I checked the http urlacl and confirmed it's set
- Reserved URL            : http://+:7047/
      User: DOMAIN\navservice
          Listen: Yes
          Delegate: Yes
          SDDL: D:(A;;GA;;;S-1-5-21-###)
- I tried setting it individually such as http://+://7047/NAVDEV/ but then the service wouldn't start throwing the error "HTTP could not register URL http://+:7047/NAVDEV/ ... because it conflicts with an existing registration on the machine". I did not try rebooting the server after changing this, just the services.

SQL Server Setup (DEVSQLSRV)

SQL Service runs as domain user "DOMAIN\devsqlservice"
The SPNs have been setup
- setspn -L DOMAIN\devsqlservice
  - MSSQLSvc/DEVSQLSRV.DOMAIN.locol:1433
  - MSSQLSvc/DEVSQLSRV.DOMAIN.local
  - MSSQLSvc/DEVSQLSRV:1433
  - MSSQLSvc/DEVSQLSRV
- Only one SQL instance
Delegation has been enabled (unconstrained for now until setup is finalized)
User has been allowed in local Windows Security Policy for "Impersonate a client after authentication" for "DOMAIN\devsqlservice"
Testing with sqlcmd from NAVSRV to DEVSQLSRV returns a kerberos connection (run as DOMAIN\navservice)
- sqlcmd -S DEVSQLSRV -Q"select net_transport, client_net_address, auth_scheme from sys.dm_exec_connections where session_id=@@spid"

NAV Database

DOMAIN\navservice user is dbowner on NAV database
Can connect just fine with RTC & Classic

What are we missing?

*This post is locked for comments

All responses (14)

Answers (1)

Verified answer

panasys 30 on 07 Feb 2018 at 15:16:41

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

The issue was the unconstrained delegation. It has to be constrained. Once I defined the services with "Trust this computer for delegation to specified services only", "Use Kerberos Only" and specified the services, it all worked.
panasys 30 on 02 Feb 2018 at 21:26:01

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Looking at packet capture, Kerberos Realm is "Null" when using Chrome and when using IE, it shows TGS Request with my username, etc. Totally different kerberos behavior.
panasys 30 on 02 Feb 2018 at 20:16:34

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Looking at procxp and tcpview, I don't see any connections back to itself.
panasys 30 on 02 Feb 2018 at 16:15:44

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

I am seeing this after enabling Kerberos logging:

A Kerberos Error Message was received:
on logon session
Client Time:
Server Time: 17:6:42.0000 2/2/2018 Z
Error Code: 0xd KDC_ERR_BADOPTION
Extended Error: 0xc00000bb KLIN(0)
Client Realm:
Client Name:
Server Realm: DOMAIN.local
Server Name: navservice@DOMAIN.local
Target Name: navservice@DOMAIN.local@DOMAIN.local
Error Text:
File: 9
Line: eff
Error Data is in record data.

I'm wondering if it's reason #4 under KDC_ERR_BADOPTION from here:

blogs.technet.microsoft.com/.../kerberos-errors-in-network-captures

But, the navservice account is not limited to constrained delegation.
panasys 30 on 02 Feb 2018 at 15:38:30

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Yes, as I mentioned in my initial post, the HTTP/Server SPNs are registered to the DOMAIN\navservice account. Also, Internet Explorer works already -- it's just Chrome and .NET services/programs that fail.
Suggested answer

Suresh Kulla 46,449 on 02 Feb 2018 at 01:01:04

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Check this link and reply from Gaspode

community.dynamics.com/.../144311
panasys 30 on 01 Feb 2018 at 19:57:01

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Yes, Chrome uses IE/Window's Internet Options and I added it there, but it did not work.
Suggested answer

Suresh Kulla 46,449 on 01 Feb 2018 at 19:41:18

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Did you add the url to the trusted website under chrome and then access it. ?
panasys 30 on 01 Feb 2018 at 18:37:23

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

We do not get the error while accessing it from IE, but we do with Chrome and other applications. As I mentioned before, for testing -- if we access the web service with IE, it works for Chrome for around 15-30 minutes then stops working again until we access it with IE again.

SSL is set to false and so is "WebServicesUseNTLMAuthentication"
Suggested answer

Suresh Kulla 46,449 on 01 Feb 2018 at 18:23:18

Like (0)

Report

RE: [NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

when you are getting that error, while accesing the service from IE or from application ? check if the webservices SSL is set to false and NTLM are enabled in CustomSetting.config fiel

Community site session details

[NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Helpful resources

News and Announcements

Quick Links

🌸 Community Spring Festival 2025 Challenge 🌸

Jonas ”Jones” Melgaard – Community Spotlight

Kudos to the March Top 10 Community Stars!

Leaderboard

Featured topics

Product updates

Community site session details

[NAV 2009 R2] 3-Tier Setup, Web Service: "The login failed when connecting to SQL Server"

Helpful resources

News and Announcements

Quick Links

🌸 Community Spring Festival 2025 Challenge 🌸

Jonas ”Jones” Melgaard – Community Spotlight

Kudos to the March Top 10 Community Stars!

Subscribe to this forum!

Select categories

Leaderboard

Featured topics

Product updates