Friday, October 19, 2007

SPN and Kerberos and Linked server

You have two SQL Servers, each hosts one instance. The service account uses the domain user account.

During installation of a SQL Server 2005, if the service account is LOCAL SYSTEM, the Service Principal Name is created automatically. If the service account is a regular domain user account, to support Kerberos authentication, you must run setSPN utility to register the service name: setspn –A MSSQLSvc/:1433

To set up a LINKed server connection to use the Impersonation, you must configure the SQL Server service account to be Trusted for Delegation.

For example, SQL ServerA has a query, which retrieves data from SQL ServerB. SQL ServerA uses a domain\user1 as the service acccount; SQL ServerB uses a domain\user2 as the service account. At ServerA, a Linked server object is created with impersonation authentication. To make the impersonation work, you must register SPN for ServerA SQL service and Configure the domain\user1 to be Trusted for Delegation.