When attempting to connect to a SQL Server host using the SQL Server agent, you may encounter an error like:
Failed to establish a SQL-Server JDBC connection protocol to Host [DOMAIN\HOSTNAME], user account [DOMAIN\USERNAME]. Reason: [Integrated authentication failed. ClientConnectionId:... Profile: MSSQLProfile{...}]
This article explains common causes of this error and provides step-by-step resolutions.
| Cause ID | Description |
|---|---|
| 1 | Domain user account issues: account may not exist, password incorrect, locked, disabled, expired, or lacks permissions to log into SQL Server or master database. SQL Server may not allow mixed mode authentication. |
| 2 | FglAM service running as Local System cannot impersonate users when using WINDOWS_DEFAULT authentication. |
| 3 | Network/firewall blocking connection, TCP/IP disabled on SQL Server, wrong port, or DNS cannot resolve hostname. |
| 4 | Missing or incorrect Service Principal Name (SPN) registrations causing Kerberos authentication to fail. |
| 5 | Domain trust issues when FglAM and SQL Server are in different domains. |
| 6 | Secure connections (SSL) required but not configured. |
| 7 | Kerberos authentication is enforced for the Active Directory account. |
| 8 | When creating a new connection to SQL Server and the NTLM flag is false in the SQL Server 7.3.0.10 cartridge |
| Resolution ID | Action |
|---|---|
| 1 | Verify and validate domain account: - Confirm account exists in AD. - Use runas /user:DOMAIN\USER cmd on FglAM server.- Test with SSMS or sqlcmd -S FQDN -E.- Ensure account has CONNECT SQL and VIEW SERVER STATE permissions.- Verify SQL Server allows Windows authentication. - Check account access to master database:
|
| 2 | Run FglAM service under domain account: - Open services.msc.- Locate Foglight Agent Manager service. - Change Log On to a domain account. - Restart service. Note: Issue may occur after upgrade due to Kerberos changes (FOG-9730). |
| 3 | Verify network connectivity and SQL Server settings: - Enable TCP/IP in SQL Server Configuration Manager. - Confirm listening port. - Use telnet HOSTNAME port or Test-NetConnection in PowerShell.- Check firewall rules. - Confirm DNS resolution of SQL Server hostname. |
| 4 | Check and register SPNs: - On SQL Server host, run: setspn -L <SQL_SERVICE_ACCOUNT>.- Verify presence of MSSQLSvc/SQLServerFQDN:port and MSSQLSvc/SQLServerFQDN.- Register missing SPNs with: (Requires domain admin or delegated rights) |
| 5 | Resolve domain trust issues: - Use FglAM server in the same domain as SQL Server host. - Troubleshoot cross-domain trust relationships. |
| 6 | Configure secure connections: - Enable SSL in installer and on FglAM. - Ensure SQL Server supports secure connections. |
| 7 | Address Kerberos authentication requirements: - Confirm Kerberos settings for AD account. - Adjust database agent authentication type if needed (Windows_Default vs Windows_Custom). |
| 8 | Defect FOG-9730 - Upgrade the SQL Server cartridge from 7.3.0.10 to a higher release. Contact Support if a cartridge at 7.3.0.11 or higher is not available for download from Supportlink - Then try installing the SQL Server agent using the installer wizard. |
If the above resolutions do not resolve the issue:
Check SQL Server error logs via Management Studio or file system for login failures referencing the domain user or ClientConnectionId.
Review any related Windows Event Logs on both SQL Server and FglAM hosts for authentication errors.