You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/linux/sql-server-linux-active-directory-authentication.md
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,9 +2,9 @@
2
2
title: Active Directory Authentication with SQL Server on Linux | Microsoft Docs
3
3
description: This tutorial provides the configuration steps for AAD authentication for SQL Server on Linux.
4
4
author: meet-bhagdev
5
-
ms.date: 10/09/2017
5
+
ms.date: 01/30/2018
6
6
ms.author: meetb
7
-
manager: jhubbard
7
+
manager: craigg
8
8
ms.topic: article
9
9
ms.prod: "sql-non-specified"
10
10
ms.prod_service: "database-engine"
@@ -52,7 +52,7 @@ Before you configure AD Authentication, you need to:
52
52
> [!IMPORTANT]
53
53
> Limitations:
54
54
> - At this time, the only authentication method supported for database mirroring endpoint is CERTIFICATE. WINDOWS authentication method will be enabled in a future release.
55
-
> -3rd party AD tools like Centrify, Powerbroker and Vintela are not supported
55
+
> -Third-party AD tools like Centrify, Powerbroker, and Vintela are not supported
56
56
57
57
## Join [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] host to AD domain
58
58
@@ -92,15 +92,15 @@ Use the following steps to join a [!INCLUDE[ssNoVersion](../includes/ssnoversion
92
92
```
93
93
94
94
> [!NOTE]
95
-
> The network interface (eth0) might differ for differnet machines. To find out which one you are using, run ifconfig and copy the interface that has an IP address and transmitted and received bytes.
95
+
> The network interface (eth0) might differ for different machines. To find out which one you are using, run ifconfig and copy the interface that has an IP address and transmitted and received bytes.
96
96
97
97
After editing this file, restart the network service:
98
98
99
99
```bash
100
100
sudo ifdown eth0 && sudo ifup eth0
101
101
```
102
102
103
-
Now check that your `/etc/resolv.conf` file contains a line like the following:
103
+
Now check that your `/etc/resolv.conf` file contains a line like the following example:
104
104
105
105
```Code
106
106
nameserver **<AD domain controller IP address>**
@@ -122,17 +122,17 @@ Use the following steps to join a [!INCLUDE[ssNoVersion](../includes/ssnoversion
122
122
sudo systemctl restart network
123
123
```
124
124
125
-
Now check that your `/etc/resolv.conf` file contains a line like the following:
125
+
Now check that your `/etc/resolv.conf` file contains a line like the following example:
126
126
127
127
```Code
128
128
nameserver **<AD domain controller IP address>**
129
129
```
130
130
131
131
1. Join the domain
132
132
133
-
Once you've confirmed that your DNS is configured properly, join the domain by running the command below. You'll need to authenticate using an AD account that has sufficient privileges in AD to join a new machine to the domain.
133
+
Once you've confirmed that your DNS is configured properly, join the domain by running the following command. You must authenticate using an AD account that has sufficient privileges in AD to join a new machine to the domain.
134
134
135
-
Specifically, this command will create a new computer account in AD, create the `/etc/krb5.keytab` host keytab file, and configure the domain in `/etc/sssd/sssd.conf`:
135
+
Specifically, this command creates a new computer account in AD, create the `/etc/krb5.keytab` host keytab file, and configure the domain in `/etc/sssd/sssd.conf`:
@@ -143,9 +143,9 @@ Use the following steps to join a [!INCLUDE[ssNoVersion](../includes/ssnoversion
143
143
> [!NOTE]
144
144
> If you see an error, "Necessary packages are not installed," then you should install those packages using your Linux distribution's package manager before running the `realm join` command again.
145
145
>
146
-
> If you receive an error, "Insufficient permissions to join the domain," then you will need to check with a domain administrator that you have sufficient permissions to join Linux machines to your domain.
146
+
> If you receive an error, "Insufficient permissions to join the domain," then you need to check with a domain administrator that you have sufficient permissions to join Linux machines to your domain.
147
147
148
-
> SQL Server uses SSSD and NSS for mapping user accounts and groups to security identifiers (SID's). SSSD must be configured and running in order for SQL Server to create AD logins successfully. Realmd will usually do this automatically as part of joining the domain, but in some cases you will need to do this separately.
148
+
> SQL Server uses SSSD and NSS for mapping user accounts and groups to security identifiers (SID's). SSSD must be configured and running in order for SQL Server to create AD logins successfully. Realmd usually does this automatically as part of joining the domain, but in some cases you must do this separately.
149
149
>
150
150
> Check out the following to configure [SSSD manually](https://access.redhat.com/articles/3023951), and [configure NSS to work with SSSD](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/system-level_authentication_guide/configuring_services#Configuration_Options-NSS_Configuration_Options)
151
151
@@ -177,7 +177,7 @@ For more information, see the Red Hat documentation for [Discovering and Joining
177
177
## Create AD user for [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] and set SPN
178
178
179
179
> [!NOTE]
180
-
> In the next steps we will use your [fully qualified domain name](https://en.wikipedia.org/wiki/Fully_qualified_domain_name). If you are on **Azure**, you will have to**[create one](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/portal-create-fqdn)** before you proceed.
180
+
> In the next steps we will use your [fully qualified domain name](https://en.wikipedia.org/wiki/Fully_qualified_domain_name). If you are on **Azure**, you must**[create one](https://docs.microsoft.com/en-us/azure/virtual-machines/linux/portal-create-fqdn)** before you proceed.
181
181
182
182
1. On your domain controller, run the [New-ADUser](https://technet.microsoft.com/library/ee617253.aspx) PowerShell command to create a new AD user with a password that never expires. This example names the account "mssql," but the account name can be anything you like. You will be prompted to enter a new password for the account:
183
183
@@ -199,13 +199,13 @@ For more information, see the Red Hat documentation for [Discovering and Joining
199
199
> [!NOTE]
200
200
> If you receive an error, "Insufficient access rights," then you need to check with a domain administrator that you have sufficient permissions to set an SPN on this account.
201
201
>
202
-
> If you change the TCP port in the future, then you will need to run the setspn command again with the new port number. You will also need to add the new SPN to the SQL Server service keytab by following the steps in the next section.
202
+
> If you change the TCP port in the future, then you need to run the setspn command again with the new port number. You also need to add the new SPN to the SQL Server service keytab by following the steps in the next section.
203
203
204
204
3. For more information, see [Register a Service Principal Name for Kerberos Connections](../database-engine/configure-windows/register-a-service-principal-name-for-kerberos-connections.md).
205
205
206
206
## Configure [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] service keytab
207
207
208
-
1. Check the Key Version Number (kvno) for the AD account created in the previous step. Usually it will be 2, but it could be another integer if you changed the account's password multiple times. On the [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] host machine, run the following:
208
+
1. Check the Key Version Number (kvno) for the AD account created in the previous step. Usually it is 2, but it could be another integer if you changed the account's password multiple times. On the [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] host machine, run the following:
209
209
210
210
```bash
211
211
kinit user@CONTOSO.COM
@@ -290,7 +290,7 @@ The specific connection string parameter for clients to use AD Authentication de
290
290
291
291
## Next steps
292
292
293
-
In this tutorial, we walked through how to setup Active Directory authentication with SQL Server on Linux. You learned how to:
293
+
In this tutorial, we walked through how to set up Active Directory authentication with SQL Server on Linux. You learned how to:
294
294
> [!div class="checklist"]
295
295
> * Join [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] host to AD domain
296
296
> * Create AD user for [!INCLUDE[ssNoVersion](../includes/ssnoversion-md.md)] and set SPN
Copy file name to clipboardExpand all lines: docs/linux/sql-server-linux-availability-group-cluster-ubuntu.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,8 +3,8 @@ title: Configure Ubuntu Cluster for SQL Server Availability Group | Microsoft Do
3
3
description:
4
4
author: MikeRayMSFT
5
5
ms.author: mikeray
6
-
manager: jhubbard
7
-
ms.date: 03/17/2017
6
+
manager: craigg
7
+
ms.date: 01/30/2018
8
8
ms.topic: article
9
9
ms.prod: "sql-non-specified"
10
10
ms.prod_service: "database-engine"
@@ -24,13 +24,13 @@ This document explains how to create a three-node cluster on Ubuntu and add a pr
24
24
For high availability, an availability group on Linux requires three nodes - see [High availability and data protection for availability group configurations](sql-server-linux-availability-group-ha.md).
25
25
26
26
> [!NOTE]
27
-
> At this point, SQL Server's integration with Pacemaker on Linux is not as coupled as with WSFC on Windows. From within SQL, there is no knowledge about the presence of the cluster, all orchestration is outside in and the service is controlled as a standalone instance by Pacemaker. Also, virtual network name is specific to WSFC, there is no equivalent of the same in Pacemaker. Always On dynamic management views that query cluster information will return empty rows. You can still create a listener to use it for transparent reconnection after failover, but you will have to manually register the listener name in the DNS server with the IP used to create the virtual IP resource (as explained below).
27
+
> At this point, SQL Server's integration with Pacemaker on Linux is not as coupled as with WSFC on Windows. From within SQL, there is no knowledge about the presence of the cluster, all orchestration is outside in, and the service is controlled as a standalone instance by Pacemaker. Also, virtual network name is specific to WSFC, there is no equivalent of the same in Pacemaker. Always On dynamic management views that query cluster information will return empty rows. You can still create a listener to use it for transparent reconnection after failover, but you will have to manually register the listener name in the DNS server with the IP used to create the virtual IP resource (as explained below).
28
28
29
29
The following sections walk through the steps to set up a failover cluster solution.
30
30
31
31
## Roadmap
32
32
33
-
The steps to create an availability group on Linux servers for high availability are different from the steps on a Windows Server failover cluster. The following list describes the highlevel steps:
33
+
The steps to create an availability group on Linux servers for high availability are different from the steps on a Windows Server failover cluster. The following list describes the high-level steps:
34
34
35
35
1.[Configure SQL Server on the cluster nodes](sql-server-linux-setup.md).
>Due to a known issue that the clustering vendor is investigating, starting the cluster ('pcs cluster start') will fail with below error. This is because the log file configured in /etc/corosync/corosync.conf which is created when the cluster setup command is run, is wrong. To workaround this issue, change the log file to: /var/log/corosync/corosync.log. Alternatively you could create the /var/log/cluster/corosync.log file.
115
+
>Due to a known issue that the clustering vendor is investigating, starting the cluster ('pcs cluster start') will fail with below error. This is because the log file configured in /etc/corosync/corosync.conf which is created when the cluster setup command is run, is wrong. To work around this issue, change the log file to: /var/log/corosync/corosync.log. Alternatively you could create the /var/log/cluster/corosync.log file.
116
116
117
117
```Error
118
118
Job for corosync.service failed because the control process exited with error code.
@@ -138,7 +138,7 @@ Resource level fencing ensures mainly that there is no data corruption in case o
138
138
Node level fencing ensures that a node does not run any resources. This is done by resetting the node and the Pacemaker implementation of it is called STONITH (which stands for "shoot the other node in the head"). Pacemaker supports a great variety of fencing devices, e.g. an uninterruptible power supply or management interface cards for servers.
139
139
For more details, see [Pacemaker Clusters from Scratch](http://clusterlabs.org/doc/en-US/Pacemaker/1.1-plugin/html/Clusters_from_Scratch/ch05.html) and [Fencing and Stonith](http://clusterlabs.org/doc/crm_fencing.html)
140
140
141
-
Because the node level fencing configuration depends heavily on your environment, we will disable it for this tutorial (it can be configured at a later time). Run the following script on the primary node:
141
+
Because the node level fencing configuration depends heavily on your environment, we disable it for this tutorial (it can be configured at a later time). Run the following script on the primary node:
142
142
143
143
```bash
144
144
sudo pcs property set stonith-enabled=false
@@ -159,7 +159,7 @@ sudo pcs property set start-failure-is-fatal=false
159
159
160
160
161
161
>[!WARNING]
162
-
>After an automatic failover, when `start-failure-is-fatal = true` the resource manager will attempt to start the resource. If it fails on the first attempt you have to manually run `pcs resource cleanup <resourceName>` to cleanup the resource failure count and reset the configuration.
162
+
>After an automatic failover, when `start-failure-is-fatal = true` the resource manager attempts to start the resource. If it fails on the first attempt you have to manually run `pcs resource cleanup <resourceName>` to clean up the resource failure count and reset the configuration.
163
163
164
164
## Install SQL Server resource agent for integration with Pacemaker
0 commit comments