# Anyone managed to connect to a SQL Server with AD credentials? **URL:** \ **Category:** Ignition\ **Tags:** ignition79\ **Created:** [October 31, 2022, 1:14pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871 "2022-10-31T13:14:36Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 1:14pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/1 "2022-10-31T13:14:36Z")
Basically the title. I have a SQL Server instance that Ignition currently connects to using a local SQL account. I'm being asked to see if we can instead use an Active Directory user account as the credential, someDomain\someUsername. Has anyone got this to work and if so how? I'm struggling to find anything on this. There are plans to upgrade this server from 7.9 to 8.1 shortly as well. If this is not possible in 7.9 but is possible in 8.1, that would also be helpful information to pass along and we can change our gnatt chart. ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [October 31, 2022, 1:19pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/2 "2022-10-31T13:19:18Z")
We use AD credentials in our connection on the gateway, is that what you're asking? It worked in both 7.9 and 8.1 ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 1:22pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/3 "2022-10-31T13:22:26Z")
Yes exactly. I see that if I have ignition log on as a my AD account I think I can use integratedSecurity, the issue is this particular server hosts both production and dev versions of the project and prod/dev db connection strings, each of which would be a different AD Account so I can't have Ignition as a server logon on as both users simultaneously. Were you able to do this strictly with the configurations on the db connection page? Or did you have to change what user the Ignition service logged in as? ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [October 31, 2022, 1:30pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/4 "2022-10-31T13:30:28Z")
We don't have a separate design gateway (We are not currently using Ignition for control but for data analysis so the occasional restart isn't an issue). So, it isn't exactly the same. We created an AD account that is specific to the Ignition Gateway (we called it IgnitionReportingService) and then on the SQL server gave that account the appropriate permissions. I see no reason why you couldn't create an account for each gateway, or even use the same account for both. As far as I know there is nothing that prevents a user from logging into SQL from multiple places. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 1:34pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/5 "2022-10-31T13:34:08Z")
Yes this isn't a real controls application either more so of a user input form. We too don't have separate gateways, it's one gateway with with both Prod and Dev versions of the Vision app and Prod/Dev db connection strings. > We created an AD account that is specific to the Ignition Gateway (we called it IgnitionReportingService) and then on the SQL server gave that account the appropriate permissions. This part their IT has already taken care of and I have the two usernames one for prod and one for dev to use. I might be overcomplicating things right now. I have the AD user credentials. What would I do to connect make a single db connection work with that? Was it just changing the username/password? Any other keyword arguments like integratedSecurity required? Do I have to change anything else? ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [October 31, 2022, 1:35pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/6 "2022-10-31T13:35:55Z")
You don’t want integrated security - that’s what makes it authenticate with the identity of the process running the connection. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 1:44pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/7 "2022-10-31T13:44:49Z")
Seems like I should may be using `Authentication=ActiveDirectoryIntegrated` is that right? But I get "Cannot use "Authentication=ActiveDirectoryIntegrated" with "User", "Username" or "Password" connection string keywords.) so I am not sure where I would provide those ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [October 31, 2022, 1:47pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/8 "2022-10-31T13:47:50Z")
I don't think that's right. It would either be `ActiveDirectoryPassword`, `SqlPassword`, or no explicit `Authentication` at all. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 1:57pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/9 "2022-10-31T13:57:46Z")
Did all you need was a username and password field? I can't seem to get this to work. ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [October 31, 2022, 2:04pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/10 "2022-10-31T14:04:38Z")
![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/d/3/d3d9829f12a9a51c1b63139af740b694f84c8838.png) Everything else is default. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 2:16pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/11 "2022-10-31T14:16:06Z")
And your ignition login is the default local user account still? You didn't have to put the name of the domain anywhere? Ugh I can't get this working still. Think its time to call IA. ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [October 31, 2022, 2:19pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/12 "2022-10-31T14:19:57Z")
> [@bkarabinchak.psi](#): > > And your ignition login is the default local user account still? I'm not sure what you mean by this. Login to the Gateway, Windows Login, or Ignition Service? > [@bkarabinchak.psi](#): > > You didn't have to put the name of the domain anywhere? No, we actually use the IP address of the server, however, I would expect a DNS name to also work (actually not sure why we aren't using a DNS name) It's worked for a long time so I haven't touched it. > [@bkarabinchak.psi](#): > > I can't get this working still Is the connection being refused from the SQL Server? Is the user set up with proper permissions there? ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 2:28pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/13 "2022-10-31T14:28:05Z")
> [@lrose](#): > > I'm not sure what you mean by this. Login to the Gateway, Windows Login, or Ignition Service? What the Ignition service logs on as when it starts up - ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/8/28713e683eb8f41390a350715594dca6d571c3ea.png) > No, we actually use the IP address of the server, however, I would expect a DNS name to also work (actually not sure why we aren't using a DNS name) It's worked for a long time so I haven't touched it. Yea we are using DNS here and I am able to login as a local SQL account just not AD. When I try with the username `domain/userName` it seems like it is SQL Server that is rejecting me - `Caused by: com.microsoft.sqlserver.jbdc.SQLServerEception: Login failed for user 'domain/userName'. ClientConnectionId:12345...`. When I try logging on with just the username without the domain I get the same exact error except in the error string but only shows the username which makes sense `Caused by: com.microsoft.sqlserver.jbdc.SQLServerEception: Login failed for user 'userName'. ClientConnectionId:12345...` I just pinged their IT team though to make sure they did setup that AD account they told me as a user on the SQL cluster. Perhaps it's nothing on my end. ---
**Author:** ![lrose](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/lrose/32/62724_2.png) [@lrose](https://forum.inductiveautomation.com/u/lrose)\ **Post date:** [October 31, 2022, 2:35pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/14 "2022-10-31T14:35:29Z")
> [@bkarabinchak.psi](#): > > What the Ignition service logs on as when it starts up - We're using the Local System Account > [@bkarabinchak.psi](#): > > When I try with the username `domain/userName` it seems like it is SQL Server that is rejecting me - `Caused by: com.microsoft.sqlserver.jbdc.SQLServerEception: Login failed for user 'domain/userName'. ClientConnectionId:12345...`. This looks to me like SQL is refusing the login, so I agree, probably not something on your end. ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 2:38pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/15 "2022-10-31T14:38:09Z")
The AD user is now the db owner of the db I am trying to connect to and still having issues so I am just going to call the professionals at this point. Thank you ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [October 31, 2022, 2:51pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/16 "2022-10-31T14:51:14Z")
I don't think user/password in the JDBC driver ever works with domain accounts, just database user accounts. Integrated security bypasses that with an extra DLL to apply the service user's credentials. (I don't ever do this. My clients set this up if they want it. I recommend against AD credentials in production.) ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 2:56pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/17 "2022-10-31T14:56:07Z")
So wait I can't use an active directory user account to connect to a db at all? ---
**Author:** ![pturmel](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/pturmel/32/3295_2.png) [@pturmel](https://forum.inductiveautomation.com/u/pturmel)\ **Post date:** [October 31, 2022, 2:58pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/18 "2022-10-31T14:58:02Z")
Yes, you can. But it does so directly based on the Service user, as long as you turn on integrated security, and have the correct MS DLLs alongside your JDBC jar. I don't think you can use arbitrary domain accounts. (I could be wrong. I try not to get to close to this stuff.) ---
**Author:** ![bkarabinchak.psi](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/bkarabinchak.psi/32/83567_2.png) [@bkarabinchak.psi](https://forum.inductiveautomation.com/u/bkarabinchak.psi)\ **Post date:** [October 31, 2022, 3:00pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/19 "2022-10-31T15:00:39Z")
Oh ok so this is what I was thinking before. So here ![image](https://us1.discourse-cdn.com/inductiveautomation/original/3X/2/8/28713e683eb8f41390a350715594dca6d571c3ea.png) I would tell Ignition to login as the AD account `domain/userName`, and then in my SQL Server connection I would use integratedSecurity to use the service logon account. Along with whatever DLL I need. ---
**Author:** ![Kevin.Herron](https://sea1.discourse-cdn.com/inductiveautomation/user_avatar/forum.inductiveautomation.com/kevin.herron/32/7259_2.png) [@Kevin.Herron](https://forum.inductiveautomation.com/u/Kevin.Herron)\ **Post date:** [October 31, 2022, 3:02pm UTC](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871/20 "2022-10-31T15:02:02Z")
Well, you would, but you said this approach won’t work because you’d need Ignition to log in simultaneously as two different users somehow… [Next page](https://forum.inductiveautomation.com/t/anyone-managed-to-connect-to-a-sql-server-with-ad-credentials/65871.md?page=2)