SSPI sql 由于双跳失败、约束委派，远程 powershell 请求访问失败

Question

我们正在尝试运行从 serverA 到远程 serverB 的自动安装，它需要使用 windows 身份验证与 sql serverC 通信。

Invoke-Command -ComputerName serverB -ScriptBlock {

    $conn = new-object System.Data.SqlClient.SqlConnection 'Data Source=ServerC;Initial Catalog=master;Integrated Security=SSPI'
    try
    {
        $conn.open()
    } finally {
        $conn | Remove-SQLConnection
    }

} -Credential $cred

然而返回失败：

Exception calling "Open" with "0" argument(s): "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'."

我们使用以下方法解决了这个问题：

Invoke-Command -ComputerName serverB -ScriptBlock { Register-PSSessionConfiguration -Name Ipswitch -RunAsCredential $using:cred -Force  } -Credential $cred

但我们更愿意使用受约束的 kerberos 委派：

https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/ps-remoting-second-hop?view=powershell-6#resource-based-kerberos-constrained-delegation

我们尝试使用以下步骤执行 kerberos 委派：

##########################
#run on serverC
##########################
Add-WindowsFeature RSAT-AD-PowerShell

Import-Module ActiveDirectory


$serverB = Get-ADComputer serverB
$serverC = Get-ADComputer serverC

# Grant resource-based Kerberos constrained delegation
Set-ADComputer -Identity $serverC -PrincipalsAllowedToDelegateToAccount $serverB

# Check the value of the attribute directly
$x = Get-ADComputer -Identity $serverC -Properties msDS-AllowedToActOnBehalfOfOtherIdentity
$x.'msDS-AllowedToActOnBehalfOfOtherIdentity'.Access

# Check the value of the attribute indirectly
Get-ADComputer -Identity $serverC -Properties PrincipalsAllowedToDelegateToAccount

# purge kerberose cache
Invoke-Command -ComputerName $serverB.Name -Credential $cred -ScriptBlock {
    klist purge -li 0x3e7
}

完成后，这 2 个测试通过：

Invoke-Command -ComputerName serverB -ScriptBlock {

    Invoke-Command -ComputerName serverC -ScriptBlock {'hello world'} -Credential $using:cred
} -Credential $cred 


Invoke-Command -ComputerName serverB -ScriptBlock {

    Copy-Item '\serverC\c$\file'

} -Credential $cred

但是sql命令仍然失败，我们还没有找到解决方法。

我们在 github 上发现了同样的问题，看起来相同，但没有答案： https://github.com/PowerShell/PowerShell/issues/9331

Answer 1

务必使用 SetSPN –A MSSQLSvc/.:1433

为 SQL 服务帐户注册一个 SPN

SSPI sql 由于双跳失败、约束委派，远程 powershell 请求访问失败

SSPI sql access fails in remote powershell request due to double-hop failure, constrained delegation

sql-server

powershell

powershell-remoting

kerberos-delegation