Vscode-sqltools: Cannot connect to SQL server using windows authentication.

Created on 23 Sep 2019  ·  3Comments  ·  Source: mtxr/vscode-sqltools

When attempting to connect to sql server using the following valid connection string as an example
"server=mydbserver;database=mydatabase;Integrated Security=true;"
sql tools report s the following error

Login failed for user ''.

To Reproduce
Steps to reproduce the behavior:

  1. Go to "Add New Connection"
  2. Click on 'MSSQL' icon
  3. Click on "Connection Method" and change to "Connection String"
  4. Click on "Connection String" textbox and enter a valid connection string similar to the example above.
  5. SQL Tools returns error Login failed for user ''.

Expected behavior
Connecting to SQL Server using integrated security should connect to the SQL server database using the current windows credentials.

Desktop (please complete the following information):

  • SQLTools Version [Latest version]
  • VSCode Version: 1.38.1
  • Dialect Used/Version: MS SQL
  • OS: [Windows]
triage

Most helpful comment

Using integrated security in the connection string allows an app to connect to a server without coding the actual credentials (username/password). Entering and saving in the configuration file the username and password reveals the domain authentication used to whomever looks at the connection settings.

I believe this provides a significant vulnerability in the security of the server having usernames and passwords exposed. Is it possible to either encrypt the password or avoid having the username/password from being entered when using integrated security?

All 3 comments

You need to add a User ID and password to the connection string:
server=mydbserver;database=mydatabase;Integrated Security=true;User ID=domain\username;Password=your_pass

Thanks @BobbyMcWho. Would you mind adding this to the docs as well?

Using integrated security in the connection string allows an app to connect to a server without coding the actual credentials (username/password). Entering and saving in the configuration file the username and password reveals the domain authentication used to whomever looks at the connection settings.

I believe this provides a significant vulnerability in the security of the server having usernames and passwords exposed. Is it possible to either encrypt the password or avoid having the username/password from being entered when using integrated security?

Was this page helpful?
0 / 5 - 0 ratings