Passing 'Windows Authentication' through REST API?
I have access to a SQL Server DB system that only allowed "Windows Authentication" - that is, use your windows login credential to access the data. (Not using a username-password). It also controls database permissions.
I want to build a REST API for users not familiar with SQL to get data from that server. The problem is, I need to take user's credential to execute the command, not the machine that hosts the REST API. How could I design the system that allow user to pass their login and let the API send query to the server using that specific login?
I found a reference from Microsoft, not sure if it's relevant.
https://docs.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode?view=sql-server-2017
sql-server rest edited Nov 15 '18 at 19:48
jarlh
29.7k52138
asked Nov 15 '18 at 18:50
MTANGMTANG
1429
add a comment |
I have access to a SQL Server DB system that only allowed "Windows Authentication" - that is, use your windows login credential to access the data. (Not using a username-password). It also controls database permissions.
I want to build a REST API for users not familiar with SQL to get data from that server. The problem is, I need to take user's credential to execute the command, not the machine that hosts the REST API. How could I design the system that allow user to pass their login and let the API send query to the server using that specific login?
I found a reference from Microsoft, not sure if it's relevant.
https://docs.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode?view=sql-server-2017
sql-server rest edited Nov 15 '18 at 19:48
jarlh
29.7k52138
asked Nov 15 '18 at 18:50
MTANGMTANG
1429
1
Mechanism that allows this is called Kerberos delegation. And no, SQL Server is just a data source in this scenario, you wouldn't have to introduce any changes into its configuration (apart from granting permissions to corresponding AD users, that is).
– Roger Wolf
Nov 16 '18 at 0:31
Hi @RogerWolf. Thanks for your suggestion. Could you please give me a brief framework/guideline how I could achieve this?
– MTANG
Nov 16 '18 at 14:37
add a comment |
I have access to a SQL Server DB system that only allowed "Windows Authentication" - that is, use your windows login credential to access the data. (Not using a username-password). It also controls database permissions.
I want to build a REST API for users not familiar with SQL to get data from that server. The problem is, I need to take user's credential to execute the command, not the machine that hosts the REST API. How could I design the system that allow user to pass their login and let the API send query to the server using that specific login?
I found a reference from Microsoft, not sure if it's relevant.
https://docs.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode?view=sql-server-2017
sql-server rest edited Nov 15 '18 at 19:48
jarlh
29.7k52138
asked Nov 15 '18 at 18:50
MTANGMTANG
1429
I have access to a SQL Server DB system that only allowed "Windows Authentication" - that is, use your windows login credential to access the data. (Not using a username-password). It also controls database permissions.
I want to build a REST API for users not familiar with SQL to get data from that server. The problem is, I need to take user's credential to execute the command, not the machine that hosts the REST API. How could I design the system that allow user to pass their login and let the API send query to the server using that specific login?
I found a reference from Microsoft, not sure if it's relevant.
https://docs.microsoft.com/en-us/sql/relational-databases/security/choose-an-authentication-mode?view=sql-server-2017
sql-server rest sql-server rest edited Nov 15 '18 at 19:48
jarlh
29.7k52138
asked Nov 15 '18 at 18:50
MTANGMTANG
1429
edited Nov 15 '18 at 19:48
jarlh
29.7k52138
asked Nov 15 '18 at 18:50
MTANGMTANG
1429
edited Nov 15 '18 at 19:48
jarlh
29.7k52138
edited Nov 15 '18 at 19:48
jarlh
29.7k52138
edited Nov 15 '18 at 19:48
jarlh
29.7k52138
29.7k52138
asked Nov 15 '18 at 18:50
MTANGMTANG
1429
asked Nov 15 '18 at 18:50
MTANGMTANG
1429
asked Nov 15 '18 at 18:50
MTANGMTANG
1429
1429
1
Mechanism that allows this is called Kerberos delegation. And no, SQL Server is just a data source in this scenario, you wouldn't have to introduce any changes into its configuration (apart from granting permissions to corresponding AD users, that is).
– Roger Wolf
Nov 16 '18 at 0:31
Hi @RogerWolf. Thanks for your suggestion. Could you please give me a brief framework/guideline how I could achieve this?
– MTANG
Nov 16 '18 at 14:37
add a comment |
1
Mechanism that allows this is called Kerberos delegation. And no, SQL Server is just a data source in this scenario, you wouldn't have to introduce any changes into its configuration (apart from granting permissions to corresponding AD users, that is).
– Roger Wolf
Nov 16 '18 at 0:31
Hi @RogerWolf. Thanks for your suggestion. Could you please give me a brief framework/guideline how I could achieve this?
– MTANG
Nov 16 '18 at 14:37
1
1
Mechanism that allows this is called Kerberos delegation. And no, SQL Server is just a data source in this scenario, you wouldn't have to introduce any changes into its configuration (apart from granting permissions to corresponding AD users, that is).
– Roger Wolf
Nov 16 '18 at 0:31
Mechanism that allows this is called Kerberos delegation. And no, SQL Server is just a data source in this scenario, you wouldn't have to introduce any changes into its configuration (apart from granting permissions to corresponding AD users, that is).
– Roger Wolf
Nov 16 '18 at 0:31
Hi @RogerWolf. Thanks for your suggestion. Could you please give me a brief framework/guideline how I could achieve this?
– MTANG
Nov 16 '18 at 14:37
Hi @RogerWolf. Thanks for your suggestion. Could you please give me a brief framework/guideline how I could achieve this?
– MTANG
Nov 16 '18 at 14:37
add a comment |
1 Answer
1
active
oldest
votes
What you are after is Kerberos delegation, sometimes also known as "double hop". It is not something you have to explicitly implement in your code, as long as you stick with the Microsoft stack; rather, it is a matter of configuration.
This post describes the setup required for the feature to work in sufficient details. You can also find some basic requirements in this help article. For anything beyond that, just google it.
answered Nov 17 '18 at 7:53
Roger WolfRoger Wolf
4,4361918
I'm using Python (django) + SQL Server on Windows machine. Do you think it's easy or need some careful configuration? Thanks.
– MTANG
Nov 21 '18 at 14:27
@MTANG, there might be some additional things you need to do / add in your code, not sure which ones though - I'm not really a web dev.
– Roger Wolf
Nov 22 '18 at 0:19
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53326117%2fpassing-windows-authentication-through-rest-api%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
What you are after is Kerberos delegation, sometimes also known as "double hop". It is not something you have to explicitly implement in your code, as long as you stick with the Microsoft stack; rather, it is a matter of configuration.
This post describes the setup required for the feature to work in sufficient details. You can also find some basic requirements in this help article. For anything beyond that, just google it.
answered Nov 17 '18 at 7:53
Roger WolfRoger Wolf
4,4361918
I'm using Python (django) + SQL Server on Windows machine. Do you think it's easy or need some careful configuration? Thanks.
– MTANG
Nov 21 '18 at 14:27
@MTANG, there might be some additional things you need to do / add in your code, not sure which ones though - I'm not really a web dev.
– Roger Wolf
Nov 22 '18 at 0:19
add a comment |
What you are after is Kerberos delegation, sometimes also known as "double hop". It is not something you have to explicitly implement in your code, as long as you stick with the Microsoft stack; rather, it is a matter of configuration.
This post describes the setup required for the feature to work in sufficient details. You can also find some basic requirements in this help article. For anything beyond that, just google it.
answered Nov 17 '18 at 7:53
Roger WolfRoger Wolf
4,4361918
I'm using Python (django) + SQL Server on Windows machine. Do you think it's easy or need some careful configuration? Thanks.
– MTANG
Nov 21 '18 at 14:27
@MTANG, there might be some additional things you need to do / add in your code, not sure which ones though - I'm not really a web dev.
– Roger Wolf
Nov 22 '18 at 0:19
add a comment |
What you are after is Kerberos delegation, sometimes also known as "double hop". It is not something you have to explicitly implement in your code, as long as you stick with the Microsoft stack; rather, it is a matter of configuration.
This post describes the setup required for the feature to work in sufficient details. You can also find some basic requirements in this help article. For anything beyond that, just google it.
answered Nov 17 '18 at 7:53
Roger WolfRoger Wolf
4,4361918
What you are after is Kerberos delegation, sometimes also known as "double hop". It is not something you have to explicitly implement in your code, as long as you stick with the Microsoft stack; rather, it is a matter of configuration.
This post describes the setup required for the feature to work in sufficient details. You can also find some basic requirements in this help article. For anything beyond that, just google it.
answered Nov 17 '18 at 7:53
Roger WolfRoger Wolf
4,4361918
answered Nov 17 '18 at 7:53
Roger WolfRoger Wolf
4,4361918
answered Nov 17 '18 at 7:53
Roger WolfRoger Wolf
4,4361918
answered Nov 17 '18 at 7:53
Roger WolfRoger Wolf
4,4361918
4,4361918
I'm using Python (django) + SQL Server on Windows machine. Do you think it's easy or need some careful configuration? Thanks.
– MTANG
Nov 21 '18 at 14:27
@MTANG, there might be some additional things you need to do / add in your code, not sure which ones though - I'm not really a web dev.
– Roger Wolf
Nov 22 '18 at 0:19
add a comment |
I'm using Python (django) + SQL Server on Windows machine. Do you think it's easy or need some careful configuration? Thanks.
– MTANG
Nov 21 '18 at 14:27
@MTANG, there might be some additional things you need to do / add in your code, not sure which ones though - I'm not really a web dev.
– Roger Wolf
Nov 22 '18 at 0:19
I'm using Python (django) + SQL Server on Windows machine. Do you think it's easy or need some careful configuration? Thanks.
– MTANG
Nov 21 '18 at 14:27
I'm using Python (django) + SQL Server on Windows machine. Do you think it's easy or need some careful configuration? Thanks.
– MTANG
Nov 21 '18 at 14:27
@MTANG, there might be some additional things you need to do / add in your code, not sure which ones though - I'm not really a web dev.
– Roger Wolf
Nov 22 '18 at 0:19
@MTANG, there might be some additional things you need to do / add in your code, not sure which ones though - I'm not really a web dev.
– Roger Wolf
Nov 22 '18 at 0:19
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53326117%2fpassing-windows-authentication-through-rest-api%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Mechanism that allows this is called Kerberos delegation. And no, SQL Server is just a data source in this scenario, you wouldn't have to introduce any changes into its configuration (apart from granting permissions to corresponding AD users, that is).
– Roger Wolf
Nov 16 '18 at 0:31
Hi @RogerWolf. Thanks for your suggestion. Could you please give me a brief framework/guideline how I could achieve this?
– MTANG
Nov 16 '18 at 14:37