Freetds with mssql domain authentication error - login packet rejected

Question

I am using Freetds with unixODBC to connect to a remote SQL server instance from linux. The linux server has AD integration and I used my domain login to ssh into the server.

However the TDS (version 7.1) doesnt connect and fails with the error message

locale is "en_US.UTF-8"
locale charset is "UTF-8"
using default charset "UTF-8"
Error 20002 (severity 9):
        Adaptive Server connection failed
There was a problem connecting to the server

Setting the TDS Dump variable, I ran the command

tsql -H server.domain.local -p 52890

The non standard port is used since I am connecting to a named instance running on port other than 1433

Below is the debug log

net.c:1370:handshake succeeded!!
gssapi.c:215:kerberos name MSSQLSvc/<server Name>
login.c:466:login packet rejected
util.c:156:Changed query state from IDLE to DEAD
util.c:331:tdserror(0x2139160, 0x2139400, 20002, 0)
util.c:361:tdserror: client library returned TDS_INT_CANCEL(2)
util.c:384:tdserror: returning TDS_INT_CANCEL(2)

I am able to connect to another server which has a SQL Server authentication enabled so its not a problem with the ODBC connection itself. This particular server only has domain authentication enabled so I am not able to check if SQL server auth is working.

****EDIT********

Added the Kerberos trace using the KRB5_TRACE variable. Sorry for the long logfile

[21067] 1382697575.336792: ccselect module realm chose cache FILE:/tmp/krb5cc_1411389785 with client principal username@domain for server principal MSSQLSvc/servername.domain:52820@domain
[21067] 1382697575.337100: Retrieving username@domain -> krb5_ccache_conf_data/proxy_impersonator@X-CACHECONF: from FILE:/tmp/krb5cc_1411389785 with result: -1765328243/Matching credential not found
[21067] 1382697575.337153: Getting credentials username@domain -> MSSQLSvc/servername.domain:52820@domain using ccache FILE:/tmp/krb5cc_1411389785
[21067] 1382697575.337267: Retrieving username@domain -> MSSQLSvc/servername.domain:52820@domain from FILE:/tmp/krb5cc_1411389785 with result: -1765328243/Matching credential not found
[21067] 1382697575.337379: Retrieving username@domain -> krbtgt/domain@domain from FILE:/tmp/krb5cc_1411389785 with result: 0/Success
[21067] 1382697575.337394: Found cached TGT for service realm: username@domain -> krbtgt/domain@domain
[21067] 1382697575.337406: Requesting tickets for MSSQLSvc/servername.domain:52820@domain, referrals on
[21067] 1382697575.337472: Generated subkey for TGS request: rc4-hmac/2124
[21067] 1382697575.337488: etypes requested in TGS request: rc4-hmac
[21067] 1382697575.337844: Sending request (1455 bytes) to domain
[21067] 1382697575.341048: Resolving hostname onau-dc01.domain.
[21067] 1382697575.351850: Sending initial UDP request to dgram <dns_server_ip>:port
[21067] 1382697575.352702: Received answer from dgram <dns_server_ip>:port
[21067] 1382697575.353576: Response was not from master KDC
[21067] 1382697575.353616: TGS request result: -1765328377/Server not found in Kerberos database
[21067] 1382697575.353629: Requesting tickets for MSSQLSvc/servername.domain:52820@domain, referrals off
[21067] 1382697575.353667: Generated subkey for TGS request: rc4-hmac/3F66
[21067] 1382697575.353687: etypes requested in TGS request: rc4-hmac
[21067] 1382697575.353804: Sending request (1455 bytes) to domain
[21067] 1382697575.355027: Resolving hostname server.domain.
[21067] 1382697575.355854: Sending initial UDP request to dgram <dns_server_ip2>:88
[21067] 1382697575.358398: Received answer from dgram <dns_server_ip2>:88
[21067] 1382697575.359061: Response was not from master KDC
[21067] 1382697575.359094: TGS request result: -1765328377/Server not found in Kerberos database
Error 20002 (severity 9):
        Adaptive Server connection failed

Answer 1

Since you are using named instance, chances are that it wants to accept only tickets issued for the port-specific SPN (MSSQLSvc/<server name>:52890), so your client software should obtain a ticket to this principal. Also, this port-specific SPN should exist for the account under which your MSSQL server is running.

Looking at FreeTDS implementation, I can see that it automaticaly tries to select port-specific SPN if no 'server_spn' is set in the config for the connection.

I would suggest you to remove explicit server_spn setting in your freetds.conf for this connection.