Netwitness ODBC Authentication Settings

[Anonymous]

When trying to add a ODBC connection as an event source, I receive login failure events on the SQL server. 

Error: 18456, Severity: 14, State: 6

State: 6 = Attempt to use a Windows login name with SQL Authentication

The account I'm using is a windows account, however the Netwintess ODBC connector appears to default to SQL authentication over Windows authentication. Is there a way to force Windows authentication for ODBC connections? 

[DavidWaugh1]

No. it can only use a sql account as far as I know

Sent from my iPhone

[AlessioAlfonsi · Accepted solution]

Add in the DSN definition the following attributes:

  AuthenticationMethod=9

  Domain=YourDomain

The driver will append to the username the Domain (tested with version DataDirect ODBC v7.1).

[EricPartington]

have you tested this with RSA ODBC connections?

I tried adding those extra DSN parameters tot eh MSSQL interface and the s27.so driver and get an error

Test connection failed:Error! An error occurred creating an ODBC connection for DSN: ECATS27_Domain_NWE2 The trapped error is: Unable to create an ODBC connection. DSN: ECATS27_Domain_NWE2; username: nwe_odbc_domain; reason: state: 08S01; error-code: 0; description: [RSA][ODBC 20101 driver]7503state: 60; error-code: 18452; description: [RSA][ODBC 20101 driver][20101]Login failed. The login is from an untrusted domain and cannot be used with Windows authentication

doesnt look like the domain value from DSN is prepending to the username as you mentioned

[KEVINDIENST]

I would be very curious about if this has been tested before. We use SQL accounts as we're unaware if we can actually leverage AD credentials for access. We'd prefer using AD integrated auth for SQL and was under the impression there is no intent to add that to the supported ODBC connection methods in RSA NetWitness. 

[someone]

I would think that Kerberos would still have to be configured on the collector for domain authentication to work. If this is even supported by the progress driver or RSA. I think they are not.

[BohdanR]

It works, thanks! 🙂

[someone]

Interesting. Thanks for sharing Alessio and Bohnan for testing & confirming.