Azure: Kerberos Authentication for ScaleArc configured in Active-Passive mode using Azure Loadbalancer 

Release	Classification	Level	DB Platform	Categories
3.11+	Information		SQL Server	Kerberos

Prerequisites:

Make sure you have the following prerequisites to successfully configure Kerberos authentication for ScaleArc in an active-passive HA mode using Azure Load Balancer: 

• Two AMI instances launched with ScaleArc image
• AD/KDC, DNS, and SQL servers
• Azure instances setup in a single domain 
• AD, KDC, DNS (with reverse lookup) and NTP servers configured

Configuration can broadly split into the following steps:

1. Join the ScaleArc nodes to the AD domain as a Machine Account
2. Configure ScaleArc in Active-Passive HA
3. Configure ScaleArc for Kerberos
4. Set up ScaleArc Machine account for Delegations
5. Provide database access
6. Create a kerberized cluster in ScaleArc
7. Verify Kerberos Authentication Offload

The following section discusses each step in detail.

Step 1: Join the ScaleArc nodes to the AD domain as a Machine Account:
Join both the ScaleArc nodes to the Windows AD Domain as a Machine Account. Please refer this KB article for the necessary steps. 

Step 2: Configuring ScaleArc in Active-Passive HA

This KB article outlines the steps for configuring ScaleArc in Active-Passive configuration using Azure Load Balancer.

Step 3: Configuring ScaleArc for Kerberos: Set up Service Principal Name (SPN) for ScaleArc

1. SPN is a unique identifier for a service on a network that uses Kerberos authentication. It consists of a service class, a host name, and a port. To create an SPN, use the "SetSPN" command line utility.
2. From the power shell, set up the Service Principal Name for ScaleArc on AD:
3. Log into the Active Directory server as a user with domain administrator's privileges.
4. From the power shell, set the service principal name for ScaleArc on AD. Remember to specify the port correctly.
5. As we do not have VIPs in Azure, we will register the SPNs with "ALL IP" i.e the Hostname of the ScaleArc Primary Node.

    

   Setspn -A MSSQLSvc/<ScaleArc Hostname>.<domainname>:<port> <domain\ScaleArc hostname$> 
   
   Example
   C:\>setspn -A MSSQLSvc/scale-test.krbs.com:1433 krbs\scale-pri$
   Note: <port> is the port number on which the Cluster will be running.

6. If you wish to create an AlwaysON cluster in ScaleArc, Set the SPN of the AG Listener.
   
   Setspn -A MSSQLSvc/<AG LISTENER_Hostname>.<domainname>:<port><domain\domain admin user>
   Example
   C:\>setspn -A MSSQLSvc/aglsnr.krbs.com:1433 krbs\cls

7. Create a DNS entry with the Internal IP address of the Azure LB and its Hostname.

8. Set the SPN for the Azure LB:

   Setspn -A MSSQLSvc/<Azure LB Hostname>.<domainname>:<port> <domain\ScaleArc hostname$> 

   Example

   C:\>setspn -A MSSQLSvc/azurelb.krbs.com:1433 krbs\scale-pri$

Step 4: Set up ScaleArc Machine account for Delegations:

1. On the domain controller, access the Active Directory Users and Computers console.
2. In the console tree, under Domain name, click Computers. 
3. Right-click the ScaleArc server, and then click Properties.
4. On the Delegation tab, click Trust this computer for delegation to specified services only.
5. Click Use any authentication protocol.
   
   
   
   
6. Click Add, and then click Users and Computers.
   
   
   
   
7. Enter the domain user that has the necessary credentials to start and stop SQL services; then, Select All DB serverer entries with Instance name and with Port number and Click OK.
8. From the Delegation tab, click Add. Then, click Users or Computers and enter the machine account name of the ScaleArc primary machine (for example, scale-pri$). Click Check Names and OK.
   
   
   
   
9. Select the HOST and the MSSQLSvc service for the ScaleArc Primary node Hostname created earlier. Press the Control key to select multiple entries. Click OK.
10. The entries appear on the Delegation tab. Click Ok.
11. Now the ScaleArc is setup for Kerberos delegation.

Step 5: Provide database access

This is a two-step process:

• Set up SQL Server for authentication with the ScaleArc's machine account
• Configure database access

Grant access to ScaleArc's machine account: 

1. Follow these steps to grant minimum privileges to ScaleArc on SQL Server:
2. From the machine running SQL Server, log in to SQL Management studio. 
3. Connect to the server.
4. Log in.
5. Locate Security > Logins > New Login. Remember to add $ at the end of the login name.
   
   
   
   
6. Select the user. Right-click on properties.
7. Under the Explicit tab, select the following permissions.( View Any Definition, View Server status.)
   
   
   
   
8. Click OK.

Step 6: Create a kerberized cluster in ScaleArc.

You are now ready to create a Kerberized cluster in ScaleArc. Follow these steps to create a cluster:

1. On the ScaleArc dashboard, click the Clusters tab > Add Cluster button. 
2. Locate the Network section. This is the first panel on the Create Cluster screen.
   
   
   
   
3. Fill in the fields with valid information
4. Select the "All IPs" for the field labeled Cluster Virtual IP Address and Outbound Virtual IP Address.
5. Locate the Database Access section. This is the second panel on the Create Cluster screen.
   
   
   
   
6. Configure the fields as follows:
   
   

   Field/Button	Description	Default/User input
   Use Kerberos authentication for ScaleArc administration	Ensures that the entire cluster is running in a complete, Kerberos-authenticated mode. Note that when you select this option you do not need to enter username and password. Make sure you have set up minimum database privileges.   If you deselect this option, you need to provide a username and password for ScaleArc to establish and administrate database connection using NTLM. Click here to review ScaleArc settings for Kerberos.	This option is pre-selected if you have configured ScaleArc to join the domain as a machine account.
   Start Cluster After Setup	Determines if the cluster automatically goes live, following setup. A selected checkbox results in a live cluster at setup. When deselected, you need to start the cluster manually.	Default: Checkbox is pre-selected.  Select/Deselect checkbox.

7. Next, configure SSL (optional) and database servers for the cluster.

Step 7: Verify Kerberos Authentication Offload

A fully-Kerberized cluster has the Kerberized Authentication Offload button set to ON when ScaleArc joins AD as a machine account and the Database Access option for Kerberos is pre-selected. Click here to review ScaleArc settings for Kerberos.

1. Click Clusters > Status > Cluster Settings  in the ScaleArc dashboard.
   
   
   
   
2. Select the ScaleArc tab.
3. Locate the Kerberos Authentication Offload button. Note that it is ON.
   
   

Reference:

The following page in the administrator’s guide outlines the steps for configuring ScaleArc for Kerberos: Create a Kerberized cluster.

If you are experiencing issues with ScaleArc or with any of it's features, please contact ScaleArc Support. We are available 24x7 by phone at 855 800 7225 or +1 408 412 7315.

For general support inquiries, you can also e-mail us at support@scalearc.com.