Relationships in MSDE - how do I do it?

Hi
I am using the Web Matrix Project to write a .NETapplication. I have set up a database using MSDE which Iaccessed through the Web Matrix Project to start with. I have nowfound the Web Data Administrator which I use to backup my database andhelp to transfer it to the Server where I hope to run this application(if I ever get it finished!).
I need to set up some relationships between database tables but cannotsee a way to do this. SQL Server Books on Line referes toEnterprise Manager which I believe ships with the full MS SQL Serverpackage (and costs a package). I am doing this on ashoe-string. Any ideas on how to do it?
Thanks in advance.
Mike
CREATE TABLE order_part
(order_nmbr int,
part_nmbr int
FOREIGN KEY REFERENCES part_sample(part_nmbr)
ON DELETE NO ACTION,
qty_ordered int)
GO

you could do an alter table if its already there|||Hi DeveloperMCDBA
I did not realise I could create a table using a StoredProcedure. It certainly takes me longer than just using theWebMatrix but I seem to be getting there. Many thanks for thehelp - much appreciated.
Mike

Relating Two DataSets

Hello,
I'm kind of new to reporting services and have gone thru a number of web
casts but no where did I come across this.
Say I have two datasets from two different database on servers.
I know a report can have multiple datasets but is there a way I can
associate the datasets.
For example - I have a dataset 'Master' (database -DB1 on Server S1)which
has a few columns and I have 'Child' (database DB2 on S2).
Master and Child have a common column Col1.
I want to use the Matrix or even List and be able to drill down to child
based on Master Col1 (also this will display other details)
Is there a way to relate Master and Child based on Col1 in the Report or
should this be done in the backed only'The way to do master-child relationships is with sub reports. I do this all
the time. A subreport can be with it's own table in your report or it can be
embedded in a list or a field of a table.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"Rashmi Jagadish" <RashmiJagadish@.discussions.microsoft.com> wrote in
message news:B5DE61A3-5A45-4810-B21A-4EB811C2C3EA@.microsoft.com...
> Hello,
> I'm kind of new to reporting services and have gone thru a number of web
> casts but no where did I come across this.
> Say I have two datasets from two different database on servers.
> I know a report can have multiple datasets but is there a way I can
> associate the datasets.
> For example - I have a dataset 'Master' (database -DB1 on Server S1)which
> has a few columns and I have 'Child' (database DB2 on S2).
> Master and Child have a common column Col1.
> I want to use the Matrix or even List and be able to drill down to child
> based on Master Col1 (also this will display other details)
> Is there a way to relate Master and Child based on Col1 in the Report or
> should this be done in the backed only'
>|||What you're describing is one of the common uses of subreports. If you'd
rather not use subreports, then you'd have to do the join on the back-end,
as you suggested.
Mike G.
"Rashmi Jagadish" <RashmiJagadish@.discussions.microsoft.com> wrote in
message news:B5DE61A3-5A45-4810-B21A-4EB811C2C3EA@.microsoft.com...
> Hello,
> I'm kind of new to reporting services and have gone thru a number of web
> casts but no where did I come across this.
> Say I have two datasets from two different database on servers.
> I know a report can have multiple datasets but is there a way I can
> associate the datasets.
> For example - I have a dataset 'Master' (database -DB1 on Server S1)which
> has a few columns and I have 'Child' (database DB2 on S2).
> Master and Child have a common column Col1.
> I want to use the Matrix or even List and be able to drill down to child
> based on Master Col1 (also this will display other details)
> Is there a way to relate Master and Child based on Col1 in the Report or
> should this be done in the backed only'
>|||Thank you both - any tutorial you can point me to?
"Mike G." wrote:
> What you're describing is one of the common uses of subreports. If you'd
> rather not use subreports, then you'd have to do the join on the back-end,
> as you suggested.
> Mike G.
>
> "Rashmi Jagadish" <RashmiJagadish@.discussions.microsoft.com> wrote in
> message news:B5DE61A3-5A45-4810-B21A-4EB811C2C3EA@.microsoft.com...
> > Hello,
> > I'm kind of new to reporting services and have gone thru a number of web
> > casts but no where did I come across this.
> >
> > Say I have two datasets from two different database on servers.
> > I know a report can have multiple datasets but is there a way I can
> > associate the datasets.
> > For example - I have a dataset 'Master' (database -DB1 on Server S1)which
> > has a few columns and I have 'Child' (database DB2 on S2).
> >
> > Master and Child have a common column Col1.
> > I want to use the Matrix or even List and be able to drill down to child
> > based on Master Col1 (also this will display other details)
> >
> > Is there a way to relate Master and Child based on Col1 in the Report or
> > should this be done in the backed only'
> >
> >
>
>|||BOL is usually a good place to start:
http://msdn2.microsoft.com/en-us/library/ms159837.aspx
Mike G.
"Rashmi Jagadish" <RashmiJagadish@.discussions.microsoft.com> wrote in
message news:F3483B62-1669-438D-AEF9-C8025F450507@.microsoft.com...
> Thank you both - any tutorial you can point me to?
> "Mike G." wrote:
>> What you're describing is one of the common uses of subreports. If you'd
>> rather not use subreports, then you'd have to do the join on the
>> back-end,
>> as you suggested.
>> Mike G.
>>
>> "Rashmi Jagadish" <RashmiJagadish@.discussions.microsoft.com> wrote in
>> message news:B5DE61A3-5A45-4810-B21A-4EB811C2C3EA@.microsoft.com...
>> > Hello,
>> > I'm kind of new to reporting services and have gone thru a number of
>> > web
>> > casts but no where did I come across this.
>> >
>> > Say I have two datasets from two different database on servers.
>> > I know a report can have multiple datasets but is there a way I can
>> > associate the datasets.
>> > For example - I have a dataset 'Master' (database -DB1 on Server
>> > S1)which
>> > has a few columns and I have 'Child' (database DB2 on S2).
>> >
>> > Master and Child have a common column Col1.
>> > I want to use the Matrix or even List and be able to drill down to
>> > child
>> > based on Master Col1 (also this will display other details)
>> >
>> > Is there a way to relate Master and Child based on Col1 in the Report
>> > or
>> > should this be done in the backed only'
>> >
>> >
>>|||Bruce,
I've seen you mention sub-reports several times as a solution to displaying
content from different data sources, or parent/child records. I wonder,
however, if you've ever found a different approach for a related situation.
A field in dataset1 may contain any of 6 status codes, and a table in
dataset2 has the status codes and an accompanying text description. Most of
the data we want to display is over in dataset1, but we'd like to display the
text for the code from dataset2. So while a Switch() would work if this
situation were limited to one field in one case, we find that all of the
customized preferences for this "off-the-shelf" system are stored in
dataset2. We'd like to find a way to regularly refer to the code/descripton
lists. SQL stored procedures are only a last resort for us. dataset1 comes
from IBM DB2 and dataset2 comes from an Access MDB.
Your thoughts are appreciated.
"Bruce L-C [MVP]" wrote:
> The way to do master-child relationships is with sub reports. I do this all
> the time. A subreport can be with it's own table in your report or it can be
> embedded in a list or a field of a table.
>
> --
> Bruce Loehle-Conger
> MVP SQL Server Reporting Services
>|||Sub reports work for this. I use it this way. Create a report (to be used as
a subreport) that has a query parameter with a matching report parameter for
status code. Have a single field returned. Shorten all parts of the report
to show only the field. Remove the header line, no footer etc. Indeed, if
you are sure that only a single record is returned your report could have a
single text field, base it on an expression, the expression is set to the
field of the dataset and uses the First aggregate (which is this case is the
first and only).
Now, add a empty cell to the table control. Drop the subreport into the
cell. Right mouse click and set the parameter mapping.
Another option is to do a drill through. For the field with the status code
set it to blue and underlined, then right mouse click, properties,
navigation and set it to do a jump to report and jump to a report that
specifies what the code means.
Bruce Loehle-Conger
MVP SQL Server Reporting Services
"Corvallis" <Corvallis@.discussions.microsoft.com> wrote in message
news:2209BB1C-E288-4B57-8723-7EE90DD81540@.microsoft.com...
> Bruce,
> I've seen you mention sub-reports several times as a solution to
> displaying
> content from different data sources, or parent/child records. I wonder,
> however, if you've ever found a different approach for a related
> situation.
> A field in dataset1 may contain any of 6 status codes, and a table in
> dataset2 has the status codes and an accompanying text description. Most
> of
> the data we want to display is over in dataset1, but we'd like to display
> the
> text for the code from dataset2. So while a Switch() would work if this
> situation were limited to one field in one case, we find that all of the
> customized preferences for this "off-the-shelf" system are stored in
> dataset2. We'd like to find a way to regularly refer to the
> code/descripton
> lists. SQL stored procedures are only a last resort for us. dataset1
> comes
> from IBM DB2 and dataset2 comes from an Access MDB.
> Your thoughts are appreciated.
> "Bruce L-C [MVP]" wrote:
>> The way to do master-child relationships is with sub reports. I do this
>> all
>> the time. A subreport can be with it's own table in your report or it can
>> be
>> embedded in a list or a field of a table.
>>
>> --
>> Bruce Loehle-Conger
>> MVP SQL Server Reporting Services

Regular intermittent Kerberos failures

Hi guys,
This is a last desperate call for help. About once a week, for between
2 and 10 minutes, users are unable to log in to our main web
application (ASP based). They get the following message:
'Failed to generate SSPI context'
Looking at the System Log on the web server displays the following
messages for the web site and SQL SPNs:
'The Security System detected an authentication error for the server
HTTP/<website name>. The failure code from authentication protocol
Kerberos was "The time at the Primary Domain Controller is different
than the time at the Backup Domain Controller or member server by too
large an amount.
(0xc0000133)".'
' The Security System detected an authentication error for the server
MSSQLSvc/S05010010.corp.dnsdom.net:1433. The failure code from
authentication protocol Kerberos was "The time at the Primary Domain
Controller is different than the time at the Backup Domain Controller
or member server by too large an amount.
(0xc0000133)".'
I have used net time to check the times on the Domain Controller, web
server and db server. Can't see any problems. Our system guys have
been through the 'Failed to generate SSPI context' knowledge base
articles.
I haven't seen anything referring to this as a regularly repeating
intermittent problem. We are getting worried cos there is always the
chance it won't come back up!
Any help very gratefully received.
Cheers,
JamesHi James
At a guess this could be a network failure, although if there is a pattern
to the times this occur it would point to something which is scheduled such
as AV or IDS software.
To eliminate the time difference being an issue you may want to try
syncronising both servers with an external time source and not rely on the AD.
John
"JimLad" wrote:
> Hi guys,
> This is a last desperate call for help. About once a week, for between
> 2 and 10 minutes, users are unable to log in to our main web
> application (ASP based). They get the following message:
> 'Failed to generate SSPI context'
> Looking at the System Log on the web server displays the following
> messages for the web site and SQL SPNs:
> 'The Security System detected an authentication error for the server
> HTTP/<website name>. The failure code from authentication protocol
> Kerberos was "The time at the Primary Domain Controller is different
> than the time at the Backup Domain Controller or member server by too
> large an amount.
> (0xc0000133)".'
> ' The Security System detected an authentication error for the server
> MSSQLSvc/S05010010.corp.dnsdom.net:1433. The failure code from
> authentication protocol Kerberos was "The time at the Primary Domain
> Controller is different than the time at the Backup Domain Controller
> or member server by too large an amount.
> (0xc0000133)".'
> I have used net time to check the times on the Domain Controller, web
> server and db server. Can't see any problems. Our system guys have
> been through the 'Failed to generate SSPI context' knowledge base
> articles.
> I haven't seen anything referring to this as a regularly repeating
> intermittent problem. We are getting worried cos there is always the
> chance it won't come back up!
> Any help very gratefully received.
> Cheers,
> James
>|||The messages you posted indicate an Active Directory configuration
problem rather than a SQL Server problem.
>From the information you've provided, its impossible to diagnose what
the problem is without knowing the architecture of your active
directory forest -- whether the HTTP server that logs into your SQL
Server is a member of the domain (which it sounds like it is), and
whether it goes thorough a firewall or any proxy servers that maybe
caching old records.
While Active Directory identifies clients connecting to servers,
Kerberos (which is a layer that runs ontop of active directory for
Microsoft platforms) also authenticates a server to the client. If
the servers are farmed, or there are many secondary domain
controllers, kerberos will check that they are all true mirrors of
each other to prevent somebody from setting up an unauthorized
secondary domain controller to spoof your forest (and thereby allow
unauthorized access via bogus active directory account entries on the
spoofed controller).|||On Aug 24, 5:43 pm, Andy <ane...@.infotek-consulting.com> wrote:
> The messages you posted indicate an Active Directory configuration
> problem rather than a SQL Server problem.
> >From the information you've provided, its impossible to diagnose what
> the problem is without knowing the architecture of your active
> directory forest -- whether the HTTP server that logs into your SQL
> Server is a member of the domain (which it sounds like it is), and
> whether it goes thorough a firewall or any proxy servers that maybe
> caching old records.
> While Active Directory identifies clients connecting to servers,
> Kerberos (which is a layer that runs ontop of active directory for
> Microsoft platforms) also authenticates a server to the client. If
> the servers are farmed, or there are many secondary domain
> controllers, kerberos will check that they are all true mirrors of
> each other to prevent somebody from setting up an unauthorized
> secondary domain controller to spoof your forest (and thereby allow
> unauthorized access via bogus active directory account entries on the
> spoofed controller).
Hi Andy,
Thanks for that. The messages indicate a timing problem: given that
Kerberos only requires servers to be within 5 minutes is this a case
of a misleading error message or is it that I am not using net time on
enough domain controllers? I also notice that the Kerberos group
policy "Maximum Tolerance for
Computer Clock Synchronization" is 'Not Defined'. Does this need to
be
defined or will it automatically use the default of 5 minutes?
Would turning on Kerberos event logging help to diagnose this? Would
turning it on on the web server be sufficient or would it need to be
enabled on dcs and db server as well? And would turning it on be a bad
idea on a production system?
More info: there is a single web server and a single db server, based
in London, no proxy or firewall between them. There are 4 domain
controllers in London. All of these are in the same domain. There are
other domain controllers at other locations in the same domain.
Any ideas on how to diagnose the problem would be extremely welcome.
Many thanks.
Cheers,
James|||On Aug 28, 10:01 am, JimLad <jamesdbi...@.yahoo.co.uk> wrote:
> On Aug 24, 5:43 pm, Andy <ane...@.infotek-consulting.com> wrote:
>
>
> > The messages you posted indicate an Active Directory configuration
> > problem rather than a SQL Server problem.
> > >From the information you've provided, its impossible to diagnose what
> > the problem is without knowing the architecture of your active
> > directory forest -- whether the HTTP server that logs into your SQL
> > Server is a member of the domain (which it sounds like it is), and
> > whether it goes thorough a firewall or any proxy servers that maybe
> > caching old records.
> > While Active Directory identifies clients connecting to servers,
> > Kerberos (which is a layer that runs ontop of active directory for
> > Microsoft platforms) also authenticates a server to the client. If
> > the servers are farmed, or there are many secondary domain
> > controllers, kerberos will check that they are all true mirrors of
> > each other to prevent somebody from setting up an unauthorized
> > secondary domain controller to spoof your forest (and thereby allow
> > unauthorized access via bogus active directory account entries on the
> > spoofed controller).
> Hi Andy,
> Thanks for that. The messages indicate a timing problem: given that
> Kerberos only requires servers to be within 5 minutes is this a case
> of a misleading error message or is it that I am not using net time on
> enough domain controllers? I also notice that the Kerberos group
> policy "Maximum Tolerance for
> Computer Clock Synchronization" is 'Not Defined'. Does this need to
> be
> defined or will it automatically use the default of 5 minutes?
> Would turning on Kerberos event logging help to diagnose this? Would
> turning it on on the web server be sufficient or would it need to be
> enabled on dcs and db server as well? And would turning it on be a bad
> idea on a production system?
> More info: there is a single web server and a single db server, based
> in London, no proxy or firewall between them. There are 4 domain
> controllers in London. All of these are in the same domain. There are
> other domain controllers at other locations in the same domain.
> Any ideas on how to diagnose the problem would be extremely welcome.
> Many thanks.
> Cheers,
> James- Hide quoted text -
> - Show quoted text -
Hi,
We turned on Kerberos tracing and in the 16 seconds that it didn't
work this week we got the following messages on the web server:
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 3
Date: 30/08/2007
Time: 17:01:38
User: N/A
Computer: S05010072
Description:
A Kerberos Error Message was received:
on logon session
Client Time:
Server Time: 16:1:39.0000 8/30/2007 Z
Error Code: 0xb KDC_ERR_NEVER_VALID
Extended Error: 0xc0000133 KLIN(0)
Client Realm:
Client Name:
Server Realm: CORP.DNSDOM.NET
Server Name: MSSQLSvc/S05010010.corp.dnsdom.net:1433
Target Name: MSSQLSvc/S05010010.corp.dnsdom.net:1433@.CORP.DNSDOM.NET
Error Text:
File: 9
Line: ae0
Error Data is in record data.
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 3
Date: 30/08/2007
Time: 17:01:47
User: N/A
Computer: S05010072
Description:
A Kerberos Error Message was received:
on logon session
Client Time:
Server Time: 16:1:49.0000 8/30/2007 Z
Error Code: 0xb KDC_ERR_NEVER_VALID
Extended Error: 0xc0000133 KLIN(0)
Client Realm:
Client Name:
Server Realm: CORP.DNSDOM.NET
Server Name: HTTP/<websitehostheader>
Target Name: HTTP/<websitehostheader>@.CORP.DNSDOM.NET
Error Text:
File: 9
Line: ae0
Error Data is in record data.
0xB - KDC_ERR_NEVER_VALID: Requested start time is later than end time
Associated internal Windows error codes
=B7None
Corresponding debug output messages
=B7DebugLog("Client asked for endtime before starttime\n")
Possible Cause and Resolution
=B7There is a time difference between the KDC and the client.
Resolution
For Kerberos authentication to work, you must synchronize clocks on
the client and on the server. For more information about this error
and how to resolve it, see Time Synchronization (Clock Skew) earlier
in this white paper.
Any ideas why we would get this error message once a week for a window
of between a few seconds and 10 minutes?
Is there any way of knowing where the KDC is? I assume it's one of the
domain controllers, but as we have several is there a way of knowing
which is being used?
We have also been getting non-fatal Kerberos messages (0x25
KRB_AP_ERR_SKEW) about the time on file server S20. This isn't a DC
and isn't involved in the authentication so I'm not sure why we are
getting this message, even though that server is indeed 6 minutes
fast.
Outside this time window we get lots of the following messages:
0x34 KRB_ERR_RESPONSE_TOO_BIG
0xd KDC_ERR_BADOPTION
0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
0x25 KRB_AP_ERR_SKEW
Cheers,
James|||Hi,
To answer some questions:
KDC runs on all Domain Controllers by default. You need to use a tool like
KerbTray or KList to see where the Kerberos tickets in question are coming
from
> We have also been getting non-fatal Kerberos messages (0x25
> KRB_AP_ERR_SKEW) about the time on file server S20. This isn't a DC
> and isn't involved in the authentication so I'm not sure why we are
> getting this message, even though that server is indeed 6 minutes
> fast.
Well, machines also authenticate to each other.
> 0x34 KRB_ERR_RESPONSE_TOO_BIG
Generally means that the packet was too big to be transmitted and was
fragmented. Should generally be OK, because Kerberos can be sent over TCP
rather than just UDP.
> 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
An SPN is missing from within your Active Directory
> 0x25 KRB_AP_ERR_SKEW
Time is out by more than the permitted deviation.
It looks like you have some time sync issues in your organisation. Are you
using the default Windows time sync heirachy (by default all DCs sync time
with the PDCe FSMO role holder, and all clients sync with their
authenticating DCs), or have you overriden this in some way?
Cheers
Ken
"JimLad" <jamesdbirch@.yahoo.co.uk> wrote in message
news:1188491704.797545.33500@.50g2000hsm.googlegroups.com...
On Aug 28, 10:01 am, JimLad <jamesdbi...@.yahoo.co.uk> wrote:
> On Aug 24, 5:43 pm, Andy <ane...@.infotek-consulting.com> wrote:
>
>
> > The messages you posted indicate an Active Directory configuration
> > problem rather than a SQL Server problem.
> > >From the information you've provided, its impossible to diagnose what
> > the problem is without knowing the architecture of your active
> > directory forest -- whether the HTTP server that logs into your SQL
> > Server is a member of the domain (which it sounds like it is), and
> > whether it goes thorough a firewall or any proxy servers that maybe
> > caching old records.
> > While Active Directory identifies clients connecting to servers,
> > Kerberos (which is a layer that runs ontop of active directory for
> > Microsoft platforms) also authenticates a server to the client. If
> > the servers are farmed, or there are many secondary domain
> > controllers, kerberos will check that they are all true mirrors of
> > each other to prevent somebody from setting up an unauthorized
> > secondary domain controller to spoof your forest (and thereby allow
> > unauthorized access via bogus active directory account entries on the
> > spoofed controller).
> Hi Andy,
> Thanks for that. The messages indicate a timing problem: given that
> Kerberos only requires servers to be within 5 minutes is this a case
> of a misleading error message or is it that I am not using net time on
> enough domain controllers? I also notice that the Kerberos group
> policy "Maximum Tolerance for
> Computer Clock Synchronization" is 'Not Defined'. Does this need to
> be
> defined or will it automatically use the default of 5 minutes?
> Would turning on Kerberos event logging help to diagnose this? Would
> turning it on on the web server be sufficient or would it need to be
> enabled on dcs and db server as well? And would turning it on be a bad
> idea on a production system?
> More info: there is a single web server and a single db server, based
> in London, no proxy or firewall between them. There are 4 domain
> controllers in London. All of these are in the same domain. There are
> other domain controllers at other locations in the same domain.
> Any ideas on how to diagnose the problem would be extremely welcome.
> Many thanks.
> Cheers,
> James- Hide quoted text -
> - Show quoted text -
Hi,
We turned on Kerberos tracing and in the 16 seconds that it didn't
work this week we got the following messages on the web server:
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 3
Date: 30/08/2007
Time: 17:01:38
User: N/A
Computer: S05010072
Description:
A Kerberos Error Message was received:
on logon session
Client Time:
Server Time: 16:1:39.0000 8/30/2007 Z
Error Code: 0xb KDC_ERR_NEVER_VALID
Extended Error: 0xc0000133 KLIN(0)
Client Realm:
Client Name:
Server Realm: CORP.DNSDOM.NET
Server Name: MSSQLSvc/S05010010.corp.dnsdom.net:1433
Target Name: MSSQLSvc/S05010010.corp.dnsdom.net:1433@.CORP.DNSDOM.NET
Error Text:
File: 9
Line: ae0
Error Data is in record data.
Event Type: Error
Event Source: Kerberos
Event Category: None
Event ID: 3
Date: 30/08/2007
Time: 17:01:47
User: N/A
Computer: S05010072
Description:
A Kerberos Error Message was received:
on logon session
Client Time:
Server Time: 16:1:49.0000 8/30/2007 Z
Error Code: 0xb KDC_ERR_NEVER_VALID
Extended Error: 0xc0000133 KLIN(0)
Client Realm:
Client Name:
Server Realm: CORP.DNSDOM.NET
Server Name: HTTP/<websitehostheader>
Target Name: HTTP/<websitehostheader>@.CORP.DNSDOM.NET
Error Text:
File: 9
Line: ae0
Error Data is in record data.
0xB - KDC_ERR_NEVER_VALID: Requested start time is later than end time
Associated internal Windows error codes
·None
Corresponding debug output messages
·DebugLog("Client asked for endtime before starttime\n")
Possible Cause and Resolution
·There is a time difference between the KDC and the client.
Resolution
For Kerberos authentication to work, you must synchronize clocks on
the client and on the server. For more information about this error
and how to resolve it, see Time Synchronization (Clock Skew) earlier
in this white paper.
Any ideas why we would get this error message once a week for a window
of between a few seconds and 10 minutes?
Is there any way of knowing where the KDC is? I assume it's one of the
domain controllers, but as we have several is there a way of knowing
which is being used?
We have also been getting non-fatal Kerberos messages (0x25
KRB_AP_ERR_SKEW) about the time on file server S20. This isn't a DC
and isn't involved in the authentication so I'm not sure why we are
getting this message, even though that server is indeed 6 minutes
fast.
Outside this time window we get lots of the following messages:
0x34 KRB_ERR_RESPONSE_TOO_BIG
0xd KDC_ERR_BADOPTION
0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
0x25 KRB_AP_ERR_SKEW
Cheers,
James|||On Sep 4, 6:50 am, "Ken Schaefer" <kenREM...@.THISadOpenStatic.com>
wrote:
> Hi,
> To answer some questions:
> KDC runs on all Domain Controllers by default. You need to use a tool like
> KerbTray or KList to see where the Kerberos tickets in question are coming
> from
> > We have also been getting non-fatal Kerberos messages (0x25
> > KRB_AP_ERR_SKEW) about the time on file server S20. This isn't a DC
> > and isn't involved in the authentication so I'm not sure why we are
> > getting this message, even though that server is indeed 6 minutes
> > fast.
> Well, machines also authenticate to each other.
> > 0x34 KRB_ERR_RESPONSE_TOO_BIG
> Generally means that the packet was too big to be transmitted and was
> fragmented. Should generally be OK, because Kerberos can be sent over TCP
> rather than just UDP.
> > 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
> An SPN is missing from within your Active Directory
> > 0x25 KRB_AP_ERR_SKEW
> Time is out by more than the permitted deviation.
> It looks like you have some time sync issues in your organisation. Are you
> using the default Windows time sync heirachy (by default all DCs sync time
> with the PDCe FSMO role holder, and all clients sync with their
> authenticating DCs), or have you overriden this in some way?
> Cheers
> Ken
> "JimLad" <jamesdbi...@.yahoo.co.uk> wrote in message
> news:1188491704.797545.33500@.50g2000hsm.googlegroups.com...
> On Aug 28, 10:01 am, JimLad <jamesdbi...@.yahoo.co.uk> wrote:
>
>
> > On Aug 24, 5:43 pm, Andy <ane...@.infotek-consulting.com> wrote:
> > > The messages you posted indicate an Active Directory configuration
> > > problem rather than a SQL Server problem.
> > > >From the information you've provided, its impossible to diagnose what
> > > the problem is without knowing the architecture of your active
> > > directory forest -- whether the HTTP server that logs into your SQL
> > > Server is a member of the domain (which it sounds like it is), and
> > > whether it goes thorough a firewall or any proxy servers that maybe
> > > caching old records.
> > > While Active Directory identifies clients connecting to servers,
> > > Kerberos (which is a layer that runs ontop of active directory for
> > > Microsoft platforms) also authenticates a server to the client. If
> > > the servers are farmed, or there are many secondary domain
> > > controllers, kerberos will check that they are all true mirrors of
> > > each other to prevent somebody from setting up an unauthorized
> > > secondary domain controller to spoof your forest (and thereby allow
> > > unauthorized access via bogus active directory account entries on the
> > > spoofed controller).
> > Hi Andy,
> > Thanks for that. The messages indicate a timing problem: given that
> > Kerberos only requires servers to be within 5 minutes is this a case
> > of a misleading error message or is it that I am not using net time on
> > enough domain controllers? I also notice that the Kerberos group
> > policy "Maximum Tolerance for
> > Computer Clock Synchronization" is 'Not Defined'. Does this need to
> > be
> > defined or will it automatically use the default of 5 minutes?
> > Would turning on Kerberos event logging help to diagnose this? Would
> > turning it on on the web server be sufficient or would it need to be
> > enabled on dcs and db server as well? And would turning it on be a bad
> > idea on a production system?
> > More info: there is a single web server and a single db server, based
> > in London, no proxy or firewall between them. There are 4 domain
> > controllers in London. All of these are in the same domain. There are
> > other domain controllers at other locations in the same domain.
> > Any ideas on how to diagnose the problem would be extremely welcome.
> > Many thanks.
> > Cheers,
> > James- Hide quoted text -
> > - Show quoted text -
> Hi,
> We turned on Kerberos tracing and in the 16 seconds that it didn't
> work this week we got the following messages on the web server:
> Event Type: Error
> Event Source: Kerberos
> Event Category: None
> Event ID: 3
> Date: 30/08/2007
> Time: 17:01:38
> User: N/A
> Computer: S05010072
> Description:
> A Kerberos Error Message was received:
> on logon session
> Client Time:
> Server Time: 16:1:39.0000 8/30/2007 Z
> Error Code: 0xb KDC_ERR_NEVER_VALID
> Extended Error: 0xc0000133 KLIN(0)
> Client Realm:
> Client Name:
> Server Realm: CORP.DNSDOM.NET
> Server Name: MSSQLSvc/S05010010.corp.dnsdom.net:1433
> Target Name: MSSQLSvc/S05010010.corp.dnsdom.net:1...@.CORP.DNSDOM.NET
> Error Text:
> File: 9
> Line: ae0
> Error Data is in record data.
> Event Type: Error
> Event Source: Kerberos
> Event Category: None
> Event ID: 3
> Date: 30/08/2007
> Time: 17:01:47
> User: N/A
> Computer: S05010072
> Description:
> A Kerberos Error Message was received:
> on logon session
> Client Time:
> Server Time: 16:1:49.0000 8/30/2007 Z
> Error Code: 0xb KDC_ERR_NEVER_VALID
> Extended Error: 0xc0000133 KLIN(0)
> Client Realm:
> Client Name:
> Server Realm: CORP.DNSDOM.NET
> Server Name: HTTP/<websitehostheader>
> Target Name: HTTP/<websitehostheader>@.CORP.DNSDOM.NET
> Error Text:
> File: 9
> Line: ae0
> Error Data is in record data.
> 0xB - KDC_ERR_NEVER_VALID: Requested start time is later than end time
> Associated internal Windows error codes
> =B7None
> Corresponding debug output messages
> =B7DebugLog("Client asked for endtime before starttime\n")
> Possible Cause and Resolution
> =B7There is a time difference between the KDC and the client.
> Resolution
> For Kerberos authentication to work, you must synchronize clocks on
> the client and on the server. For more information about this error
> and how to resolve it, see Time Synchronization (Clock Skew) earlier
> in this white paper.
> Any ideas why we would get this error message once a week for a window
> of between a few seconds and 10 minutes?
> Is there any way of knowing where the KDC is? I assume it's one of the
> domain controllers, but as we have several is there a way of knowing
> which is being used?
> We have also been getting non-fatal Kerberos messages (0x25
> KRB_AP_ERR_SKEW) about the time on file server S20. This isn't a DC
> and isn't involved in the authentication so I'm not sure why we are
> getting this message, even though that server is indeed 6 minutes
> fast.
> Outside this time window we get lots of the following messages:
> 0x34 KRB_ERR_RESPONSE_TOO_BIG
> 0xd KDC_ERR_BADOPTION
> 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
> 0x25 KRB_AP_ERR_SKEW
> Cheers,
> James- Hide quoted text -
> - Show quoted text -
Thanks Ken. Useful stuff.
I've posted a new subject based on a message I found in the security
log on the DC.
http://groups.google.com/group/comp.protocols.kerberos/browse_thread/thread=
/ce62e8b04e3cddad/5af3d0b03cee0927#5af3d0b03cee0927
Cheers,
James

Regular expression in SQL 2000

Hi All,
We are migrating a web application from oracle to SQL Server 2000.We have
used regular expression extensively in Oracle.
Is it possible to use Regular expressions in SQL 2000 queries'
GuhanCheck out the LIKE operator and the PATINDEX function. It isn't the full
regex syntax but basic wildcards and search patterns are supported.
David Portas
SQL Server MVP
--|||Can you give more details on what you are using. As David said in SQL 2K you
always have PATINDEX to help. Yet not complete in the capability. Just
wanted to add that in SQL Server 2005 you can use the capability of CLR to
perform regex work.
HTH,
Vinod Kumar
MCSE, DBA, MCAD, MCSD
http://www.extremeexperts.com
Books Online for SQL Server SP3 at
http://www.microsoft.com/sql/techin.../2000/books.asp
"Guhanath" <Guhanath@.discussions.microsoft.com> wrote in message
news:D2295C71-1483-4D89-B24C-5550FA00D7CE@.microsoft.com...
> Hi All,
> We are migrating a web application from oracle to SQL Server 2000.We
have
> used regular expression extensively in Oracle.
> Is it possible to use Regular expressions in SQL 2000 queries'
>
> --
> Guhan|||Have a look at
http://blogs.msdn.com/khen1234/arch.../11/416392.aspx
http://blogs.msdn.com/khen1234/arch.../19/420209.aspx
HTH
Jasper Smith (SQL Server MVP)
http://www.sqldbatips.com
I support PASS - the definitive, global
community for SQL Server professionals -
http://www.sqlpass.org
"Guhanath" <Guhanath@.discussions.microsoft.com> wrote in message
news:D2295C71-1483-4D89-B24C-5550FA00D7CE@.microsoft.com...
> Hi All,
> We are migrating a web application from oracle to SQL Server 2000.We
> have
> used regular expression extensively in Oracle.
> Is it possible to use Regular expressions in SQL 2000 queries'
>
> --
> Guhan

Registration of SQL with WEB Server

i need to know how can i register my SQL server with WEb based SQL server

i have the address MSSQL2.MINUTESUAE.COM now how can i register my SQL Server with them.

when i m going to conect with this server it register but after that Database not show it take to much time.

Hi,

If you are trying to connect a shared database supplied by a hosting firm, to see your database in your Enterprise Manager will take really so long time.

I can advise you to connect your database by using Query Analyzer not Enterprise Manager.

You will connect your database directly if you use Query Analyzer.

Eralper

http://www.kodyaz.com

Registering SQL Cache Dependency in web.config. Why elsewhere, too?

I have a sqlCacheDependency element registered in web.config that I figured would set the database up to deliver all notifications for all its tables:

<

sqlCacheDependencyenabled="true">

<

databases>

<

addname="MyDb"connectionStringName="MyDbConnnectionString"/>

</

databases>

</

sqlCacheDependency>

I've seen docs saying that's all I need to do with SQL Server 2005, but that doesn't appear to be the case. I get the error:

The database 'MyDB' is not enabled for SQL cache notification.

To enable a database for SQL cache notification, please use the System.Web.Caching.SqlCacheDependencyAdmin.EnableNotifications method, or the command line tool aspnet_regsql. To use the tool, please run 'aspnet_regsql.exe -?' for more information.

Are the docs I read wrong or am I missing something?

I beleive the sytax would be:

<

caching>

<

sqlCacheDependencyenabled ="true" >

<

databases>

<

addname="MyDb"connectionStringName="MyDbConnnectionString" />

</

databases>

</

sqlCacheDependency>

</

caching>

And then on your aspx page:

<asp:sqldatasourceid="Whatever"runat="server"connectionstring="<%$ ConnectionStrings:MyDbConnnectionString %>"datasourcemode="DataSet"enablecaching="true"CacheKeyDependency="MyDb"selectcommand="Whatever_SP"selectcommandtype="StoredProcedure">

|||

The web.config file is set up correctly, my problem is that I can't get notification services working. I have to resort to polling although I have SQL Server 2005.

To add more detail, I'm using Windows XP Pro and I programatically add the SqlCacheDependency:

SqlCacheDependency myDependency = new SqlCacheDependency( "MyDb", "MyTable" );

Cache.Insert( blah,
blah,
...
myDependency
... );

Everything executes correctly, but unless I use the SqlCacheDependencyAdmin or aspnet_regsql to set up polling, it throws the error displayed in my first post. If I have polling set up, the error goes away, but I'm not taking full advantage of the performance benefits of SQL Server 2005 notification services.

|||Anyone have any ideas on this? I'm perplexed!|||

I think most of what you need is covered in the links below because it maybe permissions related. Hope this helps.

http://msdn2.microsoft.com/en-us/library/system.web.caching.sqlcachedependencyadmin.aspx

http://msdn2.microsoft.com/en-us/library/xh507fc5.aspx

|||

I wondered if there might be some permission issues, though I haven't discovered what permissions may be required.

What's curious is that I'd expect the SqlCacheDependency to throw some permissions exception in such a case, however, and I wasn't seeing that.

I'll have to keep digging...

|||

Bump! I was hoping the issue would go away when I moved our SQL Server to a development server, but the problem persists.

My progress:

1. I discovered SQL Server can't run under the local machine account for Notification Services to work properly so I switched to Network Service... didn't help.

2. Apparently you need to manually create a Service Broker endpoint and enable the database to use it. Also didn't help...

3. I read a lot of people said they have to call SqlDependency.Start() to get it working... didn't help.

|||When pemissions related problem cannot be traced it usually means the service in this case the Notification service may be SQL Server Agent dependent which means the account that runs the Agent must have Admin permissions. The reason is even to run Replications the Agent needs network access and DTS automation, the list goes on. Hope this helps.|||Okay, the latest in the saga is that a Microsoft support rep is claiming the SQL Server 2005 lost the ability to integrate with SqlCacheDependency through anything other than polling in the release version. This seems fishy, since it contradicts their documentation and a lot of other resources, so I'll see if I can get to the bottom of it.|||As I suspected, query notification-based cache invalidation is alive and well in SQL Server 2005. I did a little digging and ended up finding a couple of issues:

1. You can't use the constructor I was using to set up notification-based dependencies (you need to pass in the SqlCommand).
2. You need to exclude the command SET NOCOUNT ON from your stored procedure.

See here:http://forums.asp.net/1353521/ShowThread.aspx#1353521 for more.