Configuring Archibus to Use Integrated Authentication with Microsoft SQL Server

Web Central ships with the Microsoft SQL Server JDBC Driver (mssql-jdbc-12.2.0.jre11.jar) under \WEB-INF\lib\ . This driver supports the use of Type 2 integrated authentication on Windows operating systems through the integratedSecurity connection string property. See: http://msdn.microsoft.com/en-us/library/ms378428.aspx

Configure Microsoft SQL Server

  1. Create a new SQL Server login with Windows Authentication for the <Domain\username> Windows user. This login should match the Windows OS user account, under which Web Central is running:

  2. Open Microsoft SQL Server Management Studio.

  3. In Object Explorer, select the \Security\Logins folder.

  4. Right-click on the \Logins folder and select New Login.

  5. In the Login – New window, under Select a Page, choose General, and enter the following:

    • Login Name: Enter the Windows account username for the user that you are adding. It will be in the form of <Domain\username>.

    • Select the Windows Authentication radio button.

    • Default Database: Choose the database you would like as the default for the user.

  6. Select the User Mapping page:

    • Place a check next to the database to which you will assign this user.

    • For each database selected, check the database roles you wish to assign to this user.

    • Click OK when completed.

  7. Change the objects ownership to “dbo”, negating the need to prefix references to objects in SQL scripts (the objects in this case are the database tables).

    Right-click on the database, select “Open a New Query” and run the following script:

    -- This script will change the tables and views owner. Created by Catalin Purice from ASC-Romania on 01-26-2011 -- To accomplish this you need to edit the @currentOwner to @newOwner values and run the script -- To run the procedure use this example: exec dbo.changeOwner @currentOwner='dbo', @newOwner='afm' DECLARE @currentOwner sysname DECLARE @newOwner sysname --Here initialize the current owner and the new owner SET @currentOwner = 'afm' SET @newOwner = 'dbo' --*************************************************** DECLARE @currentObject nvarchar(517) DECLARE @qualifiedObject nvarchar(517) DECLARE @i int DECLARE alterOwnerCursor CURSOR FOR SELECT [so].[name] FROM sysobjects so, sysusers su WHERE so.uid=su.uid AND su.name IN (@currentOwner) AND so.xtype IN ('U', 'V') ORDER BY so.name OPEN alterOwnerCursor SET @i = 0 FETCH NEXT FROM alterOwnerCursor INTO @currentObject WHILE @@FETCH_STATUS = 0 BEGIN SET @qualifiedObject = CAST(@currentOwner AS VARCHAR) + '.' + CAST(@currentObject AS VARCHAR) EXEC sp_changeobjectowner @qualifiedObject, @newOwner SET @i = @i + 1 FETCH NEXT FROM alterOwnerCursor INTO @currentObject END CLOSE alterOwnerCursor DEALLOCATE alterOwnerCursor IF @i = 0 BEGIN print 'No table or view owned by ' + CAST(@currentOwner AS VARCHAR) return END --The following grants needed privileges to user 'afm_secure' EXEC sp_addrolemember 'db_datareader','afm_secure' EXEC('GRANT UPDATE ON ' +@newOwner+ '.afm_users TO afm_secure')

Configure Web Central

  1. Copy the mssql-jdbc_auth-<version>-<arch>.dll file to the \jre\bin\ folder. See http://msdn.microsoft.com/en-us/library/ms378428.aspx for instructions on how to download the DLL.

  1. In afm-projects.xml , modify the value of project/databases/database/login integratedLogin attribute to "true".
  2. In afm-projects.xml , modify the value of project /databases/database/engine/jdbc url attributes to "jdbc:sqlserver://localhost:1433;databaseName=HQ;integratedSecurity=true" using the appropriate server, port and database name in place of localhost, 1433 and HQ respectively.