Applications Systems

DPA repository user login will not connect as is from an untrusted domain

When you are changing the DPA repository from SQL Server authentication to Windows authentication, the login will not connect and is said to be from an untrusted domain. The SQL server error logs have errors such as: SSPI handshake failed with error code 0x80090302, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure.

First published date

11/9/2018 7:16 PM

Last published date

2/4/2026 12:14 AM

Overview

When you are changing the DPA repository from SQL Server authentication to Windows authentication, the login will not connect and is said to be from an untrusted domain.
 

Environment 

  • DPA 
  • SQL server repository 
  • Windows authentication 

Product section

Database Performance Analyzer

Cause

The SQL server requires the windows authentication account to use a lower level of authentication: NTLMv2 instead of Kerberos. When you see this issue on the web page, the SQL server error logs will usually have an error such as the following. These errors are not found in the DPA logs. 

 

<Timestamp> Logon       Error: 17806, Severity: 20, State: 14.
<Timestamp> Logon       SSPI handshake failed with error code 0x80090302, state 14 while establishing a connection with integrated security; the connection has been closed. Reason: AcceptSecurityContext failed. The Windows error code indicates the cause of failure.  [CLIENT: xxx.xxx.xxx.xxx]. 
<Timestamp> Logon       Error: 18452, Severity: 14, State: 1.
<Timestamp> Logon       Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. [CLIENT: xxx.xxx.xxx.xxx]

Resolution

This error is an issue with java driver connections to the monitoring sql server. We need to force the use of NTLMv2 in the connection. 

By default in versions of DPA 2021.3 and greater the default Jdbc driver is MS JDBC Driver. To set the repository connection to use NTLMv2

 

  1. Add the following to the repo.properties file:

    repo.jdbcDriverProperties= integratedSecurity\=true;useNTLMv2\=true

     

  2. Restart DPA.

It is possible that DPA is set to use the older jTDS driver. This can be done if the following property is set in system.properties 

com.confio.ignite.jdbc.sqlserver.useJtdsDriver=TRUE 

in this case the above string is incorrect and instead the needed setting would be repo.additionalProperties=useNTLMv2\=TRUE 

add this and restart DPA.