Do you have a comment or suggestion to improve SQL Server? We’d love to hear it!

SMO Server class spams AGs with failed blank user logins when used with SqlCredential

When using SMO with a SqlCredential it may hammer the target server with failed connections to a blank username. These can be found in the SQL ERRORLOG. Interestingly SMO still appears to work but this prevents SqlCredentials from being used in production because it would trigger hundreds of thousands of failed logins every day.

The problem is caused because somewhere in SMO it is not detecting the SqlCredential correctly.

This does not happen on standalone servers. It does happen on servers in an AG, even when the SQL principal has sysadmin, and even with the server is a primary.

I've written a Pester test to demonstrate this. In this case I use the ServerConnection constructor that takes a prepared SqlConnection. There is an alternate constructor that can take a SqlCredential but that is a security problem because it extracts the plain-text password and stores it in the ServerConnection object connection string for all to see.

3 votes
Sign in
Check!
(thinking…)
Reset
or sign in with
  • facebook
  • google
    Password icon
    Signed in as (Sign out)

    We’ll send you updates on this idea

    Cody Konior shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

    2 comments

    Sign in
    Check!
    (thinking…)
    Reset
    or sign in with
    • facebook
    • google
      Password icon
      Signed in as (Sign out)
      Submitting...
      • Cody Konior commented  ·   ·  Flag as inappropriate

        FYI I have gone back and been unable to reproduce the failed login problem using the test I built so I'm unsure if there was user error here like mixed mode not being enabled?

        However ConnectionContext does still leak passwords by extracting them from the SqlCredential and keeping them in plain text. So I'll leave the topic open.

      • Cody Konior commented  ·   ·  Flag as inappropriate

        Thanks so much for commenting with that. At least now I know I'm not going crazy and where I don't use SqlCredential I can show that explanation to justify why.

      Feedback and Knowledge Base