SQL Server: Integrated (Kerberos) passes SPN in service@host form, which fails on Windows

[qrogi]

Bug Description

On Windows, Integrated (Kerberos) authentication for SQL Server fails with error 18452 ("Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication").

The SPN passed to the vendored kerberos module is MSSQLSvc@ — the GSSAPI-style form with @. On Windows the module goes through SSPI, which expects an SPN in service/host form and does not translate the @ separator. Negotiate finds no matching SPN, falls back to NTLM, and the server rejects the login.

Changing the separator to / makes the connection work immediately.

Initial token size confirms what happens in each case:

MSSQLSvc@ → 55 bytes (SPNEGO NegTokenInit with NTLMSSP Negotiate)
MSSQLSvc/ → 4198 bytes (Kerberos AP-REQ with PAC)

DataGrip and SSMS connect successfully to the same server from the same machine.

Repro steps

1. Domain-joined Windows client, SQL Server default instance on port 1433, SPN registered in AD.
2. Create a SQL Server connection using Integrated (Kerberos).
3. Test the connection.

Expected Behavior

Kerberos authentication succeeds.

Actual Behavior

No service ticket is requested, authentication silently falls back to NTLM, connection fails with error 18452.

Workaround

Build the SPN with / instead of @ on Windows.

Environment

• DBCode version: 1.38.0
• VS Code (or fork) version: 1.135.0
• OS: Windows 11
• Database: SQL Server 2025 (17.0.4075.5), default instance, TCP 1433
• Connection: SSL

Logs

If available, paste relevant logs from the Output panel (View > Output > DBCode).

[info] MSSQL: Using Integrated (Kerberos) authentication for <host>:1433
[debug] MSSQL: Creating Integrated authentication context for <host>:1433
[debug] Kerberos: created context for MSSQLSvc@<host> (initial token 55 bytes)
[error] Connection: '<name>' failed:  ConnectionError: Login failed. The login is from an untrusted domain and cannot be used with Integrated authentication.