SQL Server Kerberos authentication fails on 57.2 when running queries: "No LoginModules configured for SQLJDBCDriver"

[AntonPysanka]

Describe the bug

After upgrading Metabase from version 56.14 to 57.2, queries to MS SQL Server databases using integrated authentication (Kerberos) fail with a login error. Rolling back to version 56.14 resolves the issue.
Query fails with error:
Kerberos Login failed: Integrated authentication failed. ClientConnectionId:[here goes the hashed ID of client connection] due to javax.security.auth.login.LoginException (No LoginModules configured for SQLJDBCDriver)

To Reproduce

1. Use Metabase 57.2
2. Find a question with a source DB on MS SQL Server
3. Choose required filters/parameters (if needed)
4. Try to tun a question
5. See the error
   Kerberos Login failed: Integrated authentication failed. ClientConnectionId:[here goes the hashed ID of client connection] due to javax.security.auth.login.LoginException (No LoginModules configured for SQLJDBCDriver)

Expected behavior

There shouldn't be an error with connection when there's domain authentication in MS SQL Server DB

Logs

796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:16+02:00 DEBUG metabase.server.middleware.log GET /api/timeline 200 404ms (6 DB calls) App DB connections: 1/8 Jetty threads: 5/50 (2 idle, 0 queued) (72 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id 13}
[796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:16+02:00 DEBUG metabase.server.middleware.log GET /api/card/1194 200 561ms (19 DB calls) App DB connections: 0/8 Jetty threads: 4/50 (3 idle, 0 queued) (72 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id 13}
[796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:16+02:00 DEBUG metabase.server.middleware.log GET /api/card/1194/query_metadata 200 141ms (22 DB calls) App DB connections: 0/8 Jetty threads: 4/50 (3 idle, 0 queued) (72 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id 13}
[796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:16+02:00 DEBUG metabase.server.middleware.log GET /api/user-key-value/namespace/user_acknowledgement/key/turn_into_model_modal 204 6ms (1 DB calls) App DB connections: 3/8 Jetty threads: 6/50 (1 idle, 0 queued) (72 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id 13}
[796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:17+02:00 DEBUG metabase.server.middleware.log GET /api/collection 200 95ms (4 DB calls) App DB connections: 1/8 Jetty threads: 5/50 (1 idle, 0 queued) (72 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id 13}
[796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:17+02:00 DEBUG metabase.server.middleware.log GET /api/native-query-snippet 200 103ms (1 DB calls) App DB connections: 1/8 Jetty threads: 5/50 (1 idle, 0 queued) (72 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id 13}
[796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:18+02:00 ERROR metabase.query-processor.middleware.catch-exceptions Error processing query: Kerberos Login failed: Integrated authentication failed. ClientConnectionId:684c516f-f64c-4b31-bb34-ada3dfb69162 due to javax.security.auth.login.LoginException (No LoginModules configured for SQLJDBCDriver)
{:database_id 52,
:parameterized false,
:started_at #t "2025-11-13T17:16:17.706511100+02:00[Europe/Kiev]",
:via
[{:status :failed,
:class com.microsoft.sqlserver.jdbc.SQLServerException,
:error
"Kerberos Login failed: Integrated authentication failed. ClientConnectionId:684c516f-f64c-4b31-bb34-ada3dfb69162 due to javax.security.auth.login.LoginException (No LoginModules configured for SQLJDBCDriver)",
:stacktrace
["com.microsoft.sqlserver.jdbc.KerbAuthentication.initAuthInit(KerbAuthentication.java:138)"
"com.microsoft.sqlserver.jdbc.KerbAuthentication.generateClientContext(KerbAuthentication.java:252)"
"com.microsoft.sqlserver.jdbc.SQLServerConnection.sendLogon(SQLServerConnection.java:7148)"
"com.microsoft.sqlserver.jdbc.SQLServerConnection.logon(SQLServerConnection.java:5921)"
"com.microsoft.sqlserver.jdbc.SQLServerConnection$LogonCommand.doExecute(SQLServerConnection.java:5853)"
"com.microsoft.sqlserver.jdbc.TDSCommand.execute(IOBuffer.java:7825)"
"com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(SQLServerConnection.java:4828)"
"com.microsoft.sqlserver.jdbc.SQLServerConnection.connectHelper(SQLServerConnection.java:4261)"
"com.microsoft.sqlserver.jdbc.SQLServerConnection.login(SQLServerConnection.java:3817)"
"com.microsoft.sqlserver.jdbc.SQLServerConnection.connectInternal(SQLServerConnection.java:3591)"
"com.microsoft.sqlserver.jdbc.SQLServerConnection.connect(SQLServerConnection.java:2286)"
"com.microsoft.sqlserver.jdbc.SQLServerDriver.connect(SQLServerDriver.java:1371)"
"--> plugins.jdbc_proxy$proxy_driver$reify__98687.connect(jdbc_proxy.clj:37)"
"connection_pool$proxy_data_source$reify__39872.getConnection(connection_pool.clj:29)"],
:state "08S01"}
{:status :failed,
:class com.mchange.v2.resourcepool.CannotAcquireResourceException,
:error "A ResourcePool could not acquire a resource from its primary factory or source.",
:stacktrace
["com.mchange.v2.resourcepool.BasicResourcePool.awaitAvailable(BasicResourcePool.java:1660)"
"com.mchange.v2.resourcepool.BasicResourcePool.prelimCheckoutResource(BasicResourcePool.java:710)"
"com.mchange.v2.resourcepool.BasicResourcePool.checkoutResource(BasicResourcePool.java:616)"
"com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutAndScacheMarkConnectionInUse(C3P0PooledConnectionPool.java:966)"
"com.mchange.v2.c3p0.impl.C3P0PooledConnectionPool.checkoutPooledConnection(C3P0PooledConnectionPool.java:894)"
"com.mchange.v2.c3p0.impl.AbstractPoolBackedDataSource.getConnection(AbstractPoolBackedDataSource.java:105)"
"--> driver.sql_jdbc.execute$do_with_resolved_connection$get_conn__94917.invoke(execute.clj:343)"
"driver.sql_jdbc.execute$do_with_resolved_connection.invokeStatic(execute.clj:346)"
"driver.sql_jdbc.execute$do_with_resolved_connection.invoke(execute.clj:327)"
"driver.sql_jdbc.execute$fn__94978.invokeStatic(execute.clj:416)"
"driver.sql_jdbc.execute$fn__94978.invoke(execute.clj:414)"
"driver.sql_jdbc.execute$execute_reducible_query.invokeStatic(execute.clj:760)"
"driver.sql_jdbc.execute$execute_reducible_query.invoke(execute.clj:749)"
"driver.sql_jdbc$fn__97875.invokeStatic(sql_jdbc.clj:87)"
"driver.sql_jdbc$fn__97875.invoke(sql_jdbc.clj:85)"
"query_processor.pipeline$STAR_execute_STAR.invokeStatic(pipeline.clj:59)"
"query_processor.pipeline$STAR_execute_STAR.invoke(pipeline.clj:44)"
"query_processor.pipeline$STAR_run_STAR.invokeStatic(pipeline.clj:119)"
"query_processor.pipeline$STAR_run_STAR.invoke(pipeline.clj:108)"
"query_processor.execute$run.invokeStatic(execute.clj:72)"
"query_processor.execute$run.invoke(execute.clj:62)"
"query_processor.middlew...
[796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:18+02:00 DEBUG metabase.server.middleware.log POST /api/card/1194/query 202 [ASYNC: completed] 1222ms (17 DB calls) App DB connections: 0/8 Jetty threads: 4/50 (1 idle, 0 queued) (81 total active threads) Queries in flight: 0 (0 queued); sqlserver DB 52 connections: 0/0 (0 threads blocked) {:metabase-user-id 13}
[796b8dbe-4247-4375-af40-ca7e6234c407] 2025-11-13T17:16:18+02:00 DEBUG metabase.server.middleware.log GET /api/database/52 200 12ms (1 DB calls) App DB connections: 0/8 Jetty threads: 4/50 (2 idle, 0 queued) (81 total active threads) Queries in flight: 0 (0 queued) {:metabase-user-id 13}

Information about your Metabase installation

{
  "browser-info": {
    "language": "en-US",
    "platform": "Win32",
    "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Edg/142.0.0.0",
    "vendor": "Google Inc."
  },
  "metabase-info": {
    "databases": [
      "postgres",
      "oracle",
      "duckdb",
      "mysql",
      "sqlserver"
    ],
    "run-mode": "prod",
    "plan-alias": "",
    "version": {
      "date": "2025-11-11",
      "tag": "v0.57.2.1",
      "hash": "f09aaf0"
    },
    "settings": {
      "report-timezone": null
    },
    "hosting-env": "unknown",
    "application-database": "postgres",
    "application-database-details": {
      "database": {
        "name": "PostgreSQL",
        "version": "17.4"
      },
      "jdbc-driver": {
        "name": "PostgreSQL JDBC Driver",
        "version": "42.7.7"
      }
    }
  },
  "system-info": {
    "file.encoding": "UTF-8",
    "java.runtime.name": "OpenJDK Runtime Environment",
    "java.runtime.version": "21.0.7+6-LTS",
    "java.vendor": "Eclipse Adoptium",
    "java.vendor.url": "https://adoptium.net/",
    "java.version": "21.0.7",
    "java.vm.name": "OpenJDK 64-Bit Server VM",
    "java.vm.version": "21.0.7+6-LTS",
    "os.name": "Windows Server 2022",
    "os.version": "10.0",
    "user.language": "uk",
    "user.timezone": "Europe/Kiev"
  }
}

Severity

With this bug we can't use about 90% of plain reports (quesions in Metabase)

Additional context

No response

[dpsutton]

@AntonPysanka thank you for the report! We're seeing this as a consequence in the sql server driver change.

Reference:

• Keycloak 26.4.0 - Microsoft SQL - Kerberos not working keycloak/keycloak#43368
• Driver should not override default JAAS configuration microsoft/mssql-jdbc#2586

I suspect this happened first in #61486.

On 57 we use version "13.2.0.jre11", and on 56 we use "12.10.0.jre11"

Here's a suggested workaround in the meantime:
keycloak/keycloak#43368 (comment)
You should be able to do this in metabase by adding the following to the connection string you use:

[AntonPysanka]

@dpsutton this really helped, thanks a lot!

[dpsutton]

@AntonPysanka thank you for letting us know the workaround worked for you. We'll watch the underlying issue in the driver and update as soon as a fix is out.