CF2023 Kerberos Authentication running on Windows IIS

There are a couple of non-obvious things going on here. First, by default, ColdFusion 2023 uses the Progress DataDirect for JDBC library for SQL Server, which is a third-party driver that's not exactly the same as Microsoft's own JDBC driver. I haven't checked the details that closely, but the connection string properties are different. You have a couple ways you could go here.

1. Change the connection string properties to work with the DataDirect JDBC driver
A sample is shown here:
https://docs.progress.com/bundle/datadirect-microsoft-sql-server-jdbc-60/page/Connection-URL-examples.html#Connection-URL-examples__kerberos

and looks like this:

jdbc:datadirect:sqlserver://myserver:1433;
DatabaseName=sqlserverDB;AuthenticationMethod=kerberos;
ServicePrincipalName=MSSQLSvc/myserver.example.com:1433@EXAMPLE.COM;

With CF you can edit your connection string directly although the default way to edit it is just to fill out the standard form. I think you'll need to edit it directly to add the service principal name. Note the AuthenticationMethod value is "kerberos", not "JavaKerberos" - I think the second one is specifically for Microsoft's own JDBC driver. You'll probably also want to read this for more information about the ServicePrincipalName (SPN) attribute:
https://docs.progress.com/bundle/datadirect-microsoft-sql-server-jdbc-60/page/Kerberos-authentication.html#Kerberos-authentication

My (vague) understanding is that it should match the CF user account. Pay close attention to step 5 in the second link, and read the links at the bottom of this page.

2. Switch to Microsoft's own JDBC driver.

Instructions for using external JDBC drivers can be found here:

https://helpx.adobe.com/coldfusion/configuring-administering/data-source-management-for-coldfusion.html

I think Microsoft's own JDBC driver is generally fine, though I'd be reluctant to flip the switch from DataDirect to Microsoft (or vice-versa) on a busy production environment.

Second, I'm not sure what your overall Kerberos environment looks like. Are you using Entra ID? Constrained delegation? It might be a little harder to use CF as a Kerberos client. You might want to examine exactly what's going on with your working .NET application. You can use the handy klist command line tool to find out what your local Kerberos tickets look like on the .NET application server.

Good luck with that, sincerely. I've looked into it more than once over the years and never could get it working. Maybe there's some simple step we're missing--which perhaps someone else here will enlighten us with. But I've never found any documentation of how to get it all going.

Of course half the battle is having sql server (and the infrastructure) setup for Kerberos. You've got that working, so maybe you're really close.

If no one here solves it, reach out to Adobe support at cfsup@adobe.com. Then I hope you'd fill us all in on the solution--and that they'd better document it. Others definitely want to get this working.