Getting Started

Overview

This guide prepares the Britive Access Broker to manage JIT access to Microsoft SQL Server. The broker uses sqlcmd to create and drop temporary SQL Server logins. Scripts are available in both Bash (Linux broker) and PowerShell (Windows broker) variants.

Before You Begin

A running Britive Access Broker on a Linux or Windows host with network access to SQL Server (port 1433)
sqlcmd installed on the broker host
A SQL Server login with sufficient permissions to create logins, users, and roles
A broker pool token from Resource Manager → Broker Pools → New Pool in the Britive console

Step 1 — Install sqlcmd on the Broker Host

# Import Microsoft signing key and add repo
curl -fsSL https://packages.microsoft.com/keys/microsoft.asc | sudo gpg --dearmor -o /usr/share/keyrings/microsoft-prod.gpg
curl https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/prod.list | sudo tee /etc/apt/sources.list.d/mssql-release.list

sudo apt-get update
sudo ACCEPT_EULA=Y apt-get install -y mssql-tools18 unixodbc-dev

echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' >> ~/.bashrc
source ~/.bashrc

sqlcmd -? | head -1

curl https://packages.microsoft.com/config/rhel/9/prod.repo | sudo tee /etc/yum.repos.d/mssql-release.repo
sudo ACCEPT_EULA=Y dnf install -y mssql-tools18 unixODBC-devel

echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' >> ~/.bashrc
source ~/.bashrc

sqlcmd -? | head -1

Step 2 — Create the Broker Service Account in SQL Server

Connect to the SQL Server instance as sa or a sysadmin account and create a dedicated login for the broker:

-- Create the broker service login
CREATE LOGIN britive_svc WITH PASSWORD = 'StrongRandomPass!1';

-- Grant server-level permissions needed to manage logins and sessions
GRANT ALTER ANY LOGIN TO britive_svc;
GRANT VIEW SERVER STATE TO britive_svc;
GRANT ALTER ANY CONNECTION TO britive_svc;

For each database the broker will manage access to, create a corresponding user:

USE [YourDatabase];
CREATE USER britive_svc FOR LOGIN britive_svc;
ALTER ROLE db_owner ADD MEMBER britive_svc;

db_owner on the managed database is required so the broker can create users and assign roles. Use a strong, randomly generated password for the service login.

Step 3 — Register the SQL Server Instance as a Resource

Create a resource type

In the Britive console, go to Resource Manager → Resource Types → New Resource Type. Name it SQLServer.

Add parameters:

Parameter	Type	Required
`SERVER_NAME`	string	Yes
`DATABASE_NAME`	string	Yes

Register the resource

Go to Resource Manager → Resources → New Resource. Select SQLServer.

Set parameter values:

Parameter	Value
`SERVER_NAME`	SQL Server hostname or IP (e.g. `sql.internal` or `10.0.1.50`)
`DATABASE_NAME`	The target database name

Assign a broker pool

Under Broker Pools, select the pool whose broker can reach the SQL Server instance on port 1433.

Verify

Confirm the broker host can connect using the service account:

# Linux
sqlcmd -S sql.internal -U britive_svc -P 'StrongRandomPass!1' -Q "SELECT @@VERSION"

# Windows
sqlcmd -S sql.internal -U britive_svc -P 'StrongRandomPass!1' -Q "SELECT @@VERSION"

A successful response showing the SQL Server version confirms connectivity.

Troubleshoot

Symptom	Cause	Fix
`Login failed for user 'britive_svc'`	Wrong password or login disabled	Verify the login exists and is enabled: `SELECT name, is_disabled FROM sys.server_principals WHERE name = 'britive_svc'`
`TCP Provider: Connection refused`	Port 1433 blocked	Check Windows Firewall and security group rules; verify SQL Server is listening on TCP
`sqlcmd: command not found`	sqlcmd not in PATH	Add `/opt/mssql-tools18/bin` to `$PATH` on Linux
`Access denied` on `ALTER ANY LOGIN`	Service account lacks server permissions	Grant `ALTER ANY LOGIN`, `VIEW SERVER STATE`, and `ALTER ANY CONNECTION` to the service login

Last updated on May 6, 2026

Temporary DBA Access