PAM Transparent Login configuration for Microsoft SQL Management Studio 18

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Post upgradint Microsoft SQL Management Studio to version 18, Transparent login to a remote SQL server, which used to work fine, is no longer able to complete correctly.

It may work some of the times, but most times it just stays with the GUI not showing any field completed. Running the debug tool may work for connections the first time, and then stop working, etc

Cause

The problem is likely with how SQL Management Studio is programmed. 

According to

https://theflyingmaverick.com/2019/04/29/sql-server-management-studio-ssms-18-0-now-generally-available/#:~:text=Support%20for%20SQL%20Server%202019,2%20or%20greater.

https://www.microsoft.com/en-us/sql-server/blog/2019/04/24/sql-server-management-studio-ssms-18-0-released-for-general-availability/ 

SMSS 18 is based upon VS 2017 Isolated Shell

SSMS 17.X relied strictly on the older Visual Studio 2015 Isolated Shell, the 18.X generation introduces a hard dependency rewrite moving to the modern VS 2017 baseline architecture.

This may have prevented the traditional Learning tool operation.

Microsoft has transitioned from traditional Win32 applications which expose Unique Windows handlers (HWD) for every discrete element (such a combo box) to Windows Presentation Foundation (WPF) in SMSS 18. Please see:

https://learn.microsoft.com/en-us/dotnet/desktop/wpf/advanced/walkthrough-hosting-wpf-content-in-win32

In traditional Win32 desktop software, every input field (like the Server Name text box) requests its own unique window handle (HWND) from the operating system, allowing automation tools to pinpoint structural ID trees.

However, in the new implementation, as documented by Microsoft's framework rules, a WPF container functions by hosting its entire visual layer as a unified vector canvas.

Because sub-elements inside the Connect to Server dialog box are rendered as dynamic vector objects under the VS 2017 Shell rather than discrete OS-level windows, they do not present standalone HWND targets to the operating system. This architectural shift prevents classic "Learning Mode" recorders from capturing fixed field structures

This dynamic nature is the reason why sometimes it works, and sometimes it does not. Because individual sub-elements inside the "Connect to Server" dialog do not present independent HWND targets to the operating system, automated recording utilities cannot consistently find or bind to separate fields on consecutive runs. This results in PAM being unable to locate the target inputs natively, leaving fields blank upon session launch.

Resolution

As a possible solution, use a TL script based on mouse clicks and keystrokes. The following Transparent Login script has been proven to work

<window id="">
  <send id="window" host="true"/>
  <send id="window" text="{TAB}"/>
  <send id="window" text="{TAB}"/>
  <send id="window" username="true"/>
  <send id="window" text="{TAB}"/>
  <send id="window" password="true"/>
  <send id="window" text="{TAB}"/>
  <send id="window" text="{TAB}"/>
  <send id="window" text="{TAB}"/>
  <send id="window" text="{ENTER}"/>
</window>

Additional Information

Please note the script may need some tuning based on each individual system it is installed on, as it is purely based on what is seen in the GUI (and hence so are tabs, enter and other actions)