[freetds] SQL Server 2005 and TDS version 8 -- is login always encapsulated in TLS (encrypted)?
Achim Grolms
achim at grolmsnet.de
Mon Sep 24 18:17:32 EDT 2007
On Monday 24 September 2007, Bob Hetzel wrote:
> To use kerberos you probably
> have to enable a property named "delegation" and you have to have it
> running in an active directory setup.
Hello Bob,
I do not understand why "delegation" is required.
As far as I know "delegation" means tranfer of TGT to a
remote host that uses this TGT for getting a Ticket for
another (third) host.
But in the scenario there is
- a SQL-client
- a Kerberos-enabled Server, (in this case the SQL 2005 Server)
- a KDC, in this case a AD-Domain-controller.
From theory's point of view the steps needed for authentication are
1. Client needs a TGT, user runs "kinit" to get one.
2. SQL-Client uses the TGT to get a Service-ticket for
SQL-Server
3. SQL client uses Service-ticket to authenticate to SQL-Server.
(by putting the GSSAPI-Token "somewhere" in the datastream.
"somewhere" is specified in the on-the-wire protocol the
SQL-client talks to the SQL-server.
BTW: this spec. is... available?)
Is my understanding of the question wrong?
Why "delegation"?
Can you explain this in more detail or point me to
the correct understanding what is going on in this case
of authentication?
Thank you,
Achim
More information about the FreeTDS
mailing list