[freetds] tds9 and gssapi
Achim Grolms
achim at grolmsnet.de
Thu Nov 1 11:29:53 EST 2007
On Wednesday 31 October 2007, Frediano Ziglio wrote:
> - I didn't understand how to generate a service/instance name instead of
> a principal one...
The remarks below reference to the GSSAPI as defined in RFC2744.
In GSSAPI the servicename is constructed by a call to
gss_import_name()
In GSSAPI the name that goes into this call is
of format servicename at hostnamefqdn.
For example using GSSAPI for authenticating to a POP3 server of name
"bla.example.com" means the string going into gss_import_name()
becomes
"pop at bla.example.com".
(registered servicenames are available at
<http://www.iana.org/assignments/gssapi-service-names>)
If your GSSAPI lib maps the request to the Kerberos5 layer
this results internally in a request to a Kerberosticket
of servicepricipal pop/bla.example.com at REALM,
But using the GSSAPI-Interface you don't become in touch
with dealing with Kerberos5 directly.
In other words here are the corresponding elements of names:
GSSAPI:
=======
servicename at hostnamefqdn
Kerberos5:
==========
servicename/hostnamefqd at REALM
The output of gss_import_name() is "output_name", a opaque
struture that can be used to pass into
gss_init_sec_context.
gss_init_sec_context returns the GSSAPI token ("output_token")
that has to be passed into the tls message stream at the right place.
How many times (of roundtrip) gss_init_sec_context has to be called
depends on the return value of gss_init_sec_contex.
(For example if the uses of "SPNEGO" Athentication triggers a Negotiation
of authentication type that means to the programmer looping over
gss_init_sec_context until the return values becomes "GSS_S_COMPLETE")
(The signal for "do the loop again" is "GSS_S_CONTINUE_NEEDED")
In pseudcode the structure ist this:
#include <gssapi.h>
gss_import_name(...);
major = gss_init_sec_context( &context_hdl,
emptyinputtoken,
outputtoken );
errorchecking( major );
put_token_into_tls_datastream( outputtoken );
send_tls_datastream();
read_tls_datastream();
while ( major == GSS_S_CONTINUE_NEEDED ) {
extract_servers_answertoken ( &serversidetoken );
major = gss_init_sec_context( &context_hdl,
serversidetoken,
outputtoken );
errorchecking( major );
put_token_into_tls_datastream( outputtoken );
send_tls_datastream();
read_tls_datastream();
}
/* authentication finished, go on using the authenticated connection */
Achim
More information about the FreeTDS
mailing list