[freetds] tds9 and gssapi
ZIGLIO, Frediano, VF-IT
Frediano.Ziglio at vodafone.com
Thu Nov 8 09:55:58 EST 2007
> -----Original Message-----
> From: ZIGLIO, Frediano, VF-IT
> Sent: giovedì 8 novembre 2007 15.50
> To: ZIGLIO, Frediano, VF-IT
> Subject: FW: [freetds] tds9 and gssapi
>
>
>
>
> ________________________________
>
> From: Achim Grolms [mailto:achim at grolmsnet.de]
> Sent: mercoledì 7 novembre 2007 22.07
> To: ZIGLIO, Frediano, VF-IT
> Cc: freetds at lists.ibiblio.org
> Subject: Re: [freetds] tds9 and gssapi
>
>
> On Tuesday 06 November 2007, you wrote:
>
> > > The output of gss_import_name() is "output_name", a opaque
> > > struture that can be used to pass into
> >
> > I just realized that I can use getdomainname in order to
> translate from
> > hostname to full qualified hostname...
>
> But why to do so?
> passing GSS_NT_HOSTBASED_SERVIVE
> to gss_import_name() makes the GSSAPI do this work
> internally.
>
Yes but it do not support spn like MSSQLSvc/fqdnhostname:port at DOMAIN which is required by mssql...
>
> > Currently I support only a single round-trip, server seems
> to agree but
> > it's not that fine...
>
> What's the problem in detail?
> Are there any major/minor statuscodes that should be
> reported by gss_display_status()?
>
Is that is a bit complicated to write code.... I should send to mssql some token that require a reply but I don't know how...
> > Mmmm... a bit more complicated cause these tokens are nested to sql
> > packets...
>
> Sure :-D
> Initiallly I wrote that the main problem is to know
> where to put the GSSAPI-Tokens...
>
The idea is to save the state in TDSSOCKET if CONTINUE_NEEDED is returned and handle when server reply.
> >currently NTLMSSP (without SPNEGO) is the only handled
> > authentication after login...
>
> Hmmmm.
> Is it sure that the server really suppert Kerberos5 login?
> How can that be answered to be really sure what works
> and what does not work?
>
Well... if I use a wrong password and client login correctly with my login it should work. Also adding that I send a kerberos token and server agree seems ok, I hope mssql do not authenticate with an invalid kerberos token...
> I know, I have promised to to some "reverse engineering"
> myself.
> But I am too busy at the moment...
> I am sorry for beeing less helpful.
>
> Thank you very much for doing that work!
> Achim
>
All your comments has been very helpful, thanks
Frediano
More information about the FreeTDS
mailing list