[freetds] tds9 and gssapi
ZIGLIO, Frediano, VF-IT
Frediano.Ziglio at vodafone.com
Mon Nov 12 03:46:19 EST 2007
>
> On Friday 09 November 2007, you wrote:
>
> > > The resulting Kerberos5 service-ticket shown by kerbtray.exe
> > > has principalname of format
> > > 'cifs/fqdnhostname'. That would result in passing
> > > 'cifs at fqdnhostnam' to gss_import_name.
> > >
> > > I do not understand why to use 'MSSQLSvc' as a servicename?
> >
> > cifs is the file sharing service.
>
> Correct.
>
> > Are you sure you are connecting to sql
> > using kerberos?? It's not that easy to enable as it seems...
>
> You can easily prove me wrong:
>
> 1. use a Windowsclient and a MS-ODBC-driver to connect
> to the MS-SQL 2005 server using "integrated Authentication.
>
> 2. use kerbtray.exe to show the Tickets pulled into
> the Windows credentials cache.
>
> 3. Make a screenshot of kerbtray.exe showing the tickets
> an send it by mail.
>
klist (command line version of kerbtray) say
Server: MSSQLSvc/xxxxx.mydomain.it:1433 at MYDOMAIN.IT
KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
End Time: 11/12/2007 19:01:07
Renew Time: 11/19/2007 9:01:07
Have you set tcp/ip as protocol? Perhaps you are using named pipes
(which use cifs).
> > > add GSS_C_MUTUAL_FLAG to the flags of gss_init_security_context.
> >
> > I know but the problem is that mssql seems to not return
> any reply token
> > for kerberos...
>
> Hmmmm.
> No Token and no errorcode of failure?
>
I (and also ms odbc) send my token with mutual set but server just
accept ticket and do not reply with a kerberos ticket...
> > I think so... perhaps a pointer to a new structure that save
> > authentication type (ntlm/gssapi/whatever).
>
> Hmmm. A structure that saves a pointer to a callback that
> does the authentication-work?
>
>
Yes, something like this, currently (on my working directory)
@@ -1252,20 +1252,30 @@
};
enum TDS_ICONV_ENTRY
{
client2ucs2
, client2server_chardata
, iso2server_metadata
, initial_char_conv_count /* keep last */
};
+struct tds_authentication
+{
+ TDS_UCHAR *packet;
+ int packet_len;
+ int (*free)(TDSSOCKET * tds, struct tds_authentication * auth);
+ int (*get_next)(TDSSOCKET * tds, struct tds_authentication *
auth);
+};
+
+typedef struct tds_authentication TDSAUTHENTICATION;
+
/**
* Hold information for a server connection
*/
struct tds_socket
{
/* fixed and connect time */
/** tcp socket, INVALID_SOCKET if not connected */
TDS_SYS_SOCKET s;
TDS_SMALLINT major_version;
TDS_SMALLINT minor_version;
@@ -1334,20 +1344,21 @@
TDSCONNECTION *connection;
int spid;
TDS_UCHAR collation[5];
TDS_UCHAR tds9_transaction[8];
void (*env_chg_func) (TDSSOCKET * tds, int type, char *oldval,
char *newval);
int internal_sp_called;
void *tls_session;
void *tls_credentials;
+ TDSAUTHENTICATION *authentication;
int option_value;
};
int tds_init_write_buf(TDSSOCKET * tds);
void tds_free_result_info(TDSRESULTINFO * info);
void tds_free_socket(TDSSOCKET * tds);
void tds_free_connection(TDSCONNECTION * connection);
void tds_free_all_results(TDSSOCKET * tds);
void tds_free_results(TDSRESULTINFO * res_info);
void tds_free_param_results(TDSPARAMINFO * param_info);
> > Well... I know, the consideration is that our code try to
> use kerberos
> > only if domain authentication is used and if kerberos can't be
> > initialized ntlm is used so if kerberos fails (for instance
> cause there
> > is no spn) ntlm is used with provided password.
>
> NTLM as fallback?
> OK.
>
>
> Thank you,
> Achim
>
Yes but ntlm as fallback it's not so fine... perhaps the better way is:
- no user and no password?? try kerberos (if not fails)
- domain user?? use ntlm
- use normal login
freddy77
More information about the FreeTDS
mailing list