[freetds] tds9 and gssapi
Achim Grolms
achim at grolmsnet.de
Tue Nov 13 17:02:40 EST 2007
On Monday 12 November 2007, you wrote:
> Yes but ntlm as fallback it's not so fine... perhaps the better way is:
>
> - no user and no password?? try kerberos (if not fails)
> - domain user?? use ntlm
> - use normal login
Hmm.
On Samba the commandlinetool "smbclient" ships with different modes
of authentication:
smbclient -k
directly uses the Kerberosmachanism.
And fails with "Not build with Kerberos5 support" if the tool
was not build with Kerberos5 support.
smbclient -U
does the "old fashioned" authentication by username/password.
I think this behaviour can be easily adopted to the tls commandlinetool.
But I don't know how the decision "use Kerberos or Username" can be
added to lib-using software like the ODBC drivers and the database-drivers and
so on.
Idea1: Use an Environmentvariable to enable use of kerberos.
Hmmm. ugly.
Idea2: use a "Dummy-Username" with dummypassword to trigger the use of
Kerberos5.
(Ugly in-band-signalling :-/)
Idea3: Something that can be put into the configfile?
Other options available that can be passed from the driver-using software
to the underlying libs to trigger the use of Kerberosauthentication?
Achim
More information about the FreeTDS
mailing list