[freetds] tds9 and gssapi
Frediano Ziglio
freddy77 at gmail.com
Wed Nov 14 01:58:38 EST 2007
Il giorno mar, 13/11/2007 alle 23.02 +0100, Achim Grolms ha scritto:
> On Monday 12 November 2007, you wrote:
>
> > Yes but ntlm as fallback it's not so fine... perhaps the better way is:
> >
> > - no user and no password?? try kerberos (if not fails)
> > - domain user?? use ntlm
> > - use normal login
>
> Hmm.
> On Samba the commandlinetool "smbclient" ships with different modes
> of authentication:
>
> smbclient -k
>
> directly uses the Kerberosmachanism.
> And fails with "Not build with Kerberos5 support" if the tool
> was not build with Kerberos5 support.
>
> smbclient -U
>
> does the "old fashioned" authentication by username/password.
>
>
> I think this behaviour can be easily adopted to the tls commandlinetool.
>
> But I don't know how the decision "use Kerberos or Username" can be
> added to lib-using software like the ODBC drivers and the database-drivers and
> so on.
>
> Idea1: Use an Environmentvariable to enable use of kerberos.
> Hmmm. ugly.
>
> Idea2: use a "Dummy-Username" with dummypassword to trigger the use of
> Kerberos5.
> (Ugly in-band-signalling :-/)
>
That is current implementation... empty username means kerberos. You
have a similar behavior under windows (with empty username you get
"integrated authentication") with the difference that under windows is
up to the system to decide between ntlm and kerberos (but under *nix we
need user/password to make ntlm works).
> Idea3: Something that can be put into the configfile?
>
> Other options available that can be passed from the driver-using software
> to the underlying libs to trigger the use of Kerberosauthentication?
>
> Achim
freddy77
More information about the FreeTDS
mailing list