[freetds] server realm configuration for ODBC
Frediano Ziglio
freddy77 at gmail.com
Thu Mar 8 14:40:43 EST 2012
2012/3/2 Mike Slifcak <slif at bellsouth.net>:
> Pointers to all-java solutions supporting cross-realm trust are welcomed.
>
> You are right - getting the ticket requires the client or 'the environment' to forward the
> request to the correct KDC or Active Directory Domain controller.
>
> What used to happen before 0.91?
>
> Client formed request using gss_import_name
> MSSQLSvc/host:port at current-realm [the realm of the CLIENT was assumed]
>
> After 0.91, using the setting for realm {Example: realm = FOO.EXAMPLE.COM]
>
> Client formed request using gss_import_name
> MSSQLSvc/host:port at FOO.EXAMPLE.COM [the realm setting configured for the host]
>
> The patch that I provided pre-0.91 suggested config changes for ODBC too. Freddie and I
> just didn't finish the agreement on what to call the param nor where to put it for ODBC in
> time for the release.
> -Slif
>
>
> James K. Lowden wrote:
>> Hi Mike,
>>
>>> There is interest in adapting Java/JDBC to use FreeTDS' ODBC driver.
>>
>> No objection here, of course, but would you mind explaining why? I
>> would have thought all-java would be preferred.
>>
>>> How can the FreeTDS ODBC driver include the realm so that Kerberos
>>> authentication between realms with transitive trust will work using
>>> FreeTDS' ODBC driver?
>>
>> In case it helps, tsql, bsqldb, and bsqlodbc all work just fine with
>> Kerberos. I used bsqldb routinely that way until recently.
>>
>> But I might be missing something. AIUI transitive trust is a property
>> of the ticket, not the connection. Do those utilities not work in your
>> environment and, if so, is it a matter of how they use the API, or of
>> how your environment is set up?
>>
As usual is in my patches...
The main issue is that MS parameter (ServerSPN) is different cause it
replace the entire SPN, not only add the realm.
James, I think that we should bump the version to 0.91.1 to add an
addition odbc parameter. What do you think?
Frediano
More information about the FreeTDS
mailing list