Skip to Content.
Sympa Menu

freetds - Re: [freetds] SQL Server 2005 and TDS version 8 -- is login always encapsulated in TLS (encrypted)?

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Achim Grolms <achim AT grolmsnet.de>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>, Bob Hetzel <beh AT case.edu>
  • Subject: Re: [freetds] SQL Server 2005 and TDS version 8 -- is login always encapsulated in TLS (encrypted)?
  • Date: Tue, 25 Sep 2007 00:17:32 +0200

On Monday 24 September 2007, Bob Hetzel wrote:
> To use kerberos you probably
> have to enable a property named "delegation" and you have to have it
> running in an active directory setup.

Hello Bob,

I do not understand why "delegation" is required.
As far as I know "delegation" means tranfer of TGT to a
remote host that uses this TGT for getting a Ticket for
another (third) host.

But in the scenario there is

- a SQL-client
- a Kerberos-enabled Server, (in this case the SQL 2005 Server)
- a KDC, in this case a AD-Domain-controller.

From theory's point of view the steps needed for authentication are

1. Client needs a TGT, user runs "kinit" to get one.

2. SQL-Client uses the TGT to get a Service-ticket for
SQL-Server

3. SQL client uses Service-ticket to authenticate to SQL-Server.
(by putting the GSSAPI-Token "somewhere" in the datastream.
"somewhere" is specified in the on-the-wire protocol the
SQL-client talks to the SQL-server.
BTW: this spec. is... available?)

Is my understanding of the question wrong?

Why "delegation"?
Can you explain this in more detail or point me to
the correct understanding what is going on in this case
of authentication?

Thank you,
Achim





Archive powered by MHonArc 2.6.24.

Top of Page