Skip to Content.
Sympa Menu

freetds - Re: [freetds] tds9 and gssapi

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • To: <achim AT grolmsnet.de>
  • Cc: freetds AT lists.ibiblio.org
  • Subject: Re: [freetds] tds9 and gssapi
  • Date: Thu, 8 Nov 2007 15:55:58 +0100



> -----Original Message-----
> From: ZIGLIO, Frediano, VF-IT
> Sent: giovedì 8 novembre 2007 15.50
> To: ZIGLIO, Frediano, VF-IT
> Subject: FW: [freetds] tds9 and gssapi
>
>
>
>
> ________________________________
>
> From: Achim Grolms [mailto:achim AT grolmsnet.de]
> Sent: mercoledì 7 novembre 2007 22.07
> To: ZIGLIO, Frediano, VF-IT
> Cc: freetds AT lists.ibiblio.org
> Subject: Re: [freetds] tds9 and gssapi
>
>
> On Tuesday 06 November 2007, you wrote:
>
> > > The output of gss_import_name() is "output_name", a opaque
> > > struture that can be used to pass into
> >
> > I just realized that I can use getdomainname in order to
> translate from
> > hostname to full qualified hostname...
>
> But why to do so?
> passing GSS_NT_HOSTBASED_SERVIVE
> to gss_import_name() makes the GSSAPI do this work
> internally.
>

Yes but it do not support spn like MSSQLSvc/fqdnhostname:port@DOMAIN which is
required by mssql...

>
> > Currently I support only a single round-trip, server seems
> to agree but
> > it's not that fine...
>
> What's the problem in detail?
> Are there any major/minor statuscodes that should be
> reported by gss_display_status()?
>

Is that is a bit complicated to write code.... I should send to mssql some
token that require a reply but I don't know how...

> > Mmmm... a bit more complicated cause these tokens are nested to sql
> > packets...
>
> Sure :-D
> Initiallly I wrote that the main problem is to know
> where to put the GSSAPI-Tokens...
>

The idea is to save the state in TDSSOCKET if CONTINUE_NEEDED is returned and
handle when server reply.

> >currently NTLMSSP (without SPNEGO) is the only handled
> > authentication after login...
>
> Hmmmm.
> Is it sure that the server really suppert Kerberos5 login?
> How can that be answered to be really sure what works
> and what does not work?
>

Well... if I use a wrong password and client login correctly with my login it
should work. Also adding that I send a kerberos token and server agree seems
ok, I hope mssql do not authenticate with an invalid kerberos token...

> I know, I have promised to to some "reverse engineering"
> myself.
> But I am too busy at the moment...
> I am sorry for beeing less helpful.
>
> Thank you very much for doing that work!
> Achim
>

All your comments has been very helpful, thanks

Frediano




Archive powered by MHonArc 2.6.24.

Top of Page