Skip to Content.
Sympa Menu

freetds - Re: [freetds] tds9 and gssapi

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • To: <achim AT grolmsnet.de>
  • Cc: freetds AT lists.ibiblio.org
  • Subject: Re: [freetds] tds9 and gssapi
  • Date: Mon, 12 Nov 2007 09:46:19 +0100

>
> On Friday 09 November 2007, you wrote:
>
> > > The resulting Kerberos5 service-ticket shown by kerbtray.exe
> > > has principalname of format
> > > 'cifs/fqdnhostname'. That would result in passing
> > > 'cifs@fqdnhostnam' to gss_import_name.
> > >
> > > I do not understand why to use 'MSSQLSvc' as a servicename?
> >
> > cifs is the file sharing service.
>
> Correct.
>
> > Are you sure you are connecting to sql
> > using kerberos?? It's not that easy to enable as it seems...
>
> You can easily prove me wrong:
>
> 1. use a Windowsclient and a MS-ODBC-driver to connect
> to the MS-SQL 2005 server using "integrated Authentication.
>
> 2. use kerbtray.exe to show the Tickets pulled into
> the Windows credentials cache.
>
> 3. Make a screenshot of kerbtray.exe showing the tickets
> an send it by mail.
>

klist (command line version of kerbtray) say


Server: MSSQLSvc/xxxxx.mydomain.it:1433 AT MYDOMAIN.IT
KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
End Time: 11/12/2007 19:01:07
Renew Time: 11/19/2007 9:01:07

Have you set tcp/ip as protocol? Perhaps you are using named pipes
(which use cifs).

> > > add GSS_C_MUTUAL_FLAG to the flags of gss_init_security_context.
> >
> > I know but the problem is that mssql seems to not return
> any reply token
> > for kerberos...
>
> Hmmmm.
> No Token and no errorcode of failure?
>

I (and also ms odbc) send my token with mutual set but server just
accept ticket and do not reply with a kerberos ticket...

> > I think so... perhaps a pointer to a new structure that save
> > authentication type (ntlm/gssapi/whatever).
>
> Hmmm. A structure that saves a pointer to a callback that
> does the authentication-work?
>
>

Yes, something like this, currently (on my working directory)

@@ -1252,20 +1252,30 @@
};

enum TDS_ICONV_ENTRY
{
client2ucs2
, client2server_chardata
, iso2server_metadata
, initial_char_conv_count /* keep last */
};

+struct tds_authentication
+{
+ TDS_UCHAR *packet;
+ int packet_len;
+ int (*free)(TDSSOCKET * tds, struct tds_authentication * auth);
+ int (*get_next)(TDSSOCKET * tds, struct tds_authentication *
auth);
+};
+
+typedef struct tds_authentication TDSAUTHENTICATION;
+
/**
* Hold information for a server connection
*/
struct tds_socket
{
/* fixed and connect time */
/** tcp socket, INVALID_SOCKET if not connected */
TDS_SYS_SOCKET s;
TDS_SMALLINT major_version;
TDS_SMALLINT minor_version;
@@ -1334,20 +1344,21 @@
TDSCONNECTION *connection;

int spid;
TDS_UCHAR collation[5];
TDS_UCHAR tds9_transaction[8];
void (*env_chg_func) (TDSSOCKET * tds, int type, char *oldval,
char *newval);
int internal_sp_called;

void *tls_session;
void *tls_credentials;
+ TDSAUTHENTICATION *authentication;
int option_value;
};

int tds_init_write_buf(TDSSOCKET * tds);
void tds_free_result_info(TDSRESULTINFO * info);
void tds_free_socket(TDSSOCKET * tds);
void tds_free_connection(TDSCONNECTION * connection);
void tds_free_all_results(TDSSOCKET * tds);
void tds_free_results(TDSRESULTINFO * res_info);
void tds_free_param_results(TDSPARAMINFO * param_info);

> > Well... I know, the consideration is that our code try to
> use kerberos
> > only if domain authentication is used and if kerberos can't be
> > initialized ntlm is used so if kerberos fails (for instance
> cause there
> > is no spn) ntlm is used with provided password.
>
> NTLM as fallback?
> OK.
>
>
> Thank you,
> Achim
>

Yes but ntlm as fallback it's not so fine... perhaps the better way is:

- no user and no password?? try kerberos (if not fails)
- domain user?? use ntlm
- use normal login

freddy77




Archive powered by MHonArc 2.6.24.

Top of Page