Skip to Content.
Sympa Menu

freetds - Re: [freetds] tds9 and gssapi

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Achim Grolms <achim AT grolmsnet.de>
  • To: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • Cc: freetds AT lists.ibiblio.org
  • Subject: Re: [freetds] tds9 and gssapi
  • Date: Tue, 13 Nov 2007 23:02:40 +0100

On Monday 12 November 2007, you wrote:

> Yes but ntlm as fallback it's not so fine... perhaps the better way is:
>
> - no user and no password?? try kerberos (if not fails)
> - domain user?? use ntlm
> - use normal login

Hmm.
On Samba the commandlinetool "smbclient" ships with different modes
of authentication:

smbclient -k

directly uses the Kerberosmachanism.
And fails with "Not build with Kerberos5 support" if the tool
was not build with Kerberos5 support.

smbclient -U

does the "old fashioned" authentication by username/password.


I think this behaviour can be easily adopted to the tls commandlinetool.

But I don't know how the decision "use Kerberos or Username" can be
added to lib-using software like the ODBC drivers and the database-drivers
and
so on.

Idea1: Use an Environmentvariable to enable use of kerberos.
Hmmm. ugly.

Idea2: use a "Dummy-Username" with dummypassword to trigger the use of
Kerberos5.
(Ugly in-band-signalling :-/)

Idea3: Something that can be put into the configfile?

Other options available that can be passed from the driver-using software
to the underlying libs to trigger the use of Kerberosauthentication?

Achim




Archive powered by MHonArc 2.6.24.

Top of Page