Skip to Content.
Sympa Menu

freetds - Re: [freetds] tds9 and gssapi

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Hildo Biersma <Hildo.Biersma AT morganstanley.com>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] tds9 and gssapi
  • Date: Thu, 15 Nov 2007 08:08:10 -0500

Frediano Ziglio wrote:
Il giorno mar, 13/11/2007 alle 23.02 +0100, Achim Grolms ha scritto:

On Monday 12 November 2007, you wrote:


Yes but ntlm as fallback it's not so fine... perhaps the better way is:

- no user and no password?? try kerberos (if not fails)
- domain user?? use ntlm
- use normal login

Hmm.
On Samba the commandlinetool "smbclient" ships with different modes
of authentication:

smbclient -k

directly uses the Kerberosmachanism.
And fails with "Not build with Kerberos5 support" if the tool
was not build with Kerberos5 support.

smbclient -U

does the "old fashioned" authentication by username/password.


I think this behaviour can be easily adopted to the tls commandlinetool.

But I don't know how the decision "use Kerberos or Username" can be
added to lib-using software like the ODBC drivers and the database-drivers and so on.

Idea1: Use an Environmentvariable to enable use of kerberos.
Hmmm. ugly.

Idea2: use a "Dummy-Username" with dummypassword to trigger the use of Kerberos5.
(Ugly in-band-signalling :-/)



That is current implementation... empty username means kerberos. You
have a similar behavior under windows (with empty username you get
"integrated authentication") with the difference that under windows is
up to the system to decide between ntlm and kerberos (but under *nix we
need user/password to make ntlm works).

Can I suggest you add an additional way to trigger Kerberos, for example the combination of the userid "Kerberos" and password "Ticket"?

Here at Morgan Stanley we are heavy users of IBM DB2 with GSS authentication, which is also triggered by an empty userid and password. This is fine for in-house applications, but a lot of vendor applications implement edit checks that a userid and password is not empty; for example, a GUI will gray out the 'connect' button until the userid and password contain a non-empty value. Having a second way to trigger Kerberos in FreeTDS, by virtue of a special userid and password, will avoid these issues.




Archive powered by MHonArc 2.6.24.

Top of Page