Skip to Content.
Sympa Menu

freetds - Re: [freetds] mission: emulate "trusted login"

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Frediano Ziglio <freddy77 AT gmail.com>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] mission: emulate "trusted login"
  • Date: Wed, 4 Feb 2009 09:43:53 +0100

2009/2/3 James K. Lowden <jklowden AT freetds.org>:
> I would like FreeTDS to be able to run on Win64 in just the way
> NTWDBLIB.DLL runs in Win32.
>
> The biggest missing component is "trusted login", whereby the user does
> not provide his username and password. Instead, cached credentials are
> retrieved from the operating system. Adding that feature to FreeTDS will
> give us a bone-for-bone Microsoft-compatible Win64 DB-Library.
>
> Question: how to retrieve said credentials via the Win32 API?
>
> Windows surely doesn't store the user's password verbatim, but rather
> keeps the hashed/salted/whatever version of it. Part of FreeTDS's current
> functionality is to turn a raw password in to a [something] and then pass
> that to the server. I want to pass the same [something], but starting
> from whatever I can get from Win32, not the password itself.
>
> If someone could point me to the right API function, I would consider it a
> service, with gratitude. Google terms also gladly accepted. If you could
> tell me what I mean by [something], that would also be helpful.
>
> I found getSchannelClientHandle(). Is that in the right neighborhood?
>
> Many thanks.
>

Mmm... good. Personally I would check some OS software. I think curl
and firefox implements SSPI but you can find code in many places.
About FreeTDS all stuff is quite ready, see kerberos changes, in
particular login.c:

/* check ntlm */
if (strchr(user_name, '\\') != NULL) {
tds->authentication = tds_ntlm_get_auth(tds);
if (!tds->authentication)
return TDS_FAIL;
auth_len = tds->authentication->packet_len;
packet_size += auth_len;
} else if (user_name_len == 0) {
#ifdef ENABLE_KRB5
/* try kerberos */
tds->authentication = tds_gss_get_auth(tds);
if (!tds->authentication)
return TDS_FAIL;
auth_len = tds->authentication->packet_len;
packet_size += auth_len;
#else
return TDS_FAIL;
#endif
} else
packet_size += (user_name_len + password_len) * 2;

and gssapi.c. In this case you would replace kerberos stuff with SSPI.

OT: Well... looking at the code... what kind of bad code, too
replicated lines... well... perhaps it would be better to define a new
authentication even for username/password...

freddy77




Archive powered by MHonArc 2.6.24.

Top of Page