Skip to Content.
Sympa Menu

freetds - Re: [freetds] Windows authentication on Windows

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Frediano Ziglio <freddy77 AT gmail.com>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] Windows authentication on Windows
  • Date: Fri, 29 Jan 2010 20:36:21 +0100

2010/1/26 <jklowden AT schemamania.org>:
> On Tue, Jan 26, 2010 at 02:53:51PM +0100, Frediano Ziglio wrote:
>> 2010/1/26 James K. Lowden <jklowden AT freetds.org>:
>> > Mark Brand wrote:
>> >> I would like to avoid specifying the password when making the
>> >> connection. I am using FreeTDS cross-compiled in mingw-cross-env.
>> >> http://www.nongnu.org/mingw-cross-env/
>> >
>> > The only such API call in NTWDBLIB.DLL is one of the SSPI functions:
>> > InitSecurityInterface(). It returns a dispatch table to the rest of the
>> > SSPI functions, so that would seem to be what they're doing. From the
>> > docs, it looks like InitializeSecurityContext(),
>> > AcquireCredentialsHandle(), and EncryptMessage() are what we need.
>>
>> I committed an initial patch for SSPI support... quite limited:
>> - currently supported using MingW cross compiler
>> - use only NTLM, no SPNEGO or Kerberos
>> - does not take into account username/password (so using any
>> domain\user and a password will use your current account)
>> - have some possible leak (dll initilization is not thread safe)
>> Attached patch for review.
>>
>> I uploaded a dll cross compiled at http://freetds.sf.net/odbc.zip. I
>> also applyed a fake ole registration extension to dll so you can
>> "register" odbc driver using regsvr32 executable. Just copy the dll
>> somewhere and execute
>
> Excellent!  Absolutely amazingly jaw-dropping awesome!
>
> I modified Nmakefile to build tds.lib with sspi.c (and to generate
> header files).  It works!
>
> $ echo select @@version | src\apps\win32\debug\bsqldb.exe -S %S% -U "" -P ""
>
> -----------------------------------------------------------------------------------
> Microsoft SQL Server 2005 - 9.00.3282.00 (X64)
>        Aug  5 2008 00:48:00
>        Copyright (c) 1988-2005 Microsoft Corporation
>        Enterprise Edition (64-bit) on Windows NT 5.2 (Build 3790: Service
> Pack 2)
>
> $ cl -? 2>&1 | grep Version
> Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 14.00.50727.762 for
> 80x86
>
> Did I mention how excellent this is?  The FreeTDS community owes you a
> big smooch.
>

Sometimes is strange how a thing that is easy for a person could be so
appreciated!

Well... some updates and some reminds. I think sspi code could be
considered completed:
- James tested code and compile under Windows correctly;
- using Negotiate and SPN Kerberos now works correctly using SSPI;
- you can provide domain\username and password to use another user;
- I implemented mutexes under Windows and now dll initialization is thread
safe.

As a reminds Kerberos support works since 2007 with empty username and
password (and obviously a correct kerberos setting with a correct
ticket!). Perhaps we could remove username/password from tsql or other
tools but perhaps is better to add an explicit option (-I like
"integrated security" or -T as trusted)... there are already
proprietary libraries for Windows and FreeTDS is largely used under
Unix where kerberos is not so easy to set up.

freddy77




Archive powered by MHonArc 2.6.24.

Top of Page