Skip to Content.
Sympa Menu

freetds - Re: [freetds] gss_init_sec_context

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: jklowden AT schemamania.org
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] gss_init_sec_context
  • Date: Fri, 24 Jun 2011 18:38:44 -0400

On Thu, Jun 23, 2011 at 04:16:13PM -0400, jklowden AT schemamania.org wrote:
> http://www.gnu.org/software/gss/manual/html_node/Context_002dLevel-Routines.html
>
> In src/tds/gssapi.c::tds_gss_continue(), I think we may be calling
> gss_init_sec_context() incorrectly.
...
> The manual says the call should be in a loop

Well, the manual *does* say that, but more verbose error logging, recently
committed, shows the error is "mechanism specific":

net.c:602:Received packet
0000 04 01 00 25 00 00 01 00-00 00 15 00 06 01 00 1b |...%.... ........|
0010 00 01 02 00 1c 00 01 03-00 1d 00 00 ff 09 00 0f |........ ........|
0020 c3 00 00 02 00 - |.....|

login.c:1090:detected flag 2
login.c:766:using tds_gss_get_auth authentication for [no name] account
gssapi.c:206:tds_gss_get_auth: kerberos name [foo]:1433
gssapi.c:284:gss_init_sec_context: min_stat 2529638944 "Unknown code krb5 32"
gssapi.c:324:gss_init_sec_context: GSS_S_FAILURE: The routine failed for
reasons that are not defined at the GSS level.
gssapi.c:218:tds_gss_get_auth: maj_stat==0, tds_gss_continue returned 0
login.c:464:login packet rejected

I don't know how to decode the minor status. Suggestions?

Also, I tried to get the actual_mechanism; we currently pass a NULL because
don't use the feedback. I'm apparently using Kerberos krb5-devel-1.6.1, and
it
only ever sets that pointer to NULL. Suggestions?

Last point: when Kerberos logins fail, we should report TDSENEG to signify
login negotiation failed. Instead, tds_connect() reports TDSEFCON,
"Adaptive Server connection failed", which is *not* true. because
tds_connect() and the various tds..._login functions return only TDS_FAIL.
That needs unravelling.

--jkl




Archive powered by MHonArc 2.6.24.

Top of Page