Skip to Content.
Sympa Menu

freetds - Re: [freetds] gss_init_sec_context

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: jklowden AT schemamania.org
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] gss_init_sec_context
  • Date: Mon, 27 Jun 2011 16:34:38 -0400

On Mon, Jun 27, 2011 at 04:09:58PM +0200, Frediano Ziglio wrote:
> 2011/6/25 <jklowden AT schemamania.org>:
> > On Thu, Jun 23, 2011 at 04:16:13PM -0400, jklowden AT schemamania.org wrote:
> > login.c:1090:detected flag 2
> > login.c:766:using tds_gss_get_auth authentication for [no name] account
> > gssapi.c:206:tds_gss_get_auth: kerberos name [foo]:1433
> > gssapi.c:284:gss_init_sec_context: min_stat 2529638944 "Unknown code krb5
> > 32"
> > gssapi.c:324:gss_init_sec_context: GSS_S_FAILURE: The routine failed for
> > reasons that are not defined at the GSS level.
> > gssapi.c:218:tds_gss_get_auth: maj_stat==0, tds_gss_continue returned 0
> > login.c:464:login packet rejected
> >
> > I don't know how to decode the minor status. Suggestions?
>
> Strange error... which kerberos library are you using?

$ ldd build/src/apps/.libs/bsqldb | grep k
libgssapi_krb5.so.2 => /usr/lib64/libgssapi_krb5.so.2
(0x000000357dc00000)
libkrb5.so.3 => /usr/lib64/libkrb5.so.3 (0x000000357d000000)
libk5crypto.so.3 => /usr/lib64/libk5crypto.so.3 (0x000000357a200000)
libkrb5support.so.0 => /usr/lib64/libkrb5support.so.0
(0x000000357b800000)
libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x0000003576200000)

> Are you sure you are not using an header and a wrong library?

Yes. I could be wrong, but I am sure.

> Machine iime and klist are ok?

Machine time (I assume you mean) agrees with SQL server within one second.

$ bsqldb -S servername\\MSSQLSERVER -U AC\\$USER -P $(password $USER) \
<<< 'select getdate()' && date

--------------------------
Jun 27 2011 04:16:47:077PM
1 rows affected
Mon Jun 27 16:16:46 EDT 2011

$ klist
Ticket cache: FILE:/tmp/krb5cc_8327
Default principal: lowdenjk AT AC.LP.ACML.COM

Valid starting Expires Service principal
06/27/11 12:44:18 06/27/11 22:44:26 krbtgt/AC.LP.ACML.COM AT AC.LP.ACML.COM
renew until 06/28/11 11:27:37
06/27/11 15:41:39 06/27/11 22:44:26
MSSQLSvc/servername.ac.lp.acml.com:2500 AT AC.LP.ACML.COM
renew until 06/28/11 11:27:37


Kerberos 4 ticket cache: /tmp/tkt8327
klist: You have no tickets cached

The same bsqldb connects to my regular server. The one it can't connect to
(with kerberos) is SQL Server Express. As you can see from the above, I
*can* connect to it using my domain account, just not with Kerberos.

On successful connection, I *do* get a valid actual mechanism pointer (not yet
decoded, ASN.1 BER, bah!). On failure, the pointer is set to NULL, or perhaps
unchanged. I don't know if that's standard and/or fixable.

Quite possibly I'd have to change something on the Windows box or the server
configuration to put it in the domain. Maybe I could figure that out by
trial and error. I'd like to add diagnostics to the TDSDUMP log that spell
out what's wrong.


> > I'm use RHEL, and apparently using Kerberos krb5-devel-1.6.1

--jkl




Archive powered by MHonArc 2.6.24.

Top of Page