[freetds] Windows authentication on Windows
Frediano Ziglio
freddy77 at gmail.com
Tue Jan 26 08:53:51 EST 2010
2010/1/26 James K. Lowden <jklowden at freetds.org>:
> Mark Brand wrote:
>> I would like to avoid specifying the password when making the
>> connection. I am using FreeTDS cross-compiled in mingw-cross-env.
>> http://www.nongnu.org/mingw-cross-env/
>
> The feature does not exist in FreeTDS. You're not alone in asking for it,
> though. I myself would like that to work, so we'd have a working 64-bit
> db-lib implementation.
>> I've read a few things on this subject, for example that it might be
>> possible to use samba to authenticate from a non-Windows host. But I'm
>> thinking there might be an easier way if we are running on Windows.
>
> Samba won't help us here. In fact we had to write our own domain login
> code because as an LGPL project we couldn't use samba's GPL code.
>
> The best thing I found was
>
> http://blogs.msdn.com/sql_protocols/archive/2006/12/02/understanding-kerberos-and-ntlm-authentication-in-sql-server-connections.aspx
>
> also
>
> http://blogs.msdn.com/sql_protocols/archive/2005/10/12/479871.aspx
> http://support.microsoft.com/kb/811889
>
> According to Mr. Lu, in NTLM:
>
> 1. client sends the user name to the server
> 2. server generates and sends a challenge to the client
> 3. client encrypts that challenge using the user's password
> 4. client sends a response to the server.
>
> The hard part has always been #3 because it had to be (and has been)
> reverse engineered. As you say, it would be nice to use the Win32 API to
> do that when its available because we wouldn't need the password.
>
> I'm interested in NTLM because that's what FreeTDS uses on my servers at
> work. (select auth_scheme from sys.dm_exec_connections where
> session_id=@@spid yields "NTLM".)
>
> The only such API call in NTWDBLIB.DLL is one of the SSPI functions:
> InitSecurityInterface(). It returns a dispatch table to the rest of the
> SSPI functions, so that would seem to be what they're doing. From the
> docs, it looks like InitializeSecurityContext(),
> AcquireCredentialsHandle(), and EncryptMessage() are what we need.
>
> Want to take a stab at this? It would be a great feature for the next
> release.
>
I committed an initial patch for SSPI support... quite limited:
- currently supported using MingW cross compiler
- use only NTLM, no SPNEGO or Kerberos
- does not take into account username/password (so using any
domain\user and a password will use your current account)
- have some possible leak (dll initilization is not thread safe)
Attached patch for review.
I uploaded a dll cross compiled at http://freetds.sf.net/odbc.zip. I
also applyed a fake ole registration extension to dll so you can
"register" odbc driver using regsvr32 executable. Just copy the dll
somewhere and execute
regsvr32 libtdsodbc-0.dll
freddy77
-------------- next part --------------
A non-text attachment was scrubbed...
Name: vedi.diff.gz
Type: application/x-gzip
Size: 5661 bytes
Desc: not available
Url : http://lists.ibiblio.org/pipermail/freetds/attachments/20100126/946745f4/attachment.gz
More information about the FreeTDS
mailing list