[freetds] Windows authentication on Windows
freddy77 at gmail.com
Fri Jan 29 14:36:21 EST 2010
2010/1/26 <jklowden at schemamania.org>:
> On Tue, Jan 26, 2010 at 02:53:51PM +0100, Frediano Ziglio wrote:
>> 2010/1/26 James K. Lowden <jklowden at freetds.org>:
>> > Mark Brand wrote:
>> >> I would like to avoid specifying the password when making the
>> >> connection. I am using FreeTDS cross-compiled in mingw-cross-env.
>> >> http://www.nongnu.org/mingw-cross-env/
>> > The only such API call in NTWDBLIB.DLL is one of the SSPI functions:
>> > InitSecurityInterface(). It returns a dispatch table to the rest of the
>> > SSPI functions, so that would seem to be what they're doing. From the
>> > docs, it looks like InitializeSecurityContext(),
>> > AcquireCredentialsHandle(), and EncryptMessage() are what we need.
>> I committed an initial patch for SSPI support... quite limited:
>> - currently supported using MingW cross compiler
>> - use only NTLM, no SPNEGO or Kerberos
>> - does not take into account username/password (so using any
>> domain\user and a password will use your current account)
>> - have some possible leak (dll initilization is not thread safe)
>> Attached patch for review.
>> I uploaded a dll cross compiled at http://freetds.sf.net/odbc.zip. I
>> also applyed a fake ole registration extension to dll so you can
>> "register" odbc driver using regsvr32 executable. Just copy the dll
>> somewhere and execute
> Excellent! Absolutely amazingly jaw-dropping awesome!
> I modified Nmakefile to build tds.lib with sspi.c (and to generate
> header files). It works!
> $ echo select @@version | src\apps\win32\debug\bsqldb.exe -S %S% -U "" -P ""
> Microsoft SQL Server 2005 - 9.00.3282.00 (X64)
> Aug 5 2008 00:48:00
> Copyright (c) 1988-2005 Microsoft Corporation
> Enterprise Edition (64-bit) on Windows NT 5.2 (Build 3790: Service Pack 2)
> $ cl -? 2>&1 | grep Version
> Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 14.00.50727.762 for 80x86
> Did I mention how excellent this is? The FreeTDS community owes you a
> big smooch.
Sometimes is strange how a thing that is easy for a person could be so
Well... some updates and some reminds. I think sspi code could be
- James tested code and compile under Windows correctly;
- using Negotiate and SPN Kerberos now works correctly using SSPI;
- you can provide domain\username and password to use another user;
- I implemented mutexes under Windows and now dll initialization is thread safe.
As a reminds Kerberos support works since 2007 with empty username and
password (and obviously a correct kerberos setting with a correct
ticket!). Perhaps we could remove username/password from tsql or other
tools but perhaps is better to add an explicit option (-I like
"integrated security" or -T as trusted)... there are already
proprietary libraries for Windows and FreeTDS is largely used under
Unix where kerberos is not so easy to set up.
More information about the FreeTDS