FreeTDS Development Group

[Brian Bruns <camber AT ais.org>]

Ok, let me change the discourse a bit.  We have two things going on here:

1) domain logins.

Domain logins have the advantage of not being sent in the clear or clear
text equivelent.  They also tied in with NT's single password scheme.  All
in all, Good Things (tm).  

The biggest advantage from the client side of using them is that the SQL
Server may be configured to accept only domain logins.  Thus, assuming the
FreeTDS user is not in a position of control over the NT box (it happens
quite a bit) prevents the use of FreeTDS in accessing SQL Server.  This is
a big deal to me, and it is the one I've tackled.

2) trusted connections

This is purely in the desktop realm.  A user logs into the network and his
credentials are then used in a single sign-on scheme to access all the
resources, including SQL Server.  It's a convenience to the desktop
user.  How many of those do we have? Don't really know, but I'm guessing
not many.  Question is, can SQL Server restrict access to only trusted
connections? And if so what happens under a situation such as IIS/ASP/ADO
whatever where the application is running with no user logged into the
box? I'm not sure I understand this peice of it at all.  Someone
educate me, please.

To me this is the less important issue. 0.53 fodder at least.

B.


On Thu, 31 May 2001, James K. Lowden wrote:

> > where do you cache the credentials?  Microsoft's extensive use of
> > credential caching throughout the OS is a large reason why it's taken 
> > them ten
> > years to turn NT into something even remotely resembling a multi-user OS.
> > (Have you ever seen the error message 'The credentials specified conflict 
> > with
> > an existing set of credentials'? :P) If you're going to cache credentials 
> > on
> > the system so that FreeTDS connections can 'automatically' make use of 
> > them,
> > how are you going to link a specific credentials cache to a specific TDS
> > session?  By user id?
> 
> Yes.  (and MS error messages are my absolute favorite rant, don't even get 
> me
> started)
> 
> > What if you have a webserver serving multiple
> > database-driven sites that need different access rights?
> 
> Then you have to use old-fashioned ;-) server logins.
> 


> All your points about Kerberos and nothing else knowing about it or being 
> able to use
> it, you're absolutely right, including your long term squinting.  Quite so. 
>  I didn't
> know you were trying to help anyone besides FreeTDS clients.
>