FreeTDS Development Group

["Lowden, James K" <LowdenJK AT bernstein.com>]

> From: W.H. van Atteveldt
> Sent: Wednesday, December 07, 2005 3:43 PM
> 
> [wva@swpc450 wva]$ /usr/local/freetds/bin/tsql -H <server> -p 1433 -U
> <domain>\\WH.van.Atteveldt -P <password>
> locale is "en_US.UTF-8"
> locale charset is "UTF-8"
> Msg 18456, Level 14, State 1, Server , Line 0
> Login failed for user '<domain>\WH.van.Atteveldt'.
> Msg 20014, Level 9, State 0, Server OpenClient, Line 0
> Login incorrect.
> There was a problem connecting to the server
> 
> (There is a separate domain controller that I probably need to
> login onto.)
> 
> Is it at all possible to use 'integrated security' using freetds?
> It seems a bit simplistic to just send the domain name and password
> if the server requires a 'trusted connection', which to me sounds
> like Kerberos and all kind of heaby protocols. Not that I know
> anything about that...

It's confusing only because Microsoft's documentation doesn't lay bare
how simple it is.  

The PDC doesn't enter into the equation.  The server sends a challenge;
the client's response is constructed from the challenge and the
password.  The server examines the client's response, and says yea/nae.
(I think it relies on the PDC to do that, but I'm not sure.) 

On your NT workstation, your password is cached somewhere.  FreeTDS
doesn't have access to it, so you have to pass it to it.  The library
then does what the NT workstation does: construct and send a response to
the challenge.  

There's no black magic.  The hard part, in fact, was finding LGPL
compliant code.  For that, we especially thank Steve Langasek
(ChangeLog-2002):

Sun Sep 29 15:43:00 CDT 2002     Steve Langasek <vorlon AT netexpress.net>
* include/des.h src/tds/des.c src/tds/challenge.c src/tds/login.c
  acinclude.m4:
- add DES support to libtds, breaking the dependency on OpenSSL

As Frediano told you, your server must accept domain logins over TCP/IP
connections; we don't do NTLM2.  

It works really well, so well that one of my minor ambitions is to write
a TDS proxy that would accept non-domain logins (from closed-source
applications that don't know about domain logins) and convert them into
domain logins for servers that don't accept anything else.  Just another
SMP.  

HTH.

--jkl

-----------------------------------------
The information contained in this transmission may be privileged and
confidential and is intended only for the use of the person(s) named
above. If you are not the intended recipient, or an employee or agent 
responsible
for delivering this message to the intended recipient, any review, 
dissemination,
distribution or duplication of this communication is strictly prohibited. If 
you are
not the intended recipient, please contact the sender immediately by reply 
e-mail
and destroy all copies of the original message. Please note that we do not 
accept
account orders and/or instructions by e-mail, and therefore will not be 
responsible
for carrying out such orders and/or instructions.  If you, as the intended 
recipient
of this message, the purpose of which is to inform and update our clients, 
prospects
and consultants of developments relating to our services and products, would 
not
like to receive further e-mail correspondence from the sender, please "reply" 
to the
sender indicating your wishes.  In the U.S.: 1345 Avenue of the Americas, New 
York,
NY 10105.