FreeTDS Development Group

["Iliyan Peychev" <iliyan.peychev AT gmail.com>]

Hi,

I am asking for help, related to NTLM and MS SQL 2000, running on Windows
2003. I really sorry, if I disturb you and this message is not for this
forum.


Here is the problem:

I am trying to write a program, which is working as "proxy" between Query
Analyzer, or some other client and MS SQL Server 2000. My program has to
capture packets, to deal with them and to forward them to MS SQL Server.

I am using Ethereal for capturing packets.
Query Analyzer uses Windows authentication to log in.

The problem is:
The packets, which Query Analyzer sends, are not just these "raw"
packages, described in NTLM documentation. Instead, it seems it is working
by using SPNEGO protocol - inside the captured packet, just after Library
Name, instead NTLMSSP, there is "GSS-API Generic Security Service
Application Program Interface". Below Ethereal shows "SPNEGO" also.

SPNEGO contains NTLM data.

So, I think it is working as described here:
http://davenport.sourceforge.net/ntlm.html#ntlmsspAndSspi

The problem is:

After manually calcluation of LM Response and NTLM response, they seems
"wrong", i.e. they are different than those, Query Analyzer sends in Type
3 message. I am sure the algorithm is not wrong, because the same code is
working properly with jTDS for example. Of course, I am also sure I pass
as parameters correct password and challenge - these, extracted from
captured packet.

Do you have an idea is the algorithm of calculation LM response and NTLM
response different in case of using SPNEGO?
What could be the reason for this issue?

Thank you in advance!
--
Using Opera's revolutionary e-mail client: http://www.opera.com/mail/