FreeTDS Development Group

[Achim Grolms <achim AT grolmsnet.de>]

On Monday 24 September 2007, Bob Hetzel wrote:
> To use kerberos you probably
> have to enable a property named "delegation" and you have to have it
> running in an active directory setup.  

Hello Bob,

I do not understand why "delegation" is required.
As far as I know "delegation" means tranfer of TGT to a 
remote host that uses this TGT for getting a Ticket for
another (third) host.

But in the scenario there is 

- a SQL-client
- a Kerberos-enabled Server, (in this case the SQL 2005 Server)
- a KDC, in this case a AD-Domain-controller.

From theory's point of view the steps needed for authentication are

1. Client needs a TGT, user runs "kinit" to get one.

2. SQL-Client uses the TGT to get a Service-ticket for
   SQL-Server

3. SQL client uses Service-ticket to authenticate to SQL-Server.
   (by putting the GSSAPI-Token "somewhere" in the datastream.
   "somewhere" is specified in the on-the-wire protocol the
    SQL-client talks to the SQL-server.
    BTW: this spec. is... available?)

Is my understanding of the question wrong?

Why "delegation"?
Can you explain this in more detail or point me to
the correct understanding what is going on in this case
of authentication?

Thank you,
Achim