Skip to Content.
Sympa Menu

freetds - Re: [freetds] tds9 and gssapi

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Achim Grolms <achim AT grolmsnet.de>
  • To: Frediano Ziglio <freddy77 AT gmail.com>
  • Cc: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] tds9 and gssapi
  • Date: Thu, 1 Nov 2007 17:29:53 +0100

On Wednesday 31 October 2007, Frediano Ziglio wrote:

> - I didn't understand how to generate a service/instance name instead of
> a principal one...

The remarks below reference to the GSSAPI as defined in RFC2744.

In GSSAPI the servicename is constructed by a call to

gss_import_name()

In GSSAPI the name that goes into this call is
of format servicename@hostnamefqdn.
For example using GSSAPI for authenticating to a POP3 server of name
"bla.example.com" means the string going into gss_import_name()
becomes

"pop AT bla.example.com".

(registered servicenames are available at
<http://www.iana.org/assignments/gssapi-service-names>)

If your GSSAPI lib maps the request to the Kerberos5 layer
this results internally in a request to a Kerberosticket
of servicepricipal pop/bla.example.com@REALM,
But using the GSSAPI-Interface you don't become in touch
with dealing with Kerberos5 directly.

In other words here are the corresponding elements of names:

GSSAPI:
=======

servicename@hostnamefqdn

Kerberos5:
==========

servicename/hostnamefqd@REALM


The output of gss_import_name() is "output_name", a opaque
struture that can be used to pass into

gss_init_sec_context.

gss_init_sec_context returns the GSSAPI token ("output_token")
that has to be passed into the tls message stream at the right place.

How many times (of roundtrip) gss_init_sec_context has to be called
depends on the return value of gss_init_sec_contex.
(For example if the uses of "SPNEGO" Athentication triggers a Negotiation
of authentication type that means to the programmer looping over
gss_init_sec_context until the return values becomes "GSS_S_COMPLETE")
(The signal for "do the loop again" is "GSS_S_CONTINUE_NEEDED")


In pseudcode the structure ist this:

#include <gssapi.h>

gss_import_name(...);
major = gss_init_sec_context( &context_hdl,
emptyinputtoken,
outputtoken );
errorchecking( major );
put_token_into_tls_datastream( outputtoken );
send_tls_datastream();
read_tls_datastream();

while ( major == GSS_S_CONTINUE_NEEDED ) {
extract_servers_answertoken ( &serversidetoken );
major = gss_init_sec_context( &context_hdl,
serversidetoken,
outputtoken );
errorchecking( major );
put_token_into_tls_datastream( outputtoken );
send_tls_datastream();
read_tls_datastream();
}
/* authentication finished, go on using the authenticated connection */

Achim




Archive powered by MHonArc 2.6.24.

Top of Page