FreeTDS Development Group

["ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>]

> -----Original Message-----
> From: ZIGLIO, Frediano, VF-IT 
> Sent: giovedì 8 novembre 2007 15.50
> To: ZIGLIO, Frediano, VF-IT
> Subject: FW: [freetds] tds9 and gssapi
> 
>  
> 
> 
> ________________________________
> 
> From: Achim Grolms [mailto:achim AT grolmsnet.de] 
> Sent: mercoledì 7 novembre 2007 22.07
> To: ZIGLIO, Frediano, VF-IT
> Cc: freetds AT lists.ibiblio.org
> Subject: Re: [freetds] tds9 and gssapi
> 
> 
> On Tuesday 06 November 2007, you wrote:
> 
> > > The output of gss_import_name() is "output_name", a opaque
> > > struture that can be used to pass into
> >
> > I just realized that I can use getdomainname in order to 
> translate from
> > hostname to full qualified hostname...
> 
> But why to do so?
> passing GSS_NT_HOSTBASED_SERVIVE
> to gss_import_name() makes the GSSAPI do this work
> internally.
> 

Yes but it do not support spn like MSSQLSvc/fqdnhostname:port@DOMAIN which is 
required by mssql...

> 
> > Currently I support only a single round-trip, server seems 
> to agree but
> > it's not that fine...
> 
> What's the problem in detail?
> Are there any major/minor statuscodes that should be
> reported by gss_display_status()?
> 

Is that is a bit complicated to write code.... I should send to mssql some 
token that require a reply but I don't know how...

> > Mmmm... a bit more complicated cause these tokens are nested to sql
> > packets... 
> 
> Sure :-D
> Initiallly I wrote that the main problem is to know
> where to put the GSSAPI-Tokens...
> 

The idea is to save the state in TDSSOCKET if CONTINUE_NEEDED is returned and 
handle when server reply.

> >currently NTLMSSP (without SPNEGO) is the only handled
> > authentication after login...
> 
> Hmmmm.
> Is it sure that the server really suppert Kerberos5 login?
> How can that be answered to be really sure what works
> and what does not work?
> 

Well... if I use a wrong password and client login correctly with my login it 
should work. Also adding that I send a kerberos token and server agree seems 
ok, I hope mssql do not authenticate with an invalid kerberos token...

> I know, I have promised to to some "reverse engineering"
> myself.
> But I am too busy at the moment...
> I am sorry for beeing less helpful.
> 
> Thank you very much for doing that work!
>       Achim
> 

All your comments has been very helpful, thanks

Frediano