Skip to Content.
Sympa Menu

freetds - Re: [freetds] tds9 and gssapi

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Achim Grolms <achim AT grolmsnet.de>
  • To: "ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>
  • Cc: freetds AT lists.ibiblio.org
  • Subject: Re: [freetds] tds9 and gssapi
  • Date: Fri, 9 Nov 2007 18:14:11 +0100

On Friday 09 November 2007, you wrote:

> > The resulting Kerberos5 service-ticket shown by kerbtray.exe
> > has principalname of format
> > 'cifs/fqdnhostname'. That would result in passing
> > 'cifs@fqdnhostnam' to gss_import_name.
> >
> > I do not understand why to use 'MSSQLSvc' as a servicename?
>
> cifs is the file sharing service.

Correct.

> Are you sure you are connecting to sql
> using kerberos?? It's not that easy to enable as it seems...

You can easily prove me wrong:

1. use a Windowsclient and a MS-ODBC-driver to connect
to the MS-SQL 2005 server using "integrated Authentication.

2. use kerbtray.exe to show the Tickets pulled into
the Windows credentials cache.

3. Make a screenshot of kerbtray.exe showing the tickets
an send it by mail.

> > add GSS_C_MUTUAL_FLAG to the flags of gss_init_security_context.
>
> I know but the problem is that mssql seems to not return any reply token
> for kerberos...

Hmmmm.
No Token and no errorcode of failure?

> I think so... perhaps a pointer to a new structure that save
> authentication type (ntlm/gssapi/whatever).

Hmmm. A structure that saves a pointer to a callback that
does the authentication-work?


> Well... I know, the consideration is that our code try to use kerberos
> only if domain authentication is used and if kerberos can't be
> initialized ntlm is used so if kerberos fails (for instance cause there
> is no spn) ntlm is used with provided password.

NTLM as fallback?
OK.


Thank you,
Achim




Archive powered by MHonArc 2.6.24.

Top of Page