FreeTDS Development Group

[Achim Grolms <achim AT grolmsnet.de>]

On Friday 09 November 2007, you wrote:

> > The resulting Kerberos5 service-ticket shown by kerbtray.exe
> > has principalname of format
> > 'cifs/fqdnhostname'. That would result in passing
> > 'cifs@fqdnhostnam' to gss_import_name.
> >
> > I do not understand why to use 'MSSQLSvc' as a servicename?
>
> cifs is the file sharing service. 

Correct.

> Are you sure you are connecting to sql 
> using kerberos?? It's not that easy to enable as it seems...

You can easily prove me wrong:

1. use a Windowsclient and a MS-ODBC-driver to connect
   to the MS-SQL 2005 server using "integrated Authentication.

2. use kerbtray.exe to show the Tickets pulled into
   the Windows credentials cache.

3. Make a screenshot of kerbtray.exe showing the tickets
   an send it by mail.

> > add GSS_C_MUTUAL_FLAG to the flags of gss_init_security_context.
>
> I know but the problem is that mssql seems to not return any reply token
> for kerberos...

Hmmmm.
No Token and no errorcode of failure?

> I think so... perhaps a pointer to a new structure that save
> authentication type (ntlm/gssapi/whatever).

Hmmm. A structure that saves a pointer to a callback that
does the authentication-work?


> Well... I know, the consideration is that our code try to use kerberos
> only if domain authentication is used and if kerberos can't be
> initialized ntlm is used so if kerberos fails (for instance cause there
> is no spn) ntlm is used with provided password.

NTLM as  fallback?
OK.


Thank you,
Achim