FreeTDS Development Group

["ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>]

> 
> On Friday 09 November 2007, you wrote:
> 
> > > The resulting Kerberos5 service-ticket shown by kerbtray.exe
> > > has principalname of format
> > > 'cifs/fqdnhostname'. That would result in passing
> > > 'cifs@fqdnhostnam' to gss_import_name.
> > >
> > > I do not understand why to use 'MSSQLSvc' as a servicename?
> >
> > cifs is the file sharing service. 
> 
> Correct.
> 
> > Are you sure you are connecting to sql 
> > using kerberos?? It's not that easy to enable as it seems...
> 
> You can easily prove me wrong:
> 
> 1. use a Windowsclient and a MS-ODBC-driver to connect
>    to the MS-SQL 2005 server using "integrated Authentication.
> 
> 2. use kerbtray.exe to show the Tickets pulled into
>    the Windows credentials cache.
> 
> 3. Make a screenshot of kerbtray.exe showing the tickets
>    an send it by mail.
> 

klist (command line version of kerbtray) say


   Server: MSSQLSvc/xxxxx.mydomain.it:1433 AT MYDOMAIN.IT
      KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
      End Time: 11/12/2007 19:01:07
      Renew Time: 11/19/2007 9:01:07

Have you set tcp/ip as protocol? Perhaps you are using named pipes
(which use cifs).

> > > add GSS_C_MUTUAL_FLAG to the flags of gss_init_security_context.
> >
> > I know but the problem is that mssql seems to not return 
> any reply token
> > for kerberos...
> 
> Hmmmm.
> No Token and no errorcode of failure?
> 

I (and also ms odbc) send my token with mutual set but server just
accept ticket and do not reply with a kerberos ticket...

> > I think so... perhaps a pointer to a new structure that save
> > authentication type (ntlm/gssapi/whatever).
> 
> Hmmm. A structure that saves a pointer to a callback that
> does the authentication-work?
> 
> 

Yes, something like this, currently (on my working directory)

@@ -1252,20 +1252,30 @@
 };

 enum TDS_ICONV_ENTRY
 {
          client2ucs2
        , client2server_chardata
        , iso2server_metadata
        , initial_char_conv_count       /* keep last */
 };

+struct tds_authentication
+{
+       TDS_UCHAR *packet;
+       int packet_len;
+       int (*free)(TDSSOCKET * tds, struct tds_authentication * auth);
+       int (*get_next)(TDSSOCKET * tds, struct tds_authentication *
auth);
+};
+
+typedef struct tds_authentication TDSAUTHENTICATION;
+
 /**
  * Hold information for a server connection
  */
 struct tds_socket
 {
        /* fixed and connect time */
        /** tcp socket, INVALID_SOCKET if not connected */
        TDS_SYS_SOCKET s;
        TDS_SMALLINT major_version;
        TDS_SMALLINT minor_version;
@@ -1334,20 +1344,21 @@
        TDSCONNECTION *connection;

        int spid;
        TDS_UCHAR collation[5];
        TDS_UCHAR tds9_transaction[8];
        void (*env_chg_func) (TDSSOCKET * tds, int type, char *oldval,
char *newval);
        int internal_sp_called;

        void *tls_session;
        void *tls_credentials;
+       TDSAUTHENTICATION *authentication;
        int option_value;
 };

 int tds_init_write_buf(TDSSOCKET * tds);
 void tds_free_result_info(TDSRESULTINFO * info);
 void tds_free_socket(TDSSOCKET * tds);
 void tds_free_connection(TDSCONNECTION * connection);
 void tds_free_all_results(TDSSOCKET * tds);
 void tds_free_results(TDSRESULTINFO * res_info);
 void tds_free_param_results(TDSPARAMINFO * param_info);

> > Well... I know, the consideration is that our code try to 
> use kerberos
> > only if domain authentication is used and if kerberos can't be
> > initialized ntlm is used so if kerberos fails (for instance 
> cause there
> > is no spn) ntlm is used with provided password.
> 
> NTLM as  fallback?
> OK.
> 
> 
> Thank you,
> Achim
> 

Yes but ntlm as fallback it's not so fine... perhaps the better way is:

- no user and no password?? try kerberos (if not fails)
- domain user?? use ntlm
- use normal login

freddy77