FreeTDS Development Group

[Achim Grolms <achim AT grolmsnet.de>]

On Monday 12 November 2007, you wrote:

> Yes but ntlm as fallback it's not so fine... perhaps the better way is:
>
> - no user and no password?? try kerberos (if not fails)
> - domain user?? use ntlm
> - use normal login

Hmm.
On Samba the commandlinetool "smbclient" ships with different modes
of authentication:

smbclient -k

directly uses the Kerberosmachanism.
And fails with "Not build with Kerberos5 support" if the tool
was not build with Kerberos5 support.

smbclient -U

does the "old fashioned" authentication by username/password.


I think this behaviour can be easily adopted to the tls commandlinetool.

But I don't know how the decision "use Kerberos or Username" can be
added to lib-using software like the ODBC drivers and the database-drivers 
and 
so on.

Idea1: Use an Environmentvariable to enable use of kerberos.
Hmmm. ugly.

Idea2: use a "Dummy-Username"  with dummypassword to trigger the use of 
Kerberos5.
(Ugly in-band-signalling :-/)

Idea3: Something that can be put into the configfile?

Other options available that can be passed from the driver-using software
to the underlying libs to trigger the use of Kerberosauthentication?

Achim