FreeTDS Development Group

[Frediano Ziglio <freddy77 AT gmail.com>]

Il giorno mar, 13/11/2007 alle 23.02 +0100, Achim Grolms ha scritto:
> On Monday 12 November 2007, you wrote:
> 
> > Yes but ntlm as fallback it's not so fine... perhaps the better way is:
> >
> > - no user and no password?? try kerberos (if not fails)
> > - domain user?? use ntlm
> > - use normal login
> 
> Hmm.
> On Samba the commandlinetool "smbclient" ships with different modes
> of authentication:
> 
> smbclient -k
> 
> directly uses the Kerberosmachanism.
> And fails with "Not build with Kerberos5 support" if the tool
> was not build with Kerberos5 support.
> 
> smbclient -U
> 
> does the "old fashioned" authentication by username/password.
> 
> 
> I think this behaviour can be easily adopted to the tls commandlinetool.
> 
> But I don't know how the decision "use Kerberos or Username" can be
> added to lib-using software like the ODBC drivers and the database-drivers 
> and 
> so on.
> 
> Idea1: Use an Environmentvariable to enable use of kerberos.
> Hmmm. ugly.
> 
> Idea2: use a "Dummy-Username"  with dummypassword to trigger the use of 
> Kerberos5.
> (Ugly in-band-signalling :-/)
> 

That is current implementation... empty username means kerberos. You
have a similar behavior under windows (with empty username you get
"integrated authentication") with the difference that under windows is
up to the system to decide between ntlm and kerberos (but under *nix we
need user/password to make ntlm works).

> Idea3: Something that can be put into the configfile?
> 
> Other options available that can be passed from the driver-using software
> to the underlying libs to trigger the use of Kerberosauthentication?
> 
> Achim

freddy77