FreeTDS Development Group

["ZIGLIO, Frediano, VF-IT" <Frediano.Ziglio AT vodafone.com>]

> 
> Achim Grolms wrote:
> > Idea1: Use an Environmentvariable to enable use of kerberos.
> > Hmmm. ugly.
> > 
> > Idea2: use a "Dummy-Username"  with dummypassword to 
> trigger the use of 
> > Kerberos5.
> > (Ugly in-band-signalling :-/)
> > 
> > Idea3: Something that can be put into the configfile?
> > 
> > Other options available that can be passed from the driver-using
> > software to the underlying libs to trigger the use of
> > Kerberosauthentication?
> 
> Am I missing something?  Absence of a username is sufficient 
> to tell the
> library that Kerberos authentication should be used.  
> 
> How about:
> 
>       If Kerberos is built-in (configured at compile time) and 
>       the user provides no username+password pair, then
>       consult the Kerberos server.  
> 
> Something like:
> 
> if (!username) {
>       if (HAVE_KERBEROS) {
>               if (authenticate()) {
>                       Yay!
>               } else {
>                       kerberos auth failure
>               }
>       } else {
>               username required failure
>       }
> } else {
>       if (authenticate(username)) {
>               Yay!
>       } else {
>               authentication failed
>       }
> }
> 
> --jkl
> 

This should suffice

diff -u -1 -0 -r1.169 login.c
--- src/tds/login.c     13 Nov 2007 09:14:57 -0000      1.169
+++ src/tds/login.c     14 Nov 2007 16:15:30 -0000
@@ -710,28 +710,30 @@

        packet_size = current_pos + (host_name_len + app_name_len +
server_name_len + library_len + language_len + database_len) * 2;

        /* check ntlm */
        if (strchr(user_name, '\\') != NULL) {
                tds->authentication = tds_ntlm_get_auth(tds);
                if (!tds->authentication)
                        return TDS_FAIL;
                auth_len = tds->authentication->packet_len;
                packet_size += auth_len;
-#ifdef ENABLE_KRB5
        } else if (user_name_len == 0) {
+#ifdef ENABLE_KRB5
                /* try kerberos */
                tds->authentication = tds_gss_get_auth(tds);
                if (!tds->authentication)
                        return TDS_FAIL;
                auth_len = tds->authentication->packet_len;
                packet_size += auth_len;
+#else
+               return TDS_FAIL;
 #endif
        } else
                packet_size += (user_name_len + password_len) * 2;

        tdsdump_log(TDS_DBG_INFO2, "quietly sending TDS 7+ login
packet\n");
        tdsdump_off();

        tds_put_int(tds, packet_size);
        if (IS_TDS90(tds)) {
                tds_put_n(tds, tds9Version, 4);

freddy77