FreeTDS Development Group

[Hildo Biersma <Hildo.Biersma AT morganstanley.com>]

Frediano Ziglio wrote:
> Il giorno mar, 13/11/2007 alle 23.02 +0100, Achim Grolms ha scritto:
>
> > On Monday 12 November 2007, you wrote:
> >
> >
> > > Yes but ntlm as fallback it's not so fine... perhaps the better way is:
> > >
> > > - no user and no password?? try kerberos (if not fails)
> > > - domain user?? use ntlm
> > > - use normal login
> >
> > Hmm.
> > On Samba the commandlinetool "smbclient" ships with different modes
> > of authentication:
> >
> > smbclient -k
> >
> > directly uses the Kerberosmachanism.
> > And fails with "Not build with Kerberos5 support" if the tool
> > was not build with Kerberos5 support.
> >
> > smbclient -U
> >
> > does the "old fashioned" authentication by username/password.
> >
> >
> > I think this behaviour can be easily adopted to the tls commandlinetool.
> >
> > But I don't know how the decision "use Kerberos or Username" can be
> > added to lib-using software like the ODBC drivers and the database-drivers and 
> > so on.
> >
> > Idea1: Use an Environmentvariable to enable use of kerberos.
> > Hmmm. ugly.
> >
> > Idea2: use a "Dummy-Username"  with dummypassword to trigger the use of 
> > Kerberos5.
> > (Ugly in-band-signalling :-/)
>
>
> That is current implementation... empty username means kerberos. You
> have a similar behavior under windows (with empty username you get
> "integrated authentication") with the difference that under windows is
> up to the system to decide between ntlm and kerberos (but under *nix we
> need user/password to make ntlm works).

Can I suggest you add an additional way to trigger Kerberos, for example 
the combination of the userid "Kerberos" and password "Ticket"?

Here at Morgan Stanley we are heavy users of IBM DB2 with GSS 
authentication, which is also triggered by an empty userid and password. 
  This is fine for in-house applications, but a lot of vendor 
applications implement edit checks that a userid and password is not 
empty; for example, a GUI will gray out the 'connect' button until the 
userid and password contain a non-empty value.  Having a second way to 
trigger Kerberos in FreeTDS, by virtue of a special userid and password, 
will avoid these issues.