freetds AT lists.ibiblio.org
Subject: FreeTDS Development Group
List archive
- From: Frediano Ziglio <freddy77 AT gmail.com>
- To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
- Subject: Re: [freetds] Windows authentication on Windows
- Date: Fri, 29 Jan 2010 20:36:21 +0100
2010/1/26 <jklowden AT schemamania.org>:
> On Tue, Jan 26, 2010 at 02:53:51PM +0100, Frediano Ziglio wrote:
>> 2010/1/26 James K. Lowden <jklowden AT freetds.org>:
>> > Mark Brand wrote:
>> >> I would like to avoid specifying the password when making the
>> >> connection. I am using FreeTDS cross-compiled in mingw-cross-env.
>> >> http://www.nongnu.org/mingw-cross-env/
>> >
>> > The only such API call in NTWDBLIB.DLL is one of the SSPI functions:
>> > InitSecurityInterface(). It returns a dispatch table to the rest of the
>> > SSPI functions, so that would seem to be what they're doing. From the
>> > docs, it looks like InitializeSecurityContext(),
>> > AcquireCredentialsHandle(), and EncryptMessage() are what we need.
>>
>> I committed an initial patch for SSPI support... quite limited:
>> - currently supported using MingW cross compiler
>> - use only NTLM, no SPNEGO or Kerberos
>> - does not take into account username/password (so using any
>> domain\user and a password will use your current account)
>> - have some possible leak (dll initilization is not thread safe)
>> Attached patch for review.
>>
>> I uploaded a dll cross compiled at http://freetds.sf.net/odbc.zip. I
>> also applyed a fake ole registration extension to dll so you can
>> "register" odbc driver using regsvr32 executable. Just copy the dll
>> somewhere and execute
>
> Excellent! Absolutely amazingly jaw-dropping awesome!
>
> I modified Nmakefile to build tds.lib with sspi.c (and to generate
> header files). It works!
>
> $ echo select @@version | src\apps\win32\debug\bsqldb.exe -S %S% -U "" -P ""
>
> -----------------------------------------------------------------------------------
> Microsoft SQL Server 2005 - 9.00.3282.00 (X64)
> Aug 5 2008 00:48:00
> Copyright (c) 1988-2005 Microsoft Corporation
> Enterprise Edition (64-bit) on Windows NT 5.2 (Build 3790: Service
> Pack 2)
>
> $ cl -? 2>&1 | grep Version
> Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 14.00.50727.762 for
> 80x86
>
> Did I mention how excellent this is? The FreeTDS community owes you a
> big smooch.
>
Sometimes is strange how a thing that is easy for a person could be so
appreciated!
Well... some updates and some reminds. I think sspi code could be
considered completed:
- James tested code and compile under Windows correctly;
- using Negotiate and SPN Kerberos now works correctly using SSPI;
- you can provide domain\username and password to use another user;
- I implemented mutexes under Windows and now dll initialization is thread
safe.
As a reminds Kerberos support works since 2007 with empty username and
password (and obviously a correct kerberos setting with a correct
ticket!). Perhaps we could remove username/password from tsql or other
tools but perhaps is better to add an explicit option (-I like
"integrated security" or -T as trusted)... there are already
proprietary libraries for Windows and FreeTDS is largely used under
Unix where kerberos is not so easy to set up.
freddy77
-
[freetds] Windows authentication on Windows,
Mark Brand, 01/25/2010
-
Re: [freetds] Windows authentication on Windows,
James K. Lowden, 01/25/2010
-
Re: [freetds] Windows authentication on Windows,
Frediano Ziglio, 01/26/2010
-
Re: [freetds] Windows authentication on Windows,
jklowden, 01/26/2010
-
Re: [freetds] Windows authentication on Windows,
Mark Brand, 01/27/2010
- Re: [freetds] Windows authentication on Windows, James K. Lowden, 01/28/2010
-
Re: [freetds] Windows authentication on Windows,
Frediano Ziglio, 01/29/2010
- Re: [freetds] Windows authentication on Windows, James K. Lowden, 01/30/2010
-
Re: [freetds] Windows authentication on Windows,
Mark Brand, 01/27/2010
-
Re: [freetds] Windows authentication on Windows,
jklowden, 01/26/2010
-
Re: [freetds] Windows authentication on Windows,
Frediano Ziglio, 01/26/2010
-
Re: [freetds] Windows authentication on Windows,
James K. Lowden, 01/25/2010
Archive powered by MHonArc 2.6.24.