FreeTDS Development Group

[Frediano Ziglio <freddy77 AT gmail.com>]

2010/6/23 Craig A. Berry <craigberry AT mac.com>:
>
> On Jun 21, 2010, at 8:01 AM, Frediano Ziglio wrote:
>
>> 2010/6/21 Cedric ROUVRAIS <cedric.rouvrais AT sgcib.com>:
>>>
>>> Hi all,
>>>
>>> I am seriously considering implementing NT auth for bcp and isql in
>>> order
>>> to provide trusted connectivity.
>>>
>>> Before I start has anyone done NT authen for linux or have good
>>> pointers? I
>>> really dislike re-inventing hotwater.
>>>
>>> Thank you very much,
>>>
>>> Cedric
>>
>> ?? well... it's already implemented... or perhaps we don't follow
>> same line...
>> What do you mean by "NT auth" ??
>
>
> Authentication and trusted connectivity are two different things.  A
> trusted connection implies using the results of a prior authentication
> in order to avoid re-authenticating.  A Windows client does this by
> passing along a Kerberos ticket that it stores after your initial
> logging in to the domain.
>

Kerberos or NTLM, depends from configurations.

> It's not clear to me how this would work on a non-Windows system.
> Even if you are using Active Directory for external authentication to
> log in to your system (and I don't think that's all that common in the
> Linux world) you're possibly using LDAP not Kerberos.
>
> So you would still have an authentication step and need to store that
> Kerberos ticket and then present it to SQL Server.  There's probably
> code in Samba that does something like that.  Probably Mozilla also.
> It may be that most Linux systems already have a Kerberos client and
> you'd just need to follow its documentation for fetching the ticket.
>

FreeTDS too :)

Current CVS supports also SSPI and Kerberos. SSPI (supported under
Windows) allow using current saved authentication (using internally
and automatically NTLM or Kerberos) while Kerberos provide this
feature even for Unix systems. At libTDS level provide empty username
and password and Kerberos/SSPI is used. I think the only thing we miss
is -T/whatever parameter in bcp/isql/whatever.

freddy77