FreeTDS Development Group

["Peter C. Norton" <spacey-freetds.org AT ssr.com>]

On Tue, Nov 09, 2010 at 03:53:17PM -0500, Samuel Bayer wrote:
> Frediano Ziglio wrote:
> 
> >Added a "use ntlmv2" option to freetds.conf and a UseNTLMv2 odbc parameter.
> >Windows clients sends NTLMv2 only when this option is used in local
> >policy settings (which could be override by domain policies).
> 
> Thanks for your attention to this.
> 
> I checked out and built the CVS head, and configured my server in 
> freetds.conf as follows:
> 
> [<sname>]
>         tds version = 8.0
>         use ntlmv2 = yes
>         host = <host>
>         port = 1433
> 
> where <host> and <sname> are the appropriate sorts of things. I'm 
> failing with the same error I got before. I went so far as to compile 
> the freetds library with -g and break at src/tds/config.c, line 617, and 
> determined that this line WAS being reached and executed, and that 
> afterward the value of use_ntlmv2 in the connection is 1. So the setting 
> is being recognized and processed correctly; but my connection is 
> failing with the same error:
> 
> locale is "C"
> locale charset is "US-ASCII"
> using default charset "ISO-8859-1"
> Msg 18452 (severity 14, state 1) from <host> Line 1:
>       "Login failed. The login is from an untrusted domain and cannot be 
>       used with Windows authentication."
> Error 20002 (severity 9):
>       Adaptive Server connection failed
> There was a problem connecting to the server

[I'm far from an expert, so apologies in advance if I'm mis-reading
your environment and the errors - we don't use NTLM with SQL Server]

Are you sure that you're negotiating NTLM and not kerberos in this
case?  I always thought that the "trusted domain" vs. "untrusted
domain" indicated AD/krb5 auth.  I also thought that "windows
authentication" indicated the same.

We've noticed that SQL Server 2008 can be persnickity with various
forms of trust in general...  Can you try the same test against a
win2k3 server to isolate that?

-Peter