FreeTDS Development Group

[Samuel Bayer <sam AT mitre.org>]

Peter C. Norton wrote:

> [I'm far from an expert, so apologies in advance if I'm mis-reading
> your environment and the errors - we don't use NTLM with SQL Server]
>
> Are you sure that you're negotiating NTLM and not kerberos in this
> case?  I always thought that the "trusted domain" vs. "untrusted
> domain" indicated AD/krb5 auth.  I also thought that "windows
> authentication" indicated the same.
>
> We've noticed that SQL Server 2008 can be persnickity with various
> forms of trust in general...  Can you try the same test against a
> win2k3 server to isolate that?

I'll check with my admins, but I'm virtually certain that this really is 
NTLMv2. As I said earlier, the jTDS JDBC connection works with the 
useNTLMv2 flag set, and I'm assuming that that code is correct. But I 
could be wrong.

Unfortunately, I don't believe I have access to a different version of 
SQL Server.

Does anyone know which of the precise cases described in Appendix C of 
http://davenport.sourceforge.net/ntlm.html my case corresponds to? I've 
been assuming it's either "NTLMv2 Authentication; NTLM1 Signing and 
Sealing Using the 40-bit NTLMv2 User Session Key" or "NTLMv2 
Authentication; NTLM2 Signing and Sealing Using the 56-bit NTLMv2 User 
Session Key", but all this NTLM2 vs NTLMv2 stuff is making my head swim 
a bit.

Thanks in advance -

Sam Bayer
The MITRE Corporation
sam AT mitre.org