FreeTDS Development Group

[Mike Slifcak <slif AT bellsouth.net>]

I'm running in a mixed Linux and Windows environment that has MIT KRB5 KDCs 
and Windows AD.
The Linux client and Windows server are members of different realms, with cross realm 
trust established between them.


Has anyone made FreeTDS' ct-lib work with DBD-Sybase driver
such that Linux client can use Kerberos auth
 to obtain a service ticket for the MSSQL service in another realm
and succeed with a connection to that server?

I've added 'enable gssapi negotiation = on' to the global section and each host secion in 
freetds.conf.  and DBI->trace(9) in Perl.
The best I can tell

log.c:196:Starting log file for FreeTDS 0.91.dev.20110804RC2
...
net.c:310:tds_open_socket() succeeded
...
net.c:741:Sending packet [52 octets]
...
net.c:609:Received packet [37 octets]

login.c:1057:detected flag 2
gssapi.c:207: kerberos name MSSQLSvc/host.example.com:1000
login.c:466:login packet rejected

I've tried a change at gssapi.c line 203 to include the server realm in the 
SPN,
but that made no improvement.

I suspect the client side isn't getting everything it needs from the KDC.

Any suggestions for configuring FreeTDS and for turning up diagnostics to see the gory 
details of the GSS negotiations?

Many thanks,
-Mike Slifcak