Skip to Content.
Sympa Menu

freetds - [freetds] asking for help with cross realm trust

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Mike Slifcak <slif AT bellsouth.net>
  • To: freetds AT lists.ibiblio.org
  • Subject: [freetds] asking for help with cross realm trust
  • Date: Thu, 11 Aug 2011 12:15:09 -0400

I'm running in a mixed Linux and Windows environment that has MIT KRB5 KDCs
and Windows AD.
The Linux client and Windows server are members of different realms, with cross realm trust established between them.


Has anyone made FreeTDS' ct-lib work with DBD-Sybase driver
such that Linux client can use Kerberos auth
to obtain a service ticket for the MSSQL service in another realm
and succeed with a connection to that server?

I've added 'enable gssapi negotiation = on' to the global section and each host secion in freetds.conf. and DBI->trace(9) in Perl.
The best I can tell

log.c:196:Starting log file for FreeTDS 0.91.dev.20110804RC2
...
net.c:310:tds_open_socket() succeeded
...
net.c:741:Sending packet [52 octets]
...
net.c:609:Received packet [37 octets]

login.c:1057:detected flag 2
gssapi.c:207: kerberos name MSSQLSvc/host.example.com:1000
login.c:466:login packet rejected

I've tried a change at gssapi.c line 203 to include the server realm in the
SPN,
but that made no improvement.

I suspect the client side isn't getting everything it needs from the KDC.

Any suggestions for configuring FreeTDS and for turning up diagnostics to see the gory details of the GSS negotiations?

Many thanks,
-Mike Slifcak



  • [freetds] asking for help with cross realm trust, Mike Slifcak, 08/11/2011

Archive powered by MHonArc 2.6.24.

Top of Page