FreeTDS Development Group

[Mike Slifcak <slif AT bellsouth.net>]

Pointers to all-java solutions supporting cross-realm trust are welcomed.

You are right - getting the ticket requires the client or 'the environment' to forward the 
request to the correct KDC or Active Directory Domain controller.

What used to happen before 0.91?

   Client formed request using gss_import_name
        MSSQLSvc/host:port@current-realm  [the realm of the CLIENT was 
assumed]

After 0.91, using the setting for realm {Example:   realm = FOO.EXAMPLE.COM]

   Client formed request using gss_import_name
        MSSQLSvc/host:port AT FOO.EXAMPLE.COM [the realm setting configured for 
the host]

The patch that I provided pre-0.91 suggested config changes for ODBC too.  Freddie and I 
just didn't finish the agreement on what to call the param nor where to put it for ODBC in 
time for the release.
-Slif


James K. Lowden wrote:
> Hi Mike, 
>
> > There is interest in adapting Java/JDBC to use FreeTDS' ODBC driver.
>
> No objection here, of course, but would you mind explaining why?  I
> would have thought all-java would be preferred.  
>
> > How can the FreeTDS ODBC driver include the realm so that Kerberos
> > authentication between realms with transitive trust will work using
> > FreeTDS' ODBC driver?
>
> In case it helps, tsql, bsqldb, and bsqlodbc all work just fine with
> Kerberos.  I used bsqldb routinely that way until recently.  
>
> But I might be missing something.  AIUI transitive trust is a property
> of the ticket, not the connection.  Do those utilities not work in your
> environment and, if so, is it a matter of how they use the API, or of
> how your environment is set up?  
>
> --jkl
> _______________________________________________
> FreeTDS mailing list
> FreeTDS AT lists.ibiblio.org
> http://lists.ibiblio.org/mailman/listinfo/freetds