Re: mission: emulate "trusted login"

2009/2/3 James K. Lowden <[email protected]>:
> I would like FreeTDS to be able to run on Win64 in just the way
> NTWDBLIB.DLL runs in Win32.
>
> The biggest missing component is "trusted login", whereby the user does
> not provide his username and password.  Instead, cached credentials are
> retrieved from the operating system.   Adding that feature to FreeTDS will
> give us a bone-for-bone Microsoft-compatible Win64 DB-Library.
>
> Question: how to retrieve said credentials via the Win32 API?
>
> Windows surely doesn't store the user's password verbatim, but rather
> keeps the hashed/salted/whatever version of it.  Part of FreeTDS's current
> functionality is to turn a raw password in to a [something] and then pass
> that to the server.  I want to pass the same [something], but starting
> from whatever I can get from Win32, not the password itself.
>
> If someone could point me to the right API function, I would consider it a
> service, with gratitude.  Google terms also gladly accepted.  If you could
> tell me what I mean by [something], that would also be helpful.
>
> I found getSchannelClientHandle().  Is that in the right neighborhood?
>
> Many thanks.
>

Mmm... good. Personally I would check some OS software. I think curl
and firefox implements SSPI but you can find code in many places.
About FreeTDS all stuff is quite ready, see kerberos changes, in
particular login.c:

        /* check ntlm */
        if (strchr(user_name, '\\') != NULL) {
                tds->authentication = tds_ntlm_get_auth(tds);
                if (!tds->authentication)
                        return TDS_FAIL;
                auth_len = tds->authentication->packet_len;
                packet_size += auth_len;
        } else if (user_name_len == 0) {
#ifdef ENABLE_KRB5
                /* try kerberos */
                tds->authentication = tds_gss_get_auth(tds);
                if (!tds->authentication)
                        return TDS_FAIL;
                auth_len = tds->authentication->packet_len;
                packet_size += auth_len;
#else
                return TDS_FAIL;
#endif
        } else
                packet_size += (user_name_len + password_len) * 2;

and gssapi.c. In this case you would replace kerberos stuff with SSPI.

OT: Well... looking at the code... what kind of bad code, too
replicated lines... well... perhaps it would be better to define a new
authentication even for username/password...

freddy77