Re: Windows authentication on Windows

2010/1/26 James K. Lowden <[email protected]>:
> Mark Brand wrote:
>> I would like to avoid specifying the password when making the
>> connection. I am using FreeTDS cross-compiled in mingw-cross-env.
>> http://www.nongnu.org/mingw-cross-env/
>
> The feature does not exist in FreeTDS.  You're not alone in asking for it,
> though.  I myself would like that to work, so we'd have a working 64-bit
> db-lib implementation.
>> I've read a few things on this subject, for example that it might be
>> possible to use samba to authenticate from a non-Windows host. But I'm
>> thinking there might be an easier way if we are running on Windows.
>
> Samba won't help us here.  In fact we had to write our own domain login
> code because as an LGPL project we couldn't use samba's GPL code.
>
> The best thing I found was
>
> http://blogs.msdn.com/sql_protocols/archive/2006/12/02/understanding-kerberos-and-ntlm-authentication-in-sql-server-connections.aspx
>
> also
>
> http://blogs.msdn.com/sql_protocols/archive/2005/10/12/479871.aspx
> http://support.microsoft.com/kb/811889
>
> According to Mr. Lu, in NTLM:
>
> 1.  client sends the user name to the server
> 2.  server generates and sends a challenge to the client
> 3.  client encrypts that challenge using the user's password
> 4.  client sends a response to the server.
>
> The hard part has always been #3 because it had to be (and has been)
> reverse engineered.  As you say, it would be nice to use the Win32 API to
> do that when its available because we wouldn't need the password.
>
> I'm interested in NTLM because that's what FreeTDS uses on my servers at
> work.  (select auth_scheme from sys.dm_exec_connections where
> session_id=@@spid yields "NTLM".)
>
> The only such API call in NTWDBLIB.DLL is one of the SSPI functions:
> InitSecurityInterface().  It returns a dispatch table to the rest of the
> SSPI functions, so that would seem to be what they're doing.  From the
> docs, it looks like InitializeSecurityContext(),
> AcquireCredentialsHandle(), and EncryptMessage() are what we need.
>
> Want to take a stab at this?  It would be a great feature for the next
> release.
>

I committed an initial patch for SSPI support... quite limited:
- currently supported using MingW cross compiler
- use only NTLM, no SPNEGO or Kerberos
- does not take into account username/password (so using any
domain\user and a password will use your current account)
- have some possible leak (dll initilization is not thread safe)
Attached patch for review.

I uploaded a dll cross compiled at http://freetds.sf.net/odbc.zip. I
also applyed a fake ole registration extension to dll so you can
"register" odbc driver using regsvr32 executable. Just copy the dll
somewhere and execute

regsvr32 libtdsodbc-0.dll

freddy77

_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds