Re: Windows authentication on Windows

2010/1/26  <[email protected]>:
> On Tue, Jan 26, 2010 at 02:53:51PM +0100, Frediano Ziglio wrote:
>> 2010/1/26 James K. Lowden <[email protected]>:
>> > Mark Brand wrote:
>> >> I would like to avoid specifying the password when making the
>> >> connection. I am using FreeTDS cross-compiled in mingw-cross-env.
>> >> http://www.nongnu.org/mingw-cross-env/
>> >
>> > The only such API call in NTWDBLIB.DLL is one of the SSPI functions:
>> > InitSecurityInterface(). It returns a dispatch table to the rest of the
>> > SSPI functions, so that would seem to be what they're doing. From the
>> > docs, it looks like InitializeSecurityContext(),
>> > AcquireCredentialsHandle(), and EncryptMessage() are what we need.
>>
>> I committed an initial patch for SSPI support... quite limited:
>> - currently supported using MingW cross compiler
>> - use only NTLM, no SPNEGO or Kerberos
>> - does not take into account username/password (so using any
>> domain\user and a password will use your current account)
>> - have some possible leak (dll initilization is not thread safe)
>> Attached patch for review.
>>
>> I uploaded a dll cross compiled at http://freetds.sf.net/odbc.zip. I
>> also applyed a fake ole registration extension to dll so you can
>> "register" odbc driver using regsvr32 executable. Just copy the dll
>> somewhere and execute
>
> Excellent!  Absolutely amazingly jaw-dropping awesome!
>
> I modified Nmakefile to build tds.lib with sspi.c (and to generate
> header files).  It works!
>
> $ echo select @@version | src\apps\win32\debug\bsqldb.exe -S %S% -U "" -P ""
>
> -----------------------------------------------------------------------------------
> Microsoft SQL Server 2005 - 9.00.3282.00 (X64)
>        Aug  5 2008 00:48:00
>        Copyright (c) 1988-2005 Microsoft Corporation
>        Enterprise Edition (64-bit) on Windows NT 5.2 (Build 3790: Service Pack 2)
>
> $ cl -? 2>&1 | grep Version
> Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 14.00.50727.762 for 80x86
>
> Did I mention how excellent this is?  The FreeTDS community owes you a
> big smooch.
>

Sometimes is strange how a thing that is easy for a person could be so
appreciated!

Well... some updates and some reminds. I think sspi code could be
considered completed:
- James tested code and compile under Windows correctly;
- using Negotiate and SPN Kerberos now works correctly using SSPI;
- you can provide domain\username and password to use another user;
- I implemented mutexes under Windows and now dll initialization is thread safe.

As a reminds Kerberos support works since 2007 with empty username and
password (and obviously a correct kerberos setting with a correct
ticket!). Perhaps we could remove username/password from tsql or other
tools but perhaps is better to add an explicit option (-I like
"integrated security" or -T as trusted)... there are already
proprietary libraries for Windows and FreeTDS is largely used under
Unix where kerberos is not so easy to set up.

freddy77
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds