Re: server realm configuration for ODBC

2012/3/2 Mike Slifcak <[email protected]>:
> Pointers to all-java solutions supporting cross-realm trust are welcomed.
>
> You are right - getting the ticket requires the client or 'the environment' to forward the
> request to the correct KDC or Active Directory Domain controller.
>
> What used to happen before 0.91?
>
>    Client formed request using gss_import_name
>        MSSQLSvc/host:port@current-realm  [the realm of the CLIENT was assumed]
>
> After 0.91, using the setting for realm {Example:   realm = FOO.EXAMPLE.COM]
>
>    Client formed request using gss_import_name
>        MSSQLSvc/host:[email protected] [the realm setting configured for the host]
>
> The patch that I provided pre-0.91 suggested config changes for ODBC too.  Freddie and I
> just didn't finish the agreement on what to call the param nor where to put it for ODBC in
> time for the release.
> -Slif
>
>
> James K. Lowden wrote:
>> Hi Mike,
>>
>>> There is interest in adapting Java/JDBC to use FreeTDS' ODBC driver.
>>
>> No objection here, of course, but would you mind explaining why?  I
>> would have thought all-java would be preferred.
>>
>>> How can the FreeTDS ODBC driver include the realm so that Kerberos
>>> authentication between realms with transitive trust will work using
>>> FreeTDS' ODBC driver?
>>
>> In case it helps, tsql, bsqldb, and bsqlodbc all work just fine with
>> Kerberos.  I used bsqldb routinely that way until recently.
>>
>> But I might be missing something.  AIUI transitive trust is a property
>> of the ticket, not the connection.  Do those utilities not work in your
>> environment and, if so, is it a matter of how they use the API, or of
>> how your environment is set up?
>>

As usual is in my patches...
The main issue is that MS parameter (ServerSPN) is different cause it
replace the entire SPN, not only add the realm.

James, I think that we should bump the version to 0.91.1 to add an
addition odbc parameter. What do you think?

Frediano
_______________________________________________
FreeTDS mailing list
[email protected]
http://lists.ibiblio.org/mailman/listinfo/freetds