Re: SSPI, NTLM & (Heimdal) Kerberos

2015-05-12 0:31 GMT+01:00 Sergio NNX <[email protected]>:
> Hi guys,
>
> A dumb question: is there any particular reason why the following combinations aren't allowed or possible:
>
>            * NTLM + Kerberos
>            * SSPI    + Kerberos
>
> Does SSPI already include or support M$ Kerberos authentication? There are some cases where a Windows box may talk to a Linux box and interact with a Kerberos server (i.e. KDC server).
>
> Thanks.
>
> Sergio.


NTLM and Kerberos are two authentication protocols while SSPI is a
Windows API which provides authentication and has different providers
(NTLM and Kerberos for instance). The use of NTLM/Kerberos/SSPI in
FreeTDS is the same, access to a SQL Server machine. As Kerberos is
not supported in our library for Sybase and MSSQL is only Windows we
don't handle the case where a Windows machine wants to connect to a
Linux one.

About FreeTDS implementation to handle SSO (single sign on) we use
SSPI on Windows and NTLM (which we implement in our code) or a
Kerberos library (Heimdal or MIT usually) for Unix. Potentially we
could use exactly same code for Windows but if you use SSPI you can
use login credentials. See code in src/tds/login.c.

Frediano