JezK
Edit File: domains.html
<?xml version="1.0" encoding="UTF-8" standalone="no"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Domain Logins</title><link rel="stylesheet" type="text/css" href="userguide.css" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="home" href="index.html" title="FreeTDS User Guide" /><link rel="up" href="configs.html" title="Chapter 5. Advanced Configurations" /><link rel="prev" href="Localization.html" title="Localization and TDS 7.0" /><link rel="next" href="kerberos.html" title="Kerberos Support" /></head><body><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Domain Logins</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="Localization.html">Prev</a> </td><th width="60%" align="center">Chapter 5. Advanced Configurations</th><td width="20%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr></table><hr /></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="domains"></a>Domain Logins</h2></div></div></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><table border="0" summary="Note"><tr><td rowspan="2" align="center" valign="top" width="25"><img alt="[Note]" src="../images/note.gif" /></td><th align="left">Note</th></tr><tr><td align="left" valign="top"><p>Domain logins can be used only with TDS protocol versions 7.0 or above.</p></td></tr></table></div><p>As mentioned in the installation chapter, <span class="productname">Microsoft SQL Server</span> includes the ability to use domain <a href="#ftn.idm2495" class="footnote" id="idm2495"><sup class="footnote">[20]</sup></a> logins instead of standard server logins. Passwords are encrypted on the wire using a challenge-response protocol. <span class="productname">FreeTDS</span> plays nice with such logins. </p><p><span class="productname">FreeTDS</span> supports single sign-on (connecting without prompting for a username & password) or not, depending on how it was configured. For Windows hosts (both 32- and 64-bit), if SSPI is enabled, <span class="productname">FreeTDS</span> will log in using so-called <span class="quote">“<span class="quote">trusted authentication</span>”</span>. For non-Windows hosts, enabling Kerberos provides similar functionality. </p><p>When neither option is enabled, <span class="productname">FreeTDS</span> can <span class="emphasis"><em>still</em></span> log in using the domain account, but the user must supply the username & password.</p><p>To use domain logins without SSPI or Kerberos, use the <code class="literal">'DOMAIN\username'</code> syntax for the username and use the domain password.</p><div class="example"><a id="e.g.domainlogin"></a><p class="title"><strong>Example 5.4. Logging in with a domain login</strong></p><div class="example-contents"><pre class="screen"> <code class="computeroutput">$ </code><strong class="userinput"><code>tsql -S camelot -U 'NOTTINGHAM\lancelot' -P roundtable</code></strong> locale is "C" locale charset is "646" Msg 5703, Level 0, State 1, Server CPRO200, Line 0 Changed language setting to middle_english. 1></pre></div></div><br class="example-break" /><p>When <span class="productname">FreeTDS</span> sees the <span class="quote">“<span class="quote"><code class="literal">\</code></span>”</span> character, it automatically chooses a domain login.</p><div class="sect2"><div class="titlepage"><div><div><h3 class="title"><a id="domaindetails"></a>Implementation details</h3></div></div></div><p>Support for domain logins in <span class="productname">FreeTDS</span> is limited to the TCP/IP network protocol stack. <span class="productname">FreeTDS</span> does not currently implement support for Named Pipe-based SQL connections — that is, connections transported over the DCE/RPC interface, which uses TCP port 139, 445, or 135 on Win32 machines depending on the type of encapsulation used for DCE/RPC itself. Supporting this would require a fairly extensive DCE/RPC library for Unix. <span class="productname">Samba</span> has one that is licensed under the GPL and therefore not usable by LGPL-licensed projects such as <span class="productname">FreeTDS</span> .</p><p>For a technical description of the protocol used for domain logins, see <a class="ulink" href="http://davenport.sourceforge.net/ntlm.html" target="_top">http://davenport.sourceforge.net/ntlm.html</a></p></div><div class="footnotes"><br /><hr style="width:100; text-align:left;margin-left: 0" /><div id="ftn.idm2495" class="footnote"><p><a href="#idm2495" class="para"><sup class="para">[20] </sup></a>The term <em class="firstterm">domain</em> in this context is a Microsoft term. It refers to what's sometimes called an <em class="firstterm">NT domain</em>. It's unrelated to the DNS domain. DNS domains are used for name resolution. NT domains are used for authentication. Authentication is done by the domain controller, often the <em class="firstterm">Primary Domain Controller</em> (PDC).</p><p>The Microsoft SQL Server machine may belong to an NT domain. <span class="productname">FreeTDS</span> provides an encrypted password — a domain password, known to the domain controller — that the server will ask the domain controller to verify.</p></div></div></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="Localization.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="configs.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="kerberos.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Localization and <acronym class="acronym">TDS</acronym> 7.0 </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Kerberos Support</td></tr></table></div></body></html>