JezK
Edit File: kerberos.html
<?xml version="1.0" encoding="UTF-8" standalone="no"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><title>Kerberos Support</title><link rel="stylesheet" type="text/css" href="userguide.css" /><meta name="generator" content="DocBook XSL Stylesheets Vsnapshot" /><link rel="home" href="index.html" title="FreeTDS User Guide" /><link rel="up" href="configs.html" title="Chapter 5. Advanced Configurations" /><link rel="prev" href="domains.html" title="Domain Logins" /><link rel="next" href="uothread.html" title="Threading in unixODBC" /></head><body><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Kerberos Support</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="domains.html">Prev</a> </td><th width="60%" align="center">Chapter 5. Advanced Configurations</th><td width="20%" align="right"> <a accesskey="n" href="uothread.html">Next</a></td></tr></table><hr /></div><div class="sect1"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a id="kerberos"></a>Kerberos Support</h2></div></div></div><p>Perhaps surprisingly, Kerberos can be used to authenticate to Microsoft SQL Servers. <a href="#ftn.idm2533" class="footnote" id="idm2533"><sup class="footnote">[21]</sup></a> This affords single-signon (or, at most, <span class="quote">“<span class="quote">double-signon</span>”</span>) capability in non-Windows environment. </p><p>To take advantage of Kerberos you have to set up your machine with keytab <a href="#ftn.idm2538" class="footnote" id="idm2538"><sup class="footnote">[22]</sup></a> from your Active Directory. You could use <a class="ulink" href="http://www.samba.org/" target="_top">Samba</a> or configure Kerberos directly (<code class="filename">/etc/krb5.conf</code>). <span class="command"><strong>configure</strong></span> includes options to define the location of your Kerberos installation (cf. <a class="xref" href="config.html#Configure.Options" title="configure options">Options to configure</a>). </p><p>By default UNIX does not initialize a Kerberos ticket with your login account. You must use <span class="command"><strong>kinit</strong></span> to initialize a ticket. You could also configure Kerberos in PAM to initialize a Kerberos ticket at login time.</p><div class="footnotes"><br /><hr style="width:100; text-align:left;margin-left: 0" /><div id="ftn.idm2533" class="footnote"><p><a href="#idm2533" class="para"><sup class="para">[21] </sup></a>It works because much of Active Directory is based on Kerberos. <span class="emphasis"><em>From each according to his ability; to each according to his needs. </em></span></p></div><div id="ftn.idm2538" class="footnote"><p><a href="#idm2538" class="para"><sup class="para">[22] </sup></a>No, the author does not really know what he's talking about.</p></div></div></div><div class="navfooter"><hr /><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="domains.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="configs.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="uothread.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Domain Logins </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Threading in unixODBC</td></tr></table></div></body></html>