Summary
Add Windows integrated authentication (Kerberos / GSSAPI) as an option for the Linux SQL Server driver, so users can connect with their current Kerberos ticket (from kinit) instead of a SQL Server login.
Motivation
Many SQL Server deployments only permit Windows authentication. On Linux that means Kerberos: the user runs kinit user@REALM and the client authenticates to SQL Server with the ambient ticket. The MSSQL driver currently supports only SQL logins (username/password).
Proposal
core: AuthMode { Password, Kerberos } on ConnectOptions; DatabaseDriver::supports_integrated_auth() capability (default false).drivers/mssql: enable tiberius integrated-auth-gssapi; use AuthMethod::Integrated for Kerberos (ambient credential cache; SPN MSSQLSvc/<host>:<port>).storage: persist the auth mode (legacy files default to Password).app: a "Method" selector in the connect dialog, shown only for integrated-capable drivers; Kerberos hides the username/password rows.
Known upstream-crate limitations (with workarounds)
- Cross-realm — tiberius imports the SPN as a raw Kerberos principal, so it resolves in the client's default realm. For a SQL Server in a different realm, set
default_realm (and [capaths] / [domain_realm]) so MSSQLSvc/<host>:<port> maps to the service realm. Proper fix: host-based SPN (GSS_C_NT_HOSTBASED_SERVICE) upstream in tiberius.
- Debug builds abort — libgssapi 0.4.6 wraps GSSAPI's empty final-step token via
slice::from_raw_parts(null, 0), which trips Rust's UB precondition check and aborts — in debug builds only. Use a release build (debug-assertions off). Proper fix: null-guard upstream in libgssapi (0.4.6 is the latest ^0.4.5).
Acceptance
- Connect dialog offers Windows (Kerberos) for SQL Server; selecting it authenticates with the ambient ticket.
- Verified against a real (cross-realm) AD-joined SQL Server.
cargo build / clippy / fmt / unit tests green; existing SQL-auth integration tests unaffected.
Summary
Add Windows integrated authentication (Kerberos / GSSAPI) as an option for the Linux SQL Server driver, so users can connect with their current Kerberos ticket (from
kinit) instead of a SQL Server login.Motivation
Many SQL Server deployments only permit Windows authentication. On Linux that means Kerberos: the user runs
kinit user@REALMand the client authenticates to SQL Server with the ambient ticket. The MSSQL driver currently supports only SQL logins (username/password).Proposal
core:AuthMode { Password, Kerberos }onConnectOptions;DatabaseDriver::supports_integrated_auth()capability (defaultfalse).drivers/mssql: enable tiberiusintegrated-auth-gssapi; useAuthMethod::Integratedfor Kerberos (ambient credential cache; SPNMSSQLSvc/<host>:<port>).storage: persist the auth mode (legacy files default toPassword).app: a "Method" selector in the connect dialog, shown only for integrated-capable drivers; Kerberos hides the username/password rows.Known upstream-crate limitations (with workarounds)
default_realm(and[capaths]/[domain_realm]) soMSSQLSvc/<host>:<port>maps to the service realm. Proper fix: host-based SPN (GSS_C_NT_HOSTBASED_SERVICE) upstream in tiberius.slice::from_raw_parts(null, 0), which trips Rust's UB precondition check and aborts — in debug builds only. Use a release build (debug-assertions off). Proper fix: null-guard upstream in libgssapi (0.4.6 is the latest^0.4.5).Acceptance
cargo build/clippy/fmt/ unit tests green; existing SQL-auth integration tests unaffected.