feat(auth): SSPI/NTLM Windows authentication on Unix via sspi-rs - #17
Merged
Conversation
Add an optional `sspi-rs` feature that enables `AuthMethod::Windows` (and `AuthMethod::windows()`) on Unix platforms, implementing the NTLM handshake with the pure-Rust `sspi` crate. This provides Windows-style authentication without requiring a Kerberos/GSSAPI setup, closing the gap for Linux and macOS clients (#407, #276, #97). - Add `sspi` (unix target) dependency and `sspi-rs` feature; include it in the `all` feature set. - Gate `WindowsAuth`, the `AuthMethod::Windows` variant and the `windows()` constructor on `all(unix, feature = "sspi-rs")` in addition to the existing Windows `winauth` path. - Implement the two-leg NTLM negotiate/authenticate exchange in `Connection::login` for the Unix `sspi-rs` path, reusing the existing SSPI token flushing and `integrated_security` login plumbing. - Extend the connection-string parser so `IntegratedSecurity=SSPI` selects NTLM when a username/password is supplied and falls back to Kerberos (`Integrated`) only when `integrated-auth-gssapi` is enabled and no credentials are given. - Add an `Error::SspiRs` variant and `From<sspi::Error>` conversion. The existing Windows `winauth` and Unix `integrated-auth-gssapi` paths are left intact; the gssapi connection-string arm is only disabled when `sspi-rs` is active on Unix to avoid overlapping match arms.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrates the intent of upstream PR #408 onto the current
devbranch: SSPI/NTLM Windows authentication on Unix (Linux/macOS) without Kerberos, via the pure-Rustsspicrate. This lets Unix clients useAuthMethod::Windows/IntegratedSecurity=SSPIwith an explicit username/password, closing the gap that previously required a full GSSAPI/Kerberos setup (#407, #276, #97).Changes
sspi-rs(sspi-rs = ["sspi"]) withsspi = { version = "0.18", optional = true }under thecfg(unix)target; added to theallfeature so it is covered byclippy --features=alland docs.rs.AuthMethod:WindowsAuth, theWindowsvariant and thewindows()constructor are now available onall(unix, feature = "sspi-rs")in addition to the existing Windowswinauthpath.Connection::login: implements the two-leg NTLM negotiate/authenticate exchange for the Unixsspi-rspath, reusing the existing SSPI token flushing andintegrated_securitylogin plumbing (spn,TokenSspi,flush_sspi).IntegratedSecurity=SSPI(or a truthy value) now selects NTLM when a username/password is present, and falls back to Kerberos (Integrated) only whenintegrated-auth-gssapiis enabled and no credentials are given. The gssapi arm is disabled only whensspi-rsis active on Unix, avoiding overlapping match arms.Error::SspiRsandFrom<sspi::Error>.winauth, and Unixintegrated-auth-gssapipaths — no duplication or downgrades.Verification
cargo build(default) — okcargo build --features sspi-rs— okcargo clippy --features=all -- -D warnings— cleancargo test --lib— 235 pass; added a unit test for theIntegratedSecurity=SSPI+ credentials -> NTLM connection-string pathcargo fmt --check— cleanintegrated-auth-gssapi-only andsspi-rs-only builds — okDraft: the actual NTLM handshake against a server can only be validated against a live SQL Server instance accepting Windows/NTLM authentication, which is not available in CI here.