Skip to content

feat(drivers): Windows integrated (Kerberos) auth for SQL Server (#1961) - #1962

Open
Seha16 wants to merge 4 commits into
TableProApp:linuxfrom
Seha16:feat/linux-mssql-kerberos
Open

feat(drivers): Windows integrated (Kerberos) auth for SQL Server (#1961)#1962
Seha16 wants to merge 4 commits into
TableProApp:linuxfrom
Seha16:feat/linux-mssql-kerberos

Conversation

@Seha16

@Seha16 Seha16 commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

Summary

Adds Windows integrated authentication (Kerberos / GSSAPI) to the Linux SQL Server driver — connect with your kinit ticket instead of a SQL login. Fixes #1961.

  • core: AuthMode { Password, Kerberos } + ConnectOptions.auth_mode; DatabaseDriver::supports_integrated_auth() (default false).
  • drivers/mssql: tiberius integrated-auth-gssapi feature; connect() uses AuthMethod::Integrated for Kerberos (ambient credential cache, SPN MSSQLSvc/<host>:<port>).
  • storage: SavedConnection.auth_mode persisted (legacy files default to Password).
  • app: connect-dialog "Method" selector, shown only for integrated-capable drivers; Kerberos hides username/password; validity / label / dedup updated.
  • CI + README: libkrb5-dev and clang (libgssapi-sys links gssapi_krb5 and runs bindgen).

Depends on #1958

This branch is stacked on the SQL Server driver PR (#1958). Until that merges, this PR's diff also contains #1958's commit (feat(drivers): add SQL Server driver via tiberius). Please review/merge after #1958 — the diff then reduces to the single Kerberos commit.

Test plan

  • cargo build --workspace; cargo test --workspace --lib (core + storage auth_mode round-trip/legacy default; mssql supports_integrated_auth)
  • cargo fmt --all -- --check; cargo clippy --all-targets -- -D warnings
  • No regression: mssql integration 4/4 vs. real SQL Server 2022 (SQL auth)
  • UI: connect dialog shows Method = Windows (Kerberos) for SQL Server, credential rows hidden
  • Live Kerberos connection verified against a real cross-realm AD SQL Server (client realm ≠ service realm, cross-realm trust)

Known upstream-crate limitations (with workarounds)

  1. Cross-realm SPN realm — tiberius imports the SPN as a raw Kerberos principal, so it resolves in the client's default realm. For a service in another realm, set default_realm (+ [capaths] / [domain_realm]) so MSSQLSvc/<host>:<port> maps to the service realm. Proper fix: host-based SPN (GSS_C_NT_HOSTBASED_SERVICE) upstream in tiberius.
  2. Debug builds abort — libgssapi 0.4.6 wraps GSSAPI's empty final-step token via slice::from_raw_parts(null, 0), tripping Rust's UB precondition check (debug only). Run a release build (debug-assertions off) for Kerberos. Proper fix: null-guard upstream in libgssapi (0.4.6 is the latest ^0.4.5).

Neither limitation affects CI (build + unit tests; no live handshake) or the SQL-login path.

@Seha16

Seha16 commented Jul 25, 2026

Copy link
Copy Markdown
Contributor Author

Testing evidence on Arch Linux Kernel 7.1.5 with krb5 (Kerberos) with default_realm patched to the needed one:

kerberos-testing.mp4

@datlechin

datlechin commented Jul 25, 2026

Copy link
Copy Markdown
Member

Pushed fefd543 with fixes for the review findings. All of it is verified locally with the exact CI commands (cargo fmt --all -- --check, cargo clippy --all-targets -- -D warnings, cargo build --workspace, cargo test --workspace --lib --bins) plus a --no-default-features pass, except the flatpak item called out at the bottom.

Kerberos through an SSH tunnel was asking for the wrong SPN

establish() rewrites opts.host/opts.port to the tunnel's local forward before driver.connect(), and tiberius builds both the SPN and the TLS server name from Config::host/port. A tunnelled connection was asking the KDC for MSSQLSvc/127.0.0.1:<ephemeral>.

The socket and the service name are now separate: ConnectOptions::service_endpoint records the endpoint the tunnel replaced, service_address() returns it, and the driver configures tiberius from that while opening the socket against opts.host. The tuple form of TcpStream::connect also handles IPv6 literals, which config.get_addr()'s host:port string did not.

Kerberos was writing a password into the keyring

run_connect called store_password unconditionally, and AdwPasswordEntryRow keeps its text after the row is hidden. Type a password, switch to Kerberos, connect, and that credential landed in libsecret against a connection that never uses it. The credential rows are now emptied at collection time under Kerberos, the store is skipped, and open_saved no longer reads the keyring back for a Kerberos entry.

Auth mode no longer lives in widget visibility

selected_auth_mode() read auth_combo.is_visible(), and refresh_auth_visibility() called back into it, so state flowed through GTK flags and back. There is now an AuthFormState { file_based, supports_integrated, kerberos_selected } on the model with mode() / shows_method() / shows_credentials(), and the widgets are driven from it. Five unit tests cover the combinations, including a stale Kerberos selection surviving a driver switch and file-based drivers asking for nothing.

That also fixes two things the visibility coupling had introduced:

  • DriverChanged never called refresh_validity(). With SQL Server + Kerberos the form was valid with an empty username; switching back to PostgreSQL brought the username row back but left Connect enabled.
  • Dropping the file_based visibility lines meant refresh_validity() put the .error class on a hidden username row for SQLite.

Kerberos is a cargo feature now

integrated-auth-gssapi was on the workspace tiberius dependency, so libkrb5-dev and libclang were mandatory for anyone building the workspace. It moved to tablepro-driver-mssql's kerberos feature, default on, so --no-default-features drops both. supports_integrated_auth() is cfg!(feature = "kerberos") so the UI never offers a mode the binary cannot perform, and a Kerberos request in a build without it returns the new DriverError::Unsupported instead of silently doing a SQL login. CI checks that configuration so it does not rot.

Debug builds no longer abort

[profile.dev.package.libgssapi]
debug-assertions = false

The UB precondition check is emitted per crate, so turning it off for that one package makes cargo run usable for Kerberos without weakening the check anywhere else. Worth dropping once the null guard lands upstream.

Also

  • cargo test --workspace --lib was skipping the app crate entirely, since tablepro-app has no lib target. 97 existing tests had never run in CI. The step is --lib --bins now; all 97 pass headless.
  • README documents kinit, the SPN, the cross-realm krb5.conf setup, and the no-Kerberos build. Those limitations only existed in the PR description before.
  • AuthMode::Kerberos's doc said drivers without support "fall back to password auth". None did; the driver now rejects it, and the doc says so.
  • The connection label keys off auth_mode rather than an empty username.

Two things I did not do

The flatpak manifest is unverified. org.gnome.Sdk 47 ships gcc, not clang, and bindgen needs libclang, so I added the llvm18 extension with LIBCLANG_PATH. I could not run flatpak-builder from here, and nothing in CI builds the flatpak. Whether the freedesktop 24.08 SDK carries krb5 headers also needs a real build to confirm. Please run it once before merging.

po/tablepro.pot is untouched. "Method" and "Windows (Kerberos)" are still unextractable, but POTFILES.in already lists ui/app.rs, ui/edit_dialog.rs, and ui/insert_dialog.rs, none of which exist any more, so xtr cannot run at all. That predates this PR and fixing it properly is its own change.

Cargo.lock is unchanged: kerberos is default-on, so resolution is identical.

@Seha16
Seha16 force-pushed the feat/linux-mssql-kerberos branch from fefd543 to c055475 Compare July 26, 2026 16:49
@Seha16

Seha16 commented Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Testing evidence on Arch Linux Kernel 7.1.4 after rebasing onto the main branch

screenrecording-2026-07-27_14-51-18.mp4

@Seha16
fix(linux): pin tiberius to its fixed main so Kerberos logins don't a…
8fcca0c 
…bort debug builds

tiberius 0.12.3 (its latest release) pins libgssapi ^0.4.5. On a
successful GSSAPI handshake the KDC returns an empty final token
(value=NULL, length=0), and libgssapi 0.4.6's `Buf::deref` calls
`slice::from_raw_parts(NULL, 0)` -- undefined behavior that trips the
standard library's precondition check and aborts (SIGABRT) at
util.rs:237. Every Kerberos login therefore crashes under a debug build
(`cargo run`); the previously committed per-package
`debug-assertions = false` override did not reliably suppress it and
left the UB in place regardless.

tiberius already fixed this on `main` (merged PR prisma/tiberius#372:
bump libgssapi 0.4.5 -> 0.8.x, whose deref guards the null/empty case),
but has not cut a release; the bug is tracked open as
prisma/tiberius#343. Pin the fixed commit
(a6b4fcdae0de5702427290b89f8d05bc51f3bcfa) via [patch.crates-io] so
libgssapi resolves to the guarded 0.8.3. Drop this patch and bump the
`tiberius` version once a release ships.

No TablePro code changes -- the mssql driver builds unchanged.
@Seha16
Seha16 force-pushed the feat/linux-mssql-kerberos branch from edcbf97 to 8fcca0c Compare July 27, 2026 15:58
@Seha16
refactor(linux): always compile Kerberos in and trim the auth plumbing
d97f500 
Kerberos login is unchanged for users: the connect dialog still offers
Method -> Password / Windows (Kerberos), and AuthMode::Kerberos still
maps to tiberius AuthMethod::Integrated. What goes away is the opt-out
around it.

The mssql `kerberos` cargo feature existed so a packager without MIT
Kerberos could drop it, but ADR 0001 statically links every driver into
one binary, so there is no unit to swap and no packager to serve. The
tiberius `integrated-auth-gssapi` feature moves to the workspace dep and
the opt-out's whole tail goes with the feature: DriverError::Unsupported
and its UI string, the authentication_for indirection, the extra CI job,
and the build-without-Kerberos README block.

Alongside it, the rest of the branch's over-engineering:

- ServiceEndpoint (one construction site) becomes Option<(String, u16)>,
  service_address() a single map_or.
- collect_options() derives blanked credentials from shows_credentials()
  instead of re-deriving the mode per field, so the two cannot drift.
- selected_auth_mode() dropped; callers use form.mode().
- Eight assertion-per-test cases collapse into one table test each for
  AuthFormState and service_address; the tests asserting #[derive(Default)]
  and re-testing serde round-trip are gone, the legacy-file default
  (real data-loss risk) stays.
- Comments that restated the line under them, or duplicated another
  file's comment, removed.

Verified: cargo fmt --check, clippy -D warnings, 279 unit tests, full
workspace link (gssapi_krb5 now links unconditionally), app launches.
A scratch test confirmed AuthMode::Kerberos reaches the socket and
fails with ConnectionRefused rather than being compiled out.
@Seha16

Seha16 commented Jul 28, 2026

Copy link
Copy Markdown
Contributor Author

Testing evidence after refactoring of Kerberos/Windows Auth

screenrecording-2026-07-28_12-25-32.mp4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Seha16 @datlechin