5

I migrated from firebird 2.5.x to 3.0 i have changed firebird.conf :

WireCrypt = Enabled
AuthServer = Legacy_Auth, Srp, Win_Sspi

after that here you are what happened:

I can connect from Netbeans IDE using SYSDBA masterkey. I can connect from FlameRobin (database admin. tool) using SYSDBA with other password. I can not connect from Wild-Fly server using SYSDBA with that other password.

I am really wondering.!!

Mark Rotteveel
  • 82,132
  • 136
  • 114
  • 158
kamel2005
  • 419
  • 3
  • 12

1 Answers1

8

I assume you are using Jaybird 2.2.x (or earlier) when connecting from Netbeans and Wildfly. With Firebird 3 a new authentication model was introduced called SRP (Secure Remote Password). Jaybird 2.2.x doesn't support this new authentication model (support will be added in Jaybird 3.0), so you need to use the Legacy_Auth plugin.

Users have a separate identity per plugin, this means that you (can) have two users with the name SYSDBA, one for SRP and one for Legacy_Auth. These users have their own passwords.

So when you connect from Netbeans and Wildfly, you need to specify the password of the legacy authentication user. This password appears to be masterkey, or actually: masterke as legacy passwords are only 8 characters.

When you connect from flamerobin, you can use the 'other' password (of the SRP sysdba user) as flamerobin uses the Firebird 3 fbclient.dll/libfbclient.so and therefor supports the new SRP authentication model.

As far as I know flamerobin should also be able to authenticate with the password of the legacy sysdba user (when login fails, it should try the next plugin). I will test that tomorrow.

Mark Rotteveel
  • 82,132
  • 136
  • 114
  • 158
  • @kamel2005 I suspect the 'problem' with flamerobin might be due to the order of plugins. You have set `AuthServer` to try Legacy_Auth first, while the (default) for `AuthClient` is to try Srp first. I'll try that tomorrow. – Mark Rotteveel Apr 23 '16 at 20:14
  • is it important to set the same order both for client and server? – kamel2005 Apr 23 '16 at 20:58
  • @kamel2005 I commented earlier that it doesn't depend on order, but it does; I'm not exactly sure which combination allows or disallows it. It seems a bit fishy. – Mark Rotteveel Apr 24 '16 at 08:22
  • @kamel2005 It seems to be a combination of order that plugins are tried, and that the first plugin for which the username is known will reject and end the authentication if the password is wrong. I still think it is a bug, and I have asked the Firebird core developers for clarification. – Mark Rotteveel Apr 24 '16 at 08:57