feat(drivers): Windows integrated (Kerberos) auth for SQL Server (#1961)

.github/workflows/build-linux.yml

@@ -38,7 +38,10 @@ jobs:
         # ubuntu:25.10 is minimal — git for Swatinem/rust-cache key
         # generation, curl + ca-certificates for rust-toolchain's
         # rustup install, plus the GTK / libadwaita / sourceview /
-        # OpenSSL / libsecret -dev packages the workspace links.
+        # OpenSSL / libsecret -dev packages the workspace links, plus
+        # libkrb5-dev + clang for the MSSQL driver's integrated
+        # (Kerberos/GSSAPI) auth (libgssapi-sys links gssapi_krb5 and
+        # runs bindgen).
         # No sudo (container runs as root by default).
         run: |
           apt-get update
@@ -52,7 +55,9 @@ jobs:
             libadwaita-1-dev \
             libgtksourceview-5-dev \
             libssl-dev \
-            libsecret-1-dev
+            libsecret-1-dev \
+            libkrb5-dev \
+            clang
       - uses: dtolnay/rust-toolchain@1.93
         with:
           components: rustfmt, clippy
@@ -65,8 +70,10 @@ jobs:
         run: cargo clippy --all-targets -- -D warnings
       - name: Build
         run: cargo build --workspace
+      # --bins matters: tablepro-app has no lib target, so --lib alone
+      # skips every test in the app crate.
       - name: Unit tests
-        run: cargo test --workspace --lib
+        run: cargo test --workspace --lib --bins
 
   integration:
     name: Driver integration tests (docker)

linux/Cargo.toml

@@ -32,7 +32,9 @@ tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 clickhouse = { version = "0.15", default-features = false, features = ["rustls-tls"] }
 sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "tls-rustls", "chrono", "rust_decimal", "uuid", "json"] }
-tiberius = { version = "0.12", default-features = false, features = ["tds73", "rustls", "chrono", "rust_decimal"] }
+# `integrated-auth-gssapi` (Windows integrated auth) links MIT Kerberos
+# (libkrb5) and runs bindgen (libclang) at build time.
+tiberius = { version = "0.12", default-features = false, features = ["tds73", "rustls", "chrono", "rust_decimal", "integrated-auth-gssapi"] }
 chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
 rust_decimal = { version = "1", default-features = false, features = ["serde", "std"] }
 futures = "0.3"
@@ -51,3 +53,14 @@ relm4 = { version = "0.11", default-features = false, features = ["macros", "lib
 lto = "fat"
 codegen-units = 1
 strip = "symbols"
+
+# tiberius 0.12.3 (its latest release) pins libgssapi ^0.4.5. libgssapi 0.4.6's
+# `Buf::deref` calls `slice::from_raw_parts(NULL, 0)` on the empty token a
+# successful Kerberos handshake returns -- undefined behavior that aborts every
+# debug build (`cargo run`). tiberius already fixed this on `main` (merged PR
+# prisma/tiberius#372: bump libgssapi 0.4.5 -> 0.8.x, whose deref is guarded)
+# but has not cut a release; the bug is tracked open as prisma/tiberius#343.
+# Pin the fixed commit until a release lands, then drop this and bump the
+# `tiberius` version above to the release.
+[patch.crates-io]
+tiberius = { git = "https://github.com/prisma/tiberius", rev = "a6b4fcdae0de5702427290b89f8d05bc51f3bcfa" }

linux/README.md

@@ -33,13 +33,13 @@ System dependencies:
 
 ```bash
 # Ubuntu / Debian
-sudo apt install -y build-essential pkg-config libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev libssl-dev libsecret-1-dev
+sudo apt install -y build-essential pkg-config libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev libssl-dev libsecret-1-dev libkrb5-dev clang
 
 # Fedora
-sudo dnf install -y gcc pkg-config gtk4-devel libadwaita-devel gtksourceview5-devel openssl-devel libsecret-devel
+sudo dnf install -y gcc pkg-config gtk4-devel libadwaita-devel gtksourceview5-devel openssl-devel libsecret-devel krb5-devel clang
 
 # Arch
-sudo pacman -S --needed base-devel pkg-config gtk4 libadwaita gtksourceview5 openssl libsecret
+sudo pacman -S --needed base-devel pkg-config gtk4 libadwaita gtksourceview5 openssl libsecret krb5 clang
 ```
 
 Verify the right versions are present:
@@ -70,6 +70,39 @@ Driver smoke against a Postgres you already run, no Docker needed:
 
 Optional: if the system `-dev` packages above are missing, extract the package payloads under `../.local-deps/root/` (so headers land in `../.local-deps/root/usr/include`) and `source scripts/dev-env.sh` before cargo. Debian-family layouts only.
 
+`libkrb5-dev` and `clang` are there for the SQL Server driver's Windows
+integrated auth, which links MIT Kerberos and runs bindgen at build
+time.
+
+## SQL Server with Windows integrated auth
+
+Pick **Method → Windows (Kerberos)** in the connect dialog. There is no
+username or password to enter: the driver uses whatever ticket `klist`
+shows, so get one first.
+
+```bash
+kinit you@EXAMPLE.COM
+```
+
+The driver asks for `MSSQLSvc/<host>:<port>`, built from the host and
+port you typed, not from an SSH tunnel's local forward. Three things are
+worth knowing:
+
+- tiberius imports that SPN as a raw Kerberos principal, so it picks up
+  `default_realm` from `/etc/krb5.conf` and nothing else. `[domain_realm]`
+  does not apply: that lookup only runs for host-based service names, and
+  tiberius exposes no SPN override. A server in another realm works only
+  when your KDC answers with a referral, which Active Directory does
+  inside a forest. Otherwise the login fails with
+  `KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN`.
+- The host has to match the SPN registered on the server. An IP address
+  or a CNAME usually does not.
+- Running from source is the supported path today. Under Flatpak the
+  sandbox has no `/etc/krb5.conf` and its `/tmp` is private, so a FILE
+  ticket cache there is invisible; the manifest grants the config file
+  and the KCM socket, and a FILE cache needs `KRB5CCNAME` pointed
+  somewhere under `$HOME`.
+
 ## Documentation index
 
 | Topic | File |

linux/ROADMAP.md

@@ -99,6 +99,8 @@ Exit criterion: a developer can demo the basic flows (connect, browse, edit, que
 - [x] TLS toggle on connect options
 - [x] SSH tunnelling via `russh` (host, port, key / password auth)
 - [ ] SSH jump host
+- [x] Windows integrated (Kerberos) authentication for SQL Server, from the ambient ticket cache
+- [ ] Kerberos against a service outside the client's default realm, which needs an SPN override upstream in tiberius
 - [x] Read-only mode toggle per connection
 - [x] Cancel running query: button + Esc shortcut
 - [ ] `Connection::cancel` driver method, so cancelling stops the server-side query instead of dropping the client future