advice on kerberizing products
Douglas E. Engert
deengert at anl.gov
Thu Apr 24 09:42:50 EDT 2008
Kristen J. Webb wrote:
> Hi Simon,
> My current concern with the GSSAPI approach is that
> I do not understand how tightly bound it is
> with Kerberos yet (or vice-versa). Is it possible
> that I may run into situations where Kerberos
> is used w/o access to gssapi libraries?
In addition to Ken Raeburn's comments, the original Solaris 10
shipped with the GSSAPI, but hid the underlying Kerberos API.
But last year they relented and exposed the Kerberos API too.
On Windows the Microsoft SSPI has a different API then GSSAPI,
but they use the same protocol, and can interoperate with
other GSSAPI implementaitons.
Although GSSAPI is generic, and can have more mechanisms then
Kerberos, Kerberos is the predominant mechanism for GSSAPI.
I would go with GSSAPI if at all possible.
Douglas E. Engert <DEEngert at anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
More information about the Kerberos