advice on kerberizing products

Douglas E. Engert deengert at
Thu Apr 24 09:42:50 EDT 2008

Kristen J. Webb wrote:
> Hi Simon,
> My current concern with the GSSAPI approach is that
> I do not understand how tightly bound it is
> with Kerberos yet (or vice-versa).  Is it possible
> that I may run into situations where Kerberos
> is used w/o access to gssapi libraries?

In addition to Ken Raeburn's comments, the original Solaris 10
shipped with the GSSAPI, but hid the underlying Kerberos  API.
But last year they relented and exposed the Kerberos API too.

On Windows the Microsoft SSPI has a different API then GSSAPI,
but they use the same protocol, and can interoperate with
other GSSAPI implementaitons.

Although GSSAPI is generic, and can have more mechanisms then
Kerberos, Kerberos is the predominant mechanism for GSSAPI.

I would go with GSSAPI if at all possible.


  Douglas E. Engert  <DEEngert at>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444

More information about the Kerberos mailing list