advice on kerberizing products

[Douglas E. Engert]

Kristen J. Webb wrote:
> Hi Simon,
> 
> My current concern with the GSSAPI approach is that
> I do not understand how tightly bound it is
> with Kerberos yet (or vice-versa).  Is it possible
> that I may run into situations where Kerberos
> is used w/o access to gssapi libraries?
> 

In addition to Ken Raeburn's comments, the original Solaris 10
shipped with the GSSAPI, but hid the underlying Kerberos  API.
But last year they relented and exposed the Kerberos API too.

On Windows the Microsoft SSPI has a different API then GSSAPI,
but they use the same protocol, and can interoperate with
other GSSAPI implementaitons.

Although GSSAPI is generic, and can have more mechanisms then
Kerberos, Kerberos is the predominant mechanism for GSSAPI.

I would go with GSSAPI if at all possible.

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444