rpcsec_gss and Kerberos 5

[Ken Raeburn]

Rainer Orth <ro at TechFak.Uni-Bielefeld.DE> writes:
> Indeed.  Besides, switching to RPCSEC_GSS instead of AUTH_GSSAPI would give
> interoperability with Sun's SEAM kadmind which used RPCSEC_GSS from the
> start.

Assuming we use a similar enough protocol definition on top of RPC.
The current MIT protocol has no ".x" file to feed to rpcgen, and in
fact I don't think it's easy to create one.  For one thing, we have a
32-bit value we transmit as 8 bits in one place....  Mistakes like
that can be corrected when we're making such a significant
incompatible protocol change.

> Sun's TI-RPC implementation even allows for the registration of additional
> authentication flavors via svc_auth_reg(3NSL) (something older TS-RPC based
> implementations don't support), so it might even be possible to support
> both flavors in a single kadmind (at least on Solaris systems).

Maybe.  I'm not sure if the way our gssrpc authentication works would
fit properly into the rpcsec model.  It's something to look into.