GSS/SPNEGO/mechglue/krb5 patches for 1.8

Sam Hartman hartmans at MIT.EDU
Sat Jan 30 12:07:51 EST 2010


>>>>> "Jeffrey" == Jeffrey Hutzelman <jhutz at cmu.edu> writes:

    Jeffrey> In other words, you follow the GSS-API model, which is to
    Jeffrey> establish a context, see if what you got is acceptable, and
    Jeffrey> abort if not.


This produces bad results for SPNEGO.  With SPNEGO, the server has the
option of saying that it doesn't like some mechanism and selecting
another.  You're saying that rather than availing itself of that option
an application should fail.  I disagree.

--Sam



More information about the krbdev mailing list