Creating GSSAPI initiate credential using keytab entry--how should this work

[Sam Hartman]

>>>>> "Greg" == Greg Hudson <ghudson at MIT.EDU> writes:

    Greg> On Wed, 2010-03-10 at 12:36 -0500, Sam Hartman wrote:
    >> Would it be a good idea to wrap all this logic into
    >> gss_acquire_credential so that if you have a keytab you can just
    >> use it as an initiator?  I.E. would that be a good improvement
    >> for the future?

    Greg> Possibly.  Or we could do the
    Greg> credentials-cache-backed-by-a-keytab idea.

    Greg> I think it requires at least some thought, though.  Currently
    Greg> our GSSAPI library only does TGS requests, not AS requests.
    Greg> If it start doing AS requests, then it becomes a consumer of
    Greg> the gic_opt framework and the preauth framework, and there are
    Greg> some (probably manageable) implications there.

We already will have to deal with this for  iakerb.