>> So something like SPNEGO still runs in the client's address space? > > SPNEGO is not interposed by design atm. Right, because interposing pseudo-mechs will be difficult without either interposing all mechanisms or having some kind of callback mechanism. -- Luke