Subject: [Wocky] SASL vs. GSSAPI

From: "Paul B. Hill" <[email-masked]>
Date: Wed, 14 Dec 2005 17:56:08 -0500

Hi,

The Windows Oracle Calendar software (TechTime) has a configuration option
for a couple of authentication methods. These are gssapi:kerberos5,
SASLKerberosv4, CST Basic Authentication, and Standard Authentication.
(Actually the choice are dependant on what other libraries appear on your
system.)

When gssapi:kerberos5 is selected the client will use the CMU SASL libraries
if they are present. However, if the CMU SASL libraries are not present,
then the client will look for gssapi.dll and use that directly. 

If we want to provide authentication patches to Gaim, then a similar
strategy might be the best way to get the Gaim developer community to accept
the changes. 

The clients should see if the SASL libraries are present. If they are, then
any of the SASL mechanisms installed could be used. If the SASL libraries
are not able to be loaded, then see if the GSSAPI libraries can be loaded
directly. 

Paul

---

From: Greg Hudson <[email-masked]>
Date: Thu, 15 Dec 2005 02:49:34 -0500

One of the issues with dynamic loading is that the Gaim code needs to
know the signatures of each function it wants to load.  Simon's strategy
was to include a copy of the krb5 gssapi.h, hacked up so that instead of
declaring functions, it declared types.  I don't think that approach
would be acceptable to the Gaim people, and I'm curious what TechTime
does.

I suspect that whatever we send upstream will need to use a more
conventional strategy of linking to dependency libraries.  Other
protocol plugins have their own library dependencies, I believe, and I
don't think they use dynamic loading.  I can look into that more.