[37244] in Kerberos
Re: Optimizing gss_init_sec_context possible?
daemon@ATHENA.MIT.EDU (Martin Gee)
Wed Sep 23 11:34:47 2015
Date: Wed, 23 Sep 2015 15:33:47 +0000 (UTC)
From: Martin Gee <geemang_2000@yahoo.com>
To: Greg Hudson <ghudson@mit.edu>, "kerberos@mit.edu" <kerberos@mit.edu>
Message-ID: <38549668.317990.1443022427684.JavaMail.yahoo@mail.yahoo.com>
In-Reply-To: <5602C00E.8010500@mit.edu>
MIME-Version: 1.0
Reply-To: Martin Gee <geemang_2000@yahoo.com>
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
I'm using: GSS_REPLAY_FLAG|GSS_C_SEQUENCE_FLAG|GSS_C_MUTUAL_FLAG|GSS_C_CONF_FLAG|GSS_C_DELEG_FLAG
Quite honestly not a lot of thought went into these. I thought I needed DELEG since I'm doing impersonation, but it works without it too. Much, much faster. Guess its not going over the wire anymore.
Is
On Wednesday, September 23, 2015 10:06 AM, Greg Hudson <ghudson@mit.edu> wrote:
On 09/22/2015 11:13 AM, Martin Gee wrote:
> Version: 1.13.2 kerb lib
> I'm using the GSS libs to impersonate a user via HTTP SPNEGO (http://tools.ietf.org/html/rfc4559)
> I use gss_init_sec_context to get a Token which is sent over to the HTTP service (see spec) in an HTTP Header. This is necessary.
> I'm profiling my app. The gss_init_sec_context is the most expensive call. I notice that gss_init_sec_context gives you a context handle.
> Is it possible to reuse the context and still get a token?
Are you passing GSS_C_DELEG_FLAG to gss_init_sec_context()? If so, you
can probably take that out and get much better performance, unless for
some reason you need to send a TGT to the HTTP service.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
