[15575] in Kerberos_V5_Development
Re: Creating GSSAPI initiate credential using keytab entry--how
daemon@ATHENA.MIT.EDU (Greg Hudson)
Wed Mar 10 14:04:09 2010
From: Greg Hudson <ghudson@mit.edu>
To: Sam Hartman <hartmans@mit.edu>
In-Reply-To: <tsl6354gjt6.fsf_-_@mit.edu>
Date: Wed, 10 Mar 2010 14:04:04 -0500
Message-ID: <1268247844.18898.445.camel@ray>
Mime-Version: 1.0
Cc: "krbdev@MIT.EDU" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Wed, 2010-03-10 at 12:36 -0500, Sam Hartman wrote:
> Would it be a good idea to wrap all this logic into
> gss_acquire_credential so that if you have a keytab you can just use it
> as an initiator?
> I.E. would that be a good improvement for the future?
Possibly. Or we could do the credentials-cache-backed-by-a-keytab idea.
I think it requires at least some thought, though. Currently our GSSAPI
library only does TGS requests, not AS requests. If it start doing AS
requests, then it becomes a consumer of the gic_opt framework and the
preauth framework, and there are some (probably manageable) implications
there.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
