[33625] in Kerberos
Re: threading best practices?
daemon@ATHENA.MIT.EDU (Nico Williams)
Fri Jul 22 21:48:38 2011
MIME-Version: 1.0
In-Reply-To: <4E2A1E3A.8080008@d6.com>
Date: Fri, 22 Jul 2011 20:48:32 -0500
Message-ID: <CAK3OfOjcRqgzPLAudUGBpFiOAZf9LCNvUepAp-cR8v-aKynC8Q@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Chris Hecker <checker@d6.com>
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Fri, Jul 22, 2011 at 8:04 PM, Chris Hecker <checker@d6.com> wrote:
> Chris is also pretty allergic to layers and indirection in his software
> unless they're absolutely necessary, so he's quite happy that he can
> talk directly to kerberos, since he's not going to swap out the security
> layer or anything, so GSSAPI would just be adding overhead (conceptual,
> if not computational) for me.
If you need the mechanism to be Kerberos and know you'll never want a
different mechanism in your app, then using the krb5 API directly is
fine. GSS doesn't add that much more layering, and the layering it
does add adds value, IMO. As for conceptual overhead, the GSS-API is
simpler than the MIT krb5 API :)
Nico
--
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
