Set AuthServer = Win_Sspi on server, on client it's configured by default
Setting on client AuthClient=Win_Sspi (to turn off the rest of plugins) can
save you one round of authentication packets exchange but be sure that's not
what you will notice on practice.
Our plugin is using any SSP, actual choice is done by windows. A level of
abstraction in win_sspi plugin is high enough to support any SSP.
Making Firebird determine the role based on a group in i.e. Activce Directory
is not working yet but should be implemented in future releases/versions.