* Magnus Hagander ([EMAIL PROTECTED]) wrote:
> We enable the setting of the service name in the server configuration
> file, but we never use that variable anywhere. We do, however, use the
> service name on the client, in order to pick the correct key (and
> turning this off makes GSSAPI no longer work).
> If this is correct, we should not enable that parameter on the server.
> If it's not correct, we should be using it somewhere.

Uh, shouldn't you be acquiring the server credentials before accepting
the context?  That'd be done using gss_acquire_cred(), which takes the
service name (in gss_name_t structure) as an argument.  That would then
be passed in to gss_accept_sec_context() instead of using
GSS_C_NO_CREDENTIAL (in port->gss->cred).  I'm kind of suprised it's
working without that and rather curious as to what it's doing under the
hood to make that happen. :/



Attachment: signature.asc
Description: Digital signature

Reply via email to