Set AuthServer = Win_Sspi on server, on client it's configured by default Setting on client AuthClient=Win_Sspi (to turn off the rest of plugins) can save you one round of authentication packets exchange but be sure that's not what you will notice on practice.
Our plugin is using any SSP, actual choice is done by windows. A level of abstraction in win_sspi plugin is high enough to support any SSP. Making Firebird determine the role based on a group in i.e. Activce Directory is not working yet but should be implemented in future releases/versions.
