Re: [OT] Re: GGF's extensions to GSS in Public Comment

On Tue, Apr 06, 2004 at 01:19:27PM -0500, Nicolas Williams wrote:
> On Tue, Apr 06, 2004 at 10:19:12AM -0500, Douglas E. Engert wrote:
> [...]
> > The GGF gss_export_cred returns a string suitable to be used by putenv.
> > But this does not mean that it has to be a file name, it is a URL that can be
> > used by the gssapi in subsequent processes to locate credentials.
> > On a system where credentials are handled by a credential manager, the URL could 
> > even be ignored.  
> 
> Doug, this does not address the issues with the use of environment
> variables in GSS_Export_cred().
> 
> > I don't think we are that far apart. We need to look at the larger picture of
> > how credential management can be done by the operating system, so credentials
> > can be used by the kernel as well as used by the application. We also need
> > to realize that an application may be using multiple credentials for its
> > own purposes i.e. SSL, TCP where the kernel isn't involved at all. 
> 
> GSS_Store_cred() does not care what sort of credential store you're
> storing into -- GSS_Store_cred() assumes there's a "current" credential
> store available when it is called.
> 
> > We need for gssapi to be able address both needs.   
> 
> I think GSS_Store_cred() + GSS_Get/Set_current_cred_store() proposal
> covers both needs.  The GSS_Get/Set_current_cred_store() proposal needs
> more text to cover this, but I'm convinced it can cover your needs.
> 
> If you don't care about the user-land+kernel vs. user-land-only
> distinction then GSS_Store_cred() may be all you need.

Actually, I don't think GSS_Store_cred()/GSS_Get/Set_current_cred_store()
should directly distinguish between credential stores of one kind
(user-land only) and another (kernerl+user-land).  I believe that the
default_cred parameter of GSS_Store_cred() provides enough of a hint to
the implementation as to what kind of store to use, where such a hint is
needed at all.

I don't think we should saddle generic interfaces with platform-specific
details.

Cheers,

Nico
-- 
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email protected]