Re: removing MK_GSSAPI
Cy Schubert <[email protected]>
| Newsgroups | gmane.os.freebsd.architechture |
|---|---|
| Message-ID | <[email protected]> |
In message <[email protected] om> , Rick Macklem writes: > On Mon, Aug 11, 2025 at 9:33=E2=80=AFAM Lexi Winter <[email protected]> wrote= > : > > > > Rick Macklem: > > > Once upon a time, GSSAPI was envisioned to someday have a variety of > > > mechanisms, with Kerberos being one possible one. That has never > > > happened > > > > i believe Heimdal does provide an NTLM mechanism (libgssapi_ntlm) and > > also an SPNEGO mechanism which can presumably use either Kerberos or > > NTLM, but as Heimdal is planned to be removed anyway, i'm not sure this > > is a reason to keep the knob around just in case someone decides to add > > those back later. > Ok, I didn't know about NTLM (I did know that SPNEGO layered on top > of Kerberos). I doubt we care about a Microsoft protocol and, as you say, > it could be changed back someday, if need be. One can use Active Directory as a KDC. Red Hat uses MIT KRB5 for authentication and SID to UID and SID to GID translation from data provided by NTLM. I think could be why the Enterprise Working Group wanted MIT KRB5 in base. -- Cheers, Cy Schubert <[email protected]> FreeBSD UNIX: <[email protected]> Web: https://FreeBSD.org NTP: <[email protected]> Web: https://nwtime.org e**(i*pi)+1=0