On Wed, 2004-03-10 at 11:20, Sam Hartman wrote: > Umich has approached MIT asking for a private API for their in-kernel GSSAPI implementation to use. If Samba is to ever use 'real' GSSAPI (not our own private, ugly, mostly works hack) then we will also need this. We currently call if (remote) err = krb5_auth_con_getremotesubkey(context, auth_context, &skey); else err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey); To get them. This key is directly used for encrypting certain CIFS traffic (password sets particularly) and to establish 'SMB signing'. By my reading, that should be the keys we are seeing in that structure. Is that correct? > Ideally we'd like to get to a point where Heimdal could implement the > same API. > > As such we're seeking comments from the Heimdal community. > > > > ______________________________________________________________________ > From: Kevin Coffman <kwc@citi.umich.edu> > To: krbdev@mit.edu > Cc: nfsv4-wg@citi.umich.edu > Subject: Proposal to export gssapi context > Date: Tue, 09 Mar 2004 18:00:42 -0500 > > Brought to krbdev... > > The kernel implementation of rpcsec_gss used for NFSv4 requires context > information be negotiated in user-land and then passed down for use in the > kernel. gss_export_context() exports the context as an opaque object which > cannot be used for this purpose. We are proposing three new APIs. One is > to restrict the encryption types negotiated in user-land to the set that the > kernel can use. The other two are to export context information into a > usable structure, and then free that structure. > > Comments, suggestions, welcome. > > > > ______________________________________________________________________ > _______________________________________________ > krbdev mailing list krbdev@mit.edu > https://mailman.mit.edu/mailman/listinfo/krbdev -- Andrew Bartlett abartlet@pcug.org.au Manager, Authentication Subsystems, Samba Team abartlet@samba.org Student Network Administrator, Hawker College abartlet@hawkerc.net http://samba.org http://build.samba.org http://hawkerc.net
This is a digitally signed message part