Re: multi-mechanism gssapi

[Sam Hartman <hartmans@mit.edu>]

You should be aware that MIT is probably going to take a different
approach.

I believe that MIT and Sun eventually want to have the API between
GSSAPI and the mechanism be the same API as between the application
and the mech glue layer.  I'd recommend discussing with Nico and
giving him an opportunity to convince you that this is the right
approach before doing anything else.

A consequence of this approach is that mechanisms must either use a
mechanism like -Bgroup or must not call gss_* symbols without
expecting the mech glue layer.

There are several ways to work around this in designing mechanisms.
The simplest is to call something like krb5gss_internal_display_name
instead of gss_display_name when displaying a name from within the
mechanism.  Then the implementation of gss_display_name simply calls
krb5gss_internal_display_name.

--Sam