Re: KITTEN: IETF 75 - 76

[Martin Rex <[e-mail]>]

Nicolas Williams wrote:
> 
> > GSS-API is part of the identity selection problem since its the holder  
> > of credentials.
> > 
> > The application/framework will need to drive authentication and select/ 
> > try credentials as it seems approproate and remember what of them was  
> > useful.
> > 
> > This would work today, if it was possible to get initial credentials  
> > and list existing/configured credentials
> 
> Sure.  An iterator following the same design principles as
> gss_display_status() would look like:
> 
> OM_unit32 gss_list_default_cred_names(
> 	OM_uint32 *minor_status,
> 	gss_name_t  *name,
> 	int	    *more
> );

That call looks somewhat restricted to me.

How about something like this:

OM_uint32 gss_list_default_cred_names(
	OM_uint32    * minor_status,
	gss_name_t   * name,
	gss_OID_set  * mech_oids,
	int          * is_default,
	OM_uint32    * cred_context
);

That would also match what you have to feed into an
explicit call to gss_acquire_cred() in order to reliably
get a credentials handle for exactly and each one listed.

-Martin