[kitten] Clarification of gss_add_cred() behavior

[Nico Williams <[e-mail]>]

I need a clarification of RFCs 2743 and 2744 as to GSS_add_cred().

    Is it really the case that calling GSS_Add_cred() with no
    input_cred_handle (GSS_C_NO_CREDENTIAL) must ignore desired_name
    even when it is not the GSS_C_NO_NAME??

I think the answer is that this text in RFC2743 section 2.1.4, page 39:

   If GSS_C_NO_CREDENTIAL is specified as input_cred_handle, a non-NULL
   output_cred_handle must be supplied.  For the case of
   GSS_C_NO_CREDENTIAL as input_cred_handle, GSS_Add_cred() will create
   the credential referenced by its output_cred_handle based on default
   behavior.  That is, the call will have the same effect as if the
   caller had previously called GSS_Acquire_cred(), specifying the same
   usage and passing GSS_C_NO_NAME as the desired_name parameter
   (thereby obtaining an explicit credential handle corresponding to
   default behavior), had passed that credential handle to
   GSS_Add_cred(), and had finally called GSS_Release_cred() on the
   credential handle received from GSS_Acquire_cred().

and the corresponding and matching text in RFC2744 section 5.3, are
subtly wrong.  This text should have read thusly:

   If GSS_C_NO_CREDENTIAL is specified as input_cred_handle, a non-NULL
   output_cred_handle must be supplied.  For the case of
   GSS_C_NO_CREDENTIAL as input_cred_handle and desired_name as
   GSS_C_NO_NAME, GSS_Add_cred() will create
   the credential referenced by its output_cred_handle based on default
   behavior.  ...

That is, it should be possible to call GSS_Add_cred() with
input_cred_handle == GSS_C_NO_CREDENTIAL and a
desired_name != GSS_C_NO_NAME, and get a CREDENTIAL HANDLE for that
desired_name.

Otherwise GSS_Add_cred() is mostly useless.

I think this must have been a drafting error.  It's obvious to me, but
maybe someone has a very different opinion as to this (Martin?).

Nico
--