Acceptors with creds for multiple principals have little choice but to
use GSS_C_NO_CREDENTIAL and check the resulting security context to
see
if the acceptor principal (and mech, and, if we ever add it, QoP
policy)
is acceptable to the app. That's lame. I'd rather be able to
acquire a
CREDENTIAL HANDLE for all the principals I'm willing to accept sec
contexts for and then use that.
The GSS-API concept of CREDENTIAL HANDLEs is a set of credentials for
the same principal, but different mechanisms. Changing this to
allow it
to be a set of credentials for any {mechanism, principal} seems...
difficult, but perhaps fun anyways.
