Re: KITTEN: IETF 75 - 76

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Tue, Aug 18, 2009 at 10:59:59AM -0700, Love Hörnquist Åstrand wrote:
> >Yes, this problem affects initiators too.  If you want to solve the
> >Identity Selection problem _above_ the GSS-API (and I agree that the
> >solutions do belong outside the GSS-API), then you need to solve the
> >CREDENTIAL HANDLE issue first.
> 
> The credential handle problem is already solved for init sec context,  
> if you just can get hold of them.

True.

> GSS-API is part of the identity selection problem since its the holder  
> of credentials.
> 
> The application/framework will need to drive authentication and select/ 
> try credentials as it seems approproate and remember what of them was  
> useful.
> 
> This would work today, if it was possible to get initial credentials  
> and list existing/configured credentials

Sure.  An iterator following the same design principles as
gss_display_status() would look like:

OM_unit32 gss_list_default_cred_names(
	OM_uint32 *minor_status,
	gss_name_t  *name,
	int	    *more
);