Re: SSHv2 GSS spec issue wrt gss error tokens

[Nicolas Williams <Nicolas.Williams%sun.com@localhost>]

On Mon, Nov 18, 2002 at 11:16:13AM -0600, Nicolas Williams wrote:
> 
> [...]
> 
> (One need not even have to misconfigure Kerberos - if the server is
> multi-homed, with multiple canonical hostnames [one for each set of
> interfaces] then gsskeyex will work only when user against the

That should read "One need not misconfigure Kerberos ..." and
"... only when used against ..."

> interfaces whose canonical hostname matches the host's "nodename".  This
> is because the existing open source implementations of GSS/Kerberos do
> not support the better GSS_C_NO_CREDENTIAL semantics in
> GSS_Accept_sec_context().  This scenario happens every day in at least
> one environment that I know of, so it is not far-fetched; having useful
> error messages for this and other scenarios would be great and sending
> the acceptor's error token is the correct way to achieve that.)
> 
> [...]
> 
>                         Alternatively the draft could be modified in a
> non-backwards compatible manner, but I believe it's too for that.

That should read "... but I believe it's too late for that."

> 
> [...]
> 


Nico
--