Re: gss userauth

[Markus Friedl <markus%openbsd.org@localhost>]

On Tue, Sep 02, 2003 at 06:46:03PM -0600, Joseph Galbraith wrote:
> Precisely.  I believe a new server should alway
> advertise gssapi-with-mic.  If it wishes to offer
> backwards compatibility, then it MAY advertise
> the older "gssapi".

I agree, "gssapi" should only be offered for backward
compatibility and legacy clients.

During a transition period server can offer both
"gssapi" and "gssapi-mic".

> However, I'm not even sure we need to document "gssapi"
> in the new draft, other than to say it once existed,
> and SHOULD NOT be used anymore.  I.e., reserve the name
> string as unused.

I agree.