Subject: Re: [kitten] CredUI

From: Nico Williams <[email-masked]>
Date: Sat, 1 Feb 2014 12:36:31 -0600

On Fri, Jan 31, 2014 at 8:06 PM, Luke Howard <[email-masked]> wrote:
> * an API/SPI to acquire a credential given an arbitrary dictionary (currently we implemented this using gss_set_cred_option(), as that can output a credential, but a new entry point would be cleaner)

You want gss_acquire_cred_from().

http://k5wiki.kerberos.org/wiki/Projects/Credential_Store_extensions

---

From: Greg Hudson <[email-masked]>
Date: Sat, 01 Feb 2014 14:58:23 -0500

> http://k5wiki.kerberos.org/wiki/Projects/Credential_Store_extensions

I believe the consensus at the time was that gss_key_value_set_desc
could be used for answers to authentication questions, but the
cred_store parameter to gss_acquire_cred_from cannot.  See:

http://mailman.mit.edu/pipermail/krbdev/2012-July/011105.html

IIRC Nico or Sam had some ideas on what an initial cred acquisition API
might look like (given that it's not just gss_acquire_cred_from), but I
can't seem to find a writeup.

---

From: Luke Howard <[email-masked]>
Date: Mon, 3 Feb 2014 12:55:34 +1100

> can't seem to find a writeup.

At least we have gss_const_key_value_set_t, even if we use a new API (as mentioned earlier, it could also be gss_set_cred_option with a well known OID).

-- Luke