Subject: Fwd: [[email-masked]: draft-ietf-cat-sasl-gssapi-XX.txt && error tokens]

From: Will Fiveash <[email-masked]>
Date: Tue, 22 Jul 2003 16:54:39 -0500

Since Nico isn't subscribed I'm forwarding this for him.
-- 
Will Fiveash
Sun Microsystems Inc.
Austin, TX, USA (TZ=CST6CDT)

----- Forwarded message from Nicolas Williams <[email-masked]> -----

Date: Tue, 22 Jul 2003 13:28:16 -0700
From: Nicolas Williams <[email-masked]>
To: [email-masked]
Subject: draft-ietf-cat-sasl-gssapi-XX.txt && error tokens
User-Agent: Mutt/1.4i

The last version of draft-ietf-cat-sasl-gssapi that I saw (-05) did not
appropriately deal with GSS-API error tokens.

Yes, there is such a thing as GSS-API error tokens, that is,
GSS_Accept_sec_context() (and init too) can return a major status other
than GSS_S_COMPLETE/GSS_S_CONTINUE_NEEDED *and* output a token at the
same time.

Such tokens SHOULD be sent.  Sending GSS-API error tokens makes
debugging errors a lot easier and results in error strings that make
sense being displayed to the user.

Also note: minor status codes are generally not standardized (certainly
not for the Kerberos V GSS mechanism) and so minor error codes should
not be sent on the wire as the peer may not be able to interpret them
correctly (this is definitely the case with the Kerberos mech).

Since I cannot find a current version of draft-ietf-cat-sasl-gssapi I
will refrain from proposing actual text changes for now.

Cheers,

Nico
-- 

----- End forwarded message -----