Subject: GSSAPI CFX and GSS_C_ANON_FLAG

From: Sam Hartman <[email-masked]>
Date: Thu, 9 Oct 2003 16:15:14 -0400 (EDT)

According to section 4.1.1.1, a caller can pass in GSS_C_ANON_FLAG for
this mechanism.  Does that even make sense for the current Kerberos
mechanism?  If not, should we drop that flag from this mechanism at
this time?

---

From: Martin Rex <[email-masked]>
Date: Thu, 9 Oct 2003 23:47:14 +0200 (MET DST)

As far as I remeber Clifford Neuman talked about the use of ANONYMOUS for
use with Kerberos.  My CAT Email archives shows that he mentioned the
following changes for the rfc1510revisions document in an Email
on July 4th, 1997:

O A new KDC option has been added: request-anonymous(14), has been
  added which asks the KDC to assign an anonymous principal identfier.
  If allowed by the policy of the realm, the policy of the realm will
  specify a particular principal name (suggested anonymous@realm) that

---

From: Sam Hartman <[email-masked]>
Date: Thu, 09 Oct 2003 18:23:35 -0400

>>>>> "Martin" == Martin Rex <[email-masked]> writes:

    Martin> As far as I remeber Clifford Neuman talked about the use
    Martin> of ANONYMOUS for use with Kerberos.  My CAT Email archives
    Martin> shows that he mentioned the following changes for the
    Martin> rfc1510revisions document in an Email on July 4th, 1997:

Those changes have been backed out of both clarifications and
extensions.  I do agree that Kerberos could support anonymous in the
future, but since it is specified neither for the GSSAPI mechanism nor
for Kerberos itself, it seems wrong to support the flag.