Re: GSSAPI in imap?

[Sergey Poznyakoff]

> How is gssapi support different than libsasl support with gssapi
> compiled in?

The GSSAPI is a generic mechanism for doing client-server
authentication, whereas SASL is a protocol framework for various
authentication methods. A GSSAPI support in any SASL library is
used as an underlying mechanism.

> If they're the same auth stuff, I'm wondering if it would be a bigger
> win to support libsasl instead?

Surely, we should support libsasl too. But I guess we should support
it along with the generic GSSAPI support, not instead of it.
The primary reason for this is: libsasl does not provide the GSSAPI
interface: it builds its own interface on top of GSSAPI, so it still
needs the gssapi libraries (usually from MIT or Heimdal Kerberos
distribution), so that if a user wishes to compile in the support for
GSSAPI only, it will not be reasonable to require him to have an extra
library (which does not provide any extra functionality in this case).

On the other hand, whenever libsasl is present on the system,
supporting it may be quite handy.  Actually, I'd like to
implement all authentication methods described in rfc1731:
GSSAPI, KERBEROS_V4 and SKEY as well as provide support for
libsasl. 

Regards,
Sergey