Re: Wincvs error: GSSAPI authentication failed: The specified target is unknown or unreachable

[Simon Wilkinson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


On 26 May 2007, at 09:36, Mark D. Baushke wrote:

> It seems possible that the kerberized windows client is falling  
> prey to
> the differences between GSSAPI implementation on Windows and non- 
> Windows
> machines.

In general, the various GSSAPI implementations interoperate well,  
providing they are used correctly by the programmer. In particular,  
both MIT's Kerberos for Windows, and Microsoft's SSPI can  
interoperate with both Unix MIT and Heimdal servers. This is, after  
all, how all of the GSSAPI stuff in Firefox and Thunderbird works.  
The problem with Windows is that there are two commonly available  
GSSAPI implementations - Microsoft's one, and MITs. They don't use  
tickets, or configuration, from each other - and Microsoft's doesn't  
appear particularly usable in cases where your machine is not a  
member of an Active Directory realm.

In your case, I think that error message indicates that your  
application is using SSPI (Microsoft's) rather than MIT's GSSAPI -  
this means that it won't have access to the credentials you've  
obtained with NIM, or to the configuration which tells it which KDC  
to speak to. I don't think there's any real solution to this, short  
of recompiling the application against MIT's implementation (Firefox  
and Thunderbird both dynamically load their GSSAPI provider based on  
a user preference, to deal with exactly this problem).

Cheers,

Simon.


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (Darwin)

iD8DBQFGWBK1qWndc26pXmcRAmT8AJ0eu1Vh0hi/hLJVQrxJZFRmZ7OefACgshwh
3VfkiW2q64vH25OBvzsrALU=
=xqzI
-----END PGP SIGNATURE-----