GSS_C_MA_AUTH_INIT_ANON

[lhoward]

trafficstars

If you support GSS_C_ANON_FLAG, you should list GSS_C_MA_AUTH_INIT_ANON as a supported mechanism attribute. Future versions of Heimdal may exclude mechanisms from negotiation that do not support this attribute, if the initiator requested GSS_C_ANON_FLAG.

[simo5]

TBH I am not sure I ever tested anonymous support, so I am going to assume it is somewhat broken. I will try to validate and then add GSS_C_MA_AUTH_INIT_ANON as part of resolving this issue.

[lhoward]

Thanks Simo. Not sure if this mechanism was ever used with Heimdal, anyway? But it's nice for things to be "correct".

[simo5]

I currently do not allow anon:

if (claimant_cred_handle == GSS_C_NO_CREDENTIAL) {
    if (req_flags & GSS_C_ANON_FLAG) {
        set_GSSERRS(ERR_NOARG, GSS_S_UNAVAILABLE);
        goto done;

[lhoward]

Ah, then no issue then. But – if you do want to support it, then please advertise GSS_C_MA_AUTH_INIT_ANON too. :)

[simo5]

I am working on it, please do not close this issue :)