RFR 6722928: Support SSPI as a native GSS-API provider

[Michael Osipov]

Am 2019-03-22 um 16:28 schrieb Nico Williams:
> On Thu, Mar 21, 2019 at 10:17:36PM +0100, Michael Osipov wrote:
>> * header comment: Why do actually exclude NTLM from SPNEGO? Let SSPI work as
>> it is intended to work. Means less code you have to maintain
>
> There's a few reasons:
>
>   - NTLM doesn't have an OID, at least as I remember

I don't agree:
https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-nlmp/e21c0b07-8662-41b7-8853-2b9184eab0db

Heimdal uses it, look at a SPNEGO token from SSPI in Wireshark, you'll
see it.

>   - the JDK's JGSS stuff is very Kerberos-specific, especially w/ regards
>     to the ServicePermission stuff

Granted.

> IMO JAAS (and with it, *Permission) should be removed with prejudice now
> that applet support has been removed.  Perhaps stubs should be left
> behind for compatibility reasons, and all the doAs*() methods should
> just act as though permission is granted.
>
> Removing JAAS would be a wonderful simplification, then the JGSS stuff
> could stop being Kerberos-specific.

Fully agree, it has been a pain in the last couple of years. This would
also require an RFC update for the JGSS bindings to logon onto network
with username/password or keytab w/o login modules.

Michael