| Version
2.0.0 Runtime Library (included with TrustBroker v2.0, v2.1
and Devpack 1) :
With this version of the GSS-API Runtime
a GSS initiator creates initialisation tokens based on the
Pre-RFC1964 mechanism OID {1 3 5 1 5 2} by default. If the
environment variable CSF_GSS_VERSION is set to V2 the RFC1964
mechanism OID {1 2 840 113554 1 2 2} is used for token creation
instead.
A GSS acceptor using this GSS-API Runtime
will accept GSS tokens in either pre-RFC1964 or RFC1964 format,
regardless of which mechanism was selected via the API. When
the acceptor generates tokens, it generates pre-RFC1964 tokens
by default, but RFC1964 tokens can be generated by setting
the environment variable CSF_GSS_VERSION to V2.
A GSS acceptor needs to generate tokens
on context acceptance, when mutual auth is requested; and
also when the acceptor sends a signed/sealed message to the
initiator. So, if the initiator does not support Pre-RFC1964
tokens there will likely be an error issued at the initiator
when the Pre-RFC1964 tokens created by the acceptor and sent
to initiator. To fix this - either use the environment variable
to change the GSS token format created by the acceptor to
RFC1964 format (i.e. V2) or upgrade the Runtime Library to
2.0.1 or later (see details below).
Version 2.0.1 Runtime Library (included
with ActiveTRUST v3.0 and v4.0) :
With this version of the GSS-API Runtime
a GSS initiator creates initialisation tokens based on the
Pre-RFC1964 mechanism OID {1 3 5 1 5 2} by default. If the
environment variable CSF_GSS_VERSION is set to V2 the RFC1964
mechanism OID {1 2 840 113554 1 2 2} is used for token creation
instead.
A GSS acceptor using this GSS-API Runtime
will accept GSS tokens in either Pre-RFC1964 or RFC1964 format,
regardless of which mechanism was selected via the API. When
the acceptor generates tokens, it generates tokens using the
same format as chosen by the initiator.
Version 3.1.0 Runtime Library :
With this version of the GSS-API Runtime
the CSF_GSS_VERSION environment variable has been deprecated.
Also, a GSS initiator will now use the RFC1964 mechanism OID
{1 2 840 113554 1 2 2} by default and GSS tokens will be created
using this OID. If the API is used to select a different OID
such as the Pre-RFC1964 OID the GSS tokens created are based
on the OID selected. If the environment variable CSF_GSS_DEFAULT_MECH
is set to "Pre-RFC1964" the Pre-RFC1964 mechanism
OID {1 3 5 1 5 2} is used as the default instead of the RFC1964
OID, but only if the API is not used to specifically select
the RFC1964 mechanism OID. Likewise, if the API is used to
specifically select the Pre-RFC1964 OID the CSF_GSS_DEFAULT_MECH
environment variable will not be able to override this selection
to the RFC1964 OID.
A GSS acceptor using this GSS-API Runtime
will accept GSS tokens in either Pre-RFC1964 or RFC1964 format,
regardless of which mechanism was selected via the API. When
the acceptor generates tokens, it generates tokens using the
same format as chosen by the initiator. |
.jpg)
