Re: Future of krb5 authentication

Stephen Frost wrote:
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> Magnus Hagander <magnus@hagander.net> writes:
>>> On Wed, Jul 18, 2007 at 10:46:58AM -0400, Tom Lane wrote:
>>>> This needs to be fixed.
>>> Non, GSSAPI and krb5 are *not* mutually exclusive.
>>> SSPI and GSSAPI are mutually exclusive.
>> Color me confused then.  What's the difference?
> 
> GSSAPI is the MIT libraries, SSPI is the Windows library, but there's no
> way to indicate to libpq which to use and they share some of the same
> code paths with minor adjustments for each done at compile-time (aiui
> anyway, Magnus can provide a clearer answer on this).
> 

Certainly not "just minor adjustments", since we need to do dynamic
loading and checking for the functions. That's the big one, which will
certainly increase the required code a lot. The part about letting the
client specify how is probably fairly easy, if we can figure out a good
one. (I personally think we've clearly shown that using the
connectionstring is not a good enough way to do it)

//Magnus