Subject: gsskrb5.dll for Microsoft Win64/IA64 Kerberos SSP

From: Martin Rex <[email-masked]>
Date: Fri, 26 Jul 2002 11:58:51 +0200 (MET DST)

Since I don't have any fancy Web-pages, announcement mailing lists and
such for my gsskrb5.dll I just sent a note to this list.

As some of you already know, my company is providing as freeware/OpenSource
a wrapper DLL that offers a true GSS-API v2 for Microsoft Kerberos SSP.
The Software can be downloaded from:

    ftp://ftp.sap.com/pub/ietf-work/gssapi/gsskrb5/gsskrb5-106.zip

A few weeks ago I have modified the code slightly so that it 
compiles and runs on Win64/Itanium.  Basically the existing code
worked out of the box, but I had to add two workarounds for
bugs that I found in the Win64 prerelease code.

However there is one unresolved bug in the Win32-Emulation code of Win64
(WOW64) which prevents gsskrb5.dll from establishing security contexts,
the SSPI-Call
   QueryContextAttributes(SECPKG_ATTR_NATIVE_NAMES)
is not implemented on WOW64 and returns SEC_E_INSUFFICIENT_MEMORY.

So if you use my GSS-API test tool from
    ftp://ftp.sap.com/pub/ietf-work/gssapi/gsstest/gsstest-1.25.zip

and run the 32-bit version with the 32-bit gsskrb5.dll on
Win64/Itanium it will fail all context establishments with
this SSPI-error.

Due to the unavailability of this SSPI call, the initiator (client) name
from the name-based Kerberos authentication is not available to
the acceptor (server).  This makes the WOW32 Kerberos SSP pretty useless.

Partial workarounds for Microsoft-only environments by quering
the owner of the Token that was created from the authorization
payload in the ticket are conceivable but I'm reluctant to deceive anyone
that the underlying Kerberos implementation is broken/incomplete.

The call is available and seems to work correctly on native Win64
and native Win32.

If anyone thinks that Microsoft should fix/add this API call
in WOW64 (=Win32 Emulation in Win64/Itanium) then please tell
Microsoft about it.  I have a (premium support) call open but
this particular problem is currently considered very low priority.

-Martin