Heimdal SPNEGO Won't Eat Negprot GSSAPI Token

[Michael B Allen]

Hey,

I'm playing around with Heimdal GSSAPI and noticed gss_init_sec_context
will not accept the NegTokenInit SPNEGO token provided in an
SMB_COM_NEGOTIATE response. In fact due to some internal shortcuts it
won't accept a NegTokenInit at all (presumably because it only supports
Kerberos which can be completed in one exchange).

So I thought I might work on some patches so that it eats this initial
token and either returns an error because Kerberos 5 isn't advertised
or GSS_S_CONTINUE_NEEDED. Also, I'm at least thinking about NTLMSSP.

But from reading GSSAPI C bindings v2 RFC 2744 Section 5.19:

    Initially, the input_token parameter should be specified either as
    GSS_C_NO_BUFFER, or as a pointer to a gss_buffer_desc object whose
    length field contains the value zero.

Mmm, should I just pretend I didn't hear this? What am I supposed to do
with the initial SPNEGO token returned in the SMB_COM_NEGOTIATE response?

Thanks,
Mike