RE: LDAP extension draft for GSSAPI protection of session data

[Chris Newman <Chris.Newman@INNOSOFT.COM>]

On Tue, 4 Aug 1998, Jonathan Trostle wrote:
> Thanks for your efforts, but I do not see where SASL specifies how the data 
> stream (following initial authentication) tokens are exchanged. Are you saying 
> that the bare unencapsulated GSS Wrap tokens are sent on the wire?

They are encapsulated in a SASL security layer as specified in the last
paragraph of section 3 of RFC 2222.

A SASL security layer is a series of "cipher text blocks", each with a
4-octet length prefix in big-endian byte order.

When the GSSAPI mechanism is used, the cipher text blocks are formed from
GSS_Wrap() tokens.

		- Chris