RFC: add a 'policy' value to GSSAPIDelegateCredentials (OK-AS-DELEGATE)

[Carson Gaspar]

On 7/9/2026 12:27 PM, Avinash Duduskar wrote:
> I found no prior proposal to honor OK-AS-DELEGATE and no mention of
> GSS_C_DELEG_POLICY_FLAG in the openssh-unix-dev archives or on
> bugzilla.mindrot.org.
>
> Before writing a patch: is this something you would consider, and
> would you rather extend GSSAPIDelegateCredentials or add a separate
> keyword? I will go with whichever fits.

At my until-recently employer we ran with a GSSAPIDelegateCredentials 
policy patch for the last few years. The patch was fairly trivial, and 
worked well for us. While I no longer have a personal interest in my 
newly retired life, I think this would be a nice addition to upstream.

-- 

Carson