Committing what I have. See ChangeLog for the last couple of things I

did.  I wouldn't consider anything in any form of reasonable state at the
moment.

diff --git a/ChangeLog b/ChangeLog
index ef1342d..6a834c0 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2003-06-10  Daniel Henninger  <jadestorm@users.sourceforge.net>
+
+       * src/mod_auth_kerb.c:
+       Reworked the AuthType-esque directives.
+       Made KrbAuthRealm(s) be... more correct.
+
+2003-06-03  Daniel Henninger  <jadestorm@users.sourceforge.net>
+
+       * src/mod_auth_kerb.c:
+       Removed KrbDefaultRealm, replaced with KrbAuthRealms.
+       Working on full multi-realm support as per request 738054.
+
 2003-06-02  Daniel Henninger  <jadestorm@users.sourceforge.net>
 
        * src/mod_auth_kerb.c:

diff --git a/configure.in b/configure.in
index 927e41d..fc8a93e 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1,15 +1,23 @@
-dnl ####################
-dnl ## Initialization ##
-dnl ####################
+dnl Process this file with autoconf to produce a configure script.
 AC_INIT(Apache Kerberos Module,
         alpha2,
         modauthkerb-developers@lists.sourceforge.net,
         mod_auth_kerb)
+AC_CANONICAL_HOST
 
 
-dnl ####################
-dnl ## Config Options ##
-dnl ####################
+dnl OS specific options.
+case "$host" in
+*-*-netbsd*)
+       need_dash_r=1
+       ;;
+*-*-solaris*)
+       need_dash_r=1
+       ;;
+esac
+
+
+dnl Custom args we care about.
 AC_ARG_WITH(api,
 [  --with-api=API                      api to use (apache1, apache2)],
 [
@@ -50,18 +58,11 @@ AC_ARG_WITH(static,
 AC_ARG_WITH(krb5,
 [  --with-krb5=DIR                     path to Kerberos 5 install],
 [
-       if test -d $withval ; then
-               CFLAGS="$CFLAGS -I$withval/include -I$withval/include/kerberosIV"
-               CPPFLAGS="$CPPFLAGS -I$withval/include -I$withval/include/kerberosIV"
-               LDFLAGS="$LDFLAGS -L$withval/lib"
-
-               case "$host" in
-                       *-solaris*)
-                               LDFLAGS="$LDFLAGS -R$withval/lib"
-                               ;;
-               esac
-       else
-               AC_ERROR(Specified Kerberos 5 directory doesn't exist.)
+       CFLAGS="$CFLAGS -I$withval/include -I$withval/include/kerberosIV"
+       CPPFLAGS="$CPPFLAGS -I$withval/include -I$withval/include/kerberosIV"
+       LDFLAGS="$LDFLAGS -L$withval/lib"
+       if test -n "${need_dash_r}"; then
+               LDFLAGS="$LDFLAGS -R$withval/lib"
        fi
 ]
 )
@@ -69,28 +70,17 @@ AC_ARG_WITH(krb5,
 AC_ARG_WITH(krb5-include,
 [    --with-krb5-include=DIR           include path to Kerberos 5 install],
 [
-       if test -d $withval ; then
-               CFLAGS="$CFLAGS -I$withval -I$withval/include/kerberosIV"
-               CPPFLAGS="$CPPFLAGS -I$withval -I$withval/include/kerberosIV"
-       else
-               AC_ERROR(Specified Kerberos 5 directory doesn't exist.)
-       fi
+       CFLAGS="$CFLAGS -I$withval -I$withval/kerberosIV"
+       CPPFLAGS="$CPPFLAGS -I$withval -I$withval/kerberosIV"
 ]
 )
 
 AC_ARG_WITH(krb5-lib,
 [    --with-krb5-lib=DIR               lib path to Kerberos 5 install],
 [
-       if test -d $withval ; then
-               LDFLAGS="$LDFLAGS -L$withval"
-
-               case "$host" in
-                       *-solaris*)
-                               LDFLAGS="$LDFLAGS -R$withval"
-                               ;;
-               esac
-       else
-               AC_ERROR(Specified Kerberos 5 directory doesn't exist.)
+       LDFLAGS="$LDFLAGS -L$withval"
+       if test -n "${need_dash_r}"; then
+               LDFLAGS="$LDFLAGS -R$withval"
        fi
 ]
 )
@@ -107,18 +97,11 @@ AC_ARG_ENABLE(krb5,
 AC_ARG_WITH(krb4,
 [  --with-krb4=DIR                     path to Kerberos 4 install],
 [
-       if test -d $withval ; then
-               CFLAGS="$CFLAGS -I$withval/include"
-               CPPFLAGS="$CPPFLAGS -I$withval/include"
-               LDFLAGS="$LDFLAGS -L$withval/lib"
-
-               case "$host" in
-                       *-solaris*)
-                               LDFLAGS="$LDFLAGS -R$withval/lib"
-                               ;;
-               esac
-       else
-               AC_ERROR(Specified Kerberos 4 directory doesn't exist.)
+       CFLAGS="$CFLAGS -I$withval/include"
+       CPPFLAGS="$CPPFLAGS -I$withval/include"
+       LDFLAGS="$LDFLAGS -L$withval/lib"
+       if test -n "${need_dash_r}"; then
+               LDFLAGS="$LDFLAGS -R$withval/lib"
        fi
 ]
 )
@@ -126,28 +109,17 @@ AC_ARG_WITH(krb4,
 AC_ARG_WITH(krb4-include,
 [    --with-krb4-include=DIR           include path to Kerberos 4 install],
 [
-       if test -d $withval ; then
-               CFLAGS="$CFLAGS -I$withval"
-               CPPFLAGS="$CPPFLAGS -I$withval"
-       else
-               AC_ERROR(Specified Kerberos 4 directory doesn't exist.)
-       fi
+       CFLAGS="$CFLAGS -I$withval"
+       CPPFLAGS="$CPPFLAGS -I$withval"
 ]
 )
 
 AC_ARG_WITH(krb4-lib,
 [    --with-krb4-lib=DIR               lib path to Kerberos 4 install],
 [
-       if test -d $withval ; then
-               LDFLAGS="$LDFLAGS -L$withval"
-
-               case "$host" in
-                       *-solaris*)
-                               LDFLAGS="$LDFLAGS -R$withval"
-                               ;;
-               esac
-       else
-               AC_ERROR(Specified Kerberos 4 directory doesn't exist.)
+       LDFLAGS="$LDFLAGS -L$withval"
+       if test -n "${need_dash_r}"; then
+               LDFLAGS="$LDFLAGS -R$withval"
        fi
 ]
 )
@@ -161,11 +133,50 @@ AC_ARG_ENABLE(krb4,
 ],
 )
 
+AC_ARG_WITH(gssapi,
+[  --with-gssapi=DIR                   path to GSSAPI install],
+[
+       CFLAGS="$CFLAGS -I$withval/include -I$withval/include/gssapi"
+       CPPFLAGS="$CPPFLAGS -I$withval/include -I$withval/include/gssapi"
+       LDFLAGS="$LDFLAGS -L$withval/lib"
+       if test -n "${need_dash_r}"; then
+               LDFLAGS="$LDFLAGS -R$withval/lib"
+       fi
+]
+)
+
+AC_ARG_WITH(gssapi-include,
+[    --with-gssapi-include=DIR         include path to GSSAPI install],
+[
+       CFLAGS="$CFLAGS -I$withval -I$withval/gssapi"
+       CPPFLAGS="$CPPFLAGS -I$withval -I$withval/gssapi"
+]
+)
+
+AC_ARG_WITH(gssapi-lib,
+[    --with-gssapi-lib=DIR             lib path to GSSAPI install],
+[
+       LDFLAGS="$LDFLAGS -L$withval"
+       if test -n "${need_dash_r}"; then
+               LDFLAGS="$LDFLAGS -R$withval"
+       fi
+]
+)
+
+AC_ARG_ENABLE(gssapi,
+[  --disable-gssapi                    force disabling of gssapi support],
+[
+       if test "$enable_gssapi" = "no" ; then
+               ac_gssapi_disable="yes"
+       fi
+]
+)
+
+
 
-dnl ####################
-dnl ## Program Checks ##
-dnl ####################
+dnl Checks for programs.
 AC_PROG_CC
+AC_PROG_MAKE_SET
 if test -z "$ac_static" ; then
        AC_PATH_PROG(APXS, apxs)
        if test -z "$APXS" ; then
@@ -175,9 +186,7 @@ if test -z "$ac_static" ; then
 fi
 
 
-dnl ###############
-dnl ## Libraries ##
-dnl ###############
+dnl Checks for libraries.
 if test -z "$ac_krb5_disable" ; then
        AC_CHECK_LIB(krb5, krb5_get_in_tkt_with_password, [
                ac_krb5="yes"
@@ -199,7 +208,7 @@ if test -z "$ac_krb5_disable" ; then
                                AC_CHECK_LIB(krb4, krb_get_pw_in_tkt, [
                                        ac_krb4="yes"
                                        ac_krbdefs="$ac_krbdefs -DKRB4"
-                                       ac_krblibs="$ac_krblibs -lkrb4 $ac_krblibs"
+                                       ac_krblibs="-lkrb4 $ac_krblibs"
                                ],, $ac_krblibs)
                        fi
                fi
@@ -219,9 +228,7 @@ if test -z "$ac_krb4" -a -z "$ac_krb5" ; then
 fi
 
 
-dnl #############
-dnl ## Headers ##
-dnl #############
+dnl Checks for header files.
 if test -n "$ac_krb5" ; then
        AC_CHECK_HEADERS(krb5.h, [
                ac_foundkrb5="yes"
@@ -251,19 +258,7 @@ if test -z "$ac_krb4" -a -z "$ac_krb5" ; then
 fi
 
 
-dnl ##############
-dnl ## Typedefs ##
-dnl ##############
-
-
-dnl ################
-dnl ## Structures ##
-dnl ################
-
-
-dnl ##############################
-dnl ## Compiler Characteristics ##
-dnl ##############################
+dnl Checks for typedefs, structures, and compiler characteristics.
 if test -z "$ac_api" ; then
        if test -n "`$APXS -q bindir 2> /dev/null`" ; then
                echo "API autodetected to be Apache 2.*"
@@ -277,27 +272,16 @@ if test -z "$ac_api" ; then
 fi
 
 
-dnl #######################
-dnl ## Library Functions ##
-dnl #######################
-
-
-dnl #####################
-dnl ## System Services ##
-dnl #####################
+dnl Checks for library functions.
 
 
-dnl ##########################
-dnl ## Last Minute Settings ##
-dnl ##########################
+dnl Last minute settings.
 LIBS="$LIBS $ac_krblibs"
 DEFS="$DEFS $ac_apidefs $ac_krbdefs"
 CFLAGS="$CFLAGS $DEFS"
 
 
-dnl #########################
-dnl ## Create Output Files ##
-dnl #########################
+dnl Create files necessary to compile mod_auth_kerb.
 if test "$ac_static" = "yes" ; then
        echo ""
        echo ""

diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c
index e15cb06..d66e3af 100644 (file)
--- a/src/mod_auth_kerb.c
+++ b/src/mod_auth_kerb.c
@@ -30,9 +30,12 @@ module AP_MODULE_DECLARE_DATA kerb_auth_module;
 
 #ifdef KRB5
 #include <krb5.h>
-#include <gssapi.h>
 #endif /* KRB5 */
 
+#ifdef GSSAPI
+#include <gssapi.h>
+#endif /* GSSAPI */
+
 #ifdef KRB4
 #include <krb.h>
 #endif /* KRB4 */
@@ -74,22 +77,29 @@ module AP_MODULE_DECLARE_DATA kerb_auth_module;
  Auth Configuration Structure
  ***************************************************************************/
 typedef struct {
-       char *krb_auth_type;
 #ifdef KRB4
        char *krb_4_srvtab;
 #endif /* KRB4 */
 #ifdef KRB5
        char *krb_5_keytab;
 #endif /* KRB5 */
+       int krb_auth_enable;
+       char *krb_auth_realms;
        int krb_authoritative;
-       char *krb_default_realm;
        int krb_fail_status;
        char *krb_force_instance;
 #ifdef KRB5
        int krb_forwardable;
 #endif /* KRB5 */
        char *krb_lifetime;
+#ifdef GSSAPI
+       int krb_method_gssapi;
+#endif /* GSSAPI */
+#ifdef KRB4
+       int krb_method_k4pass;
+#endif /* KRB4 */
 #ifdef KRB5
+       int krb_method_k5pass;
        char *krb_renewable;
 #endif /* KRB5 */
        int krb_save_credentials;
@@ -97,6 +107,13 @@ typedef struct {
        char *service_name;
 } kerb_auth_config;
 
+
+
+
+/*************************************************************************** 
+ GSSAPI Support Initialization
+ ***************************************************************************/
+#ifdef GSSAPI
 typedef struct {
    gss_ctx_id_t context;
    gss_cred_id_t server_creds;
@@ -118,6 +135,8 @@ cleanup_gss_connection(void *data)
    if (gss_conn->server_creds != GSS_C_NO_CREDENTIAL)
       gss_release_cred(&minor_status, &gss_conn->server_creds);
 }
+#endif /* GSSAPI */
+
 
 
 
@@ -130,7 +149,19 @@ static void *kerb_dir_config(MK_POOL *p, char *d)
        rec = (void *) ap_pcalloc(p, sizeof(kerb_auth_config));
        ((kerb_auth_config *)rec)->krb_fail_status = HTTP_UNAUTHORIZED;
        ((kerb_auth_config *)rec)->krb_authoritative = 0;
-       ((kerb_auth_config *)rec)->krb_auth_type = MK_PSTRDUP(p, "None");
+#ifdef GSSAPI
+       ((kerb_auth_config *)rec)->krb_method_gssapi = 0;
+#endif /* GSSAPI */
+#ifdef KRB4
+       ((kerb_auth_config *)rec)->krb_method_k4pass = 1;
+#endif /* KRB4 */
+#ifdef KRB5
+       ((kerb_auth_config *)rec)->krb_method_k5pass = 1;
+#ifdef KRB4
+       ((kerb_auth_config *)rec)->krb_method_k4pass = 0;
+#endif /* KRB4 */
+#endif /* KRB5 */
+       ((kerb_auth_config *)rec)->krb_auth_realms = "";
        return rec;
 }
 
@@ -155,33 +186,6 @@ static const char *kerb_set_fail_slot(cmd_parms *cmd, void *struct_ptr,
        return NULL;
 }
 
-/* these are either char *struct_ptr, char *arg or void *struct_ptr, const char *arg */
-static const char *kerb_set_type_slot(cmd_parms *cmd, void *struct_ptr,
-                                       const char *arg)
-{
-       int offset = (int) (long) cmd->info;
-#ifdef KRB5
-       if (!strncasecmp(arg, "v5", 2))
-               *(char **) ((char *)struct_ptr + offset) = MK_PSTRDUP(cmd->pool, "KerberosV5");
-       else
-#endif /* KRB5 */
-#ifdef KRB4
-       if (!strncasecmp(arg, "v4", 2))
-               *(char **) ((char *)struct_ptr + offset) = MK_PSTRDUP(cmd->pool, "KerberosV4");
-       else
-#endif /* KRB4 */
-       if (!strncasecmp(arg, "dualv5v4", 8))
-               *(char **) ((char *)struct_ptr + offset) = MK_PSTRDUP(cmd->pool, "KerberosDualV5V4");
-       else if
-          (!strncasecmp(arg, "dualv4v5", 8))
-               *(char **) ((char *)struct_ptr + offset) = MK_PSTRDUP(cmd->pool, "KerberosDualV4V5");
-#if defined(KRB4) && defined(KRB5)
-#endif /* KRB4 && KRB5 */
-       else
-               return "AuthKerberos must be V5, V4, DualV4V5, or DualV5V4.";
-       return NULL;
-}
-
 
 
 
@@ -192,10 +196,10 @@ static const char *kerb_set_type_slot(cmd_parms *cmd, void *struct_ptr,
 command_rec kerb_auth_cmds[] = {
        {
                "AuthKerberos",
-               kerb_set_type_slot,
-               (void*)XtOffsetOf(kerb_auth_config, krb_auth_type),
+               ap_set_flag_slot,
+               (void*)XtOffsetOf(kerb_auth_config, krb_auth_enable),
                OR_AUTHCFG,
-               TAKE1,
+               FLAG,
                "Permit Kerberos auth without AuthType requirement."
        },
 
@@ -231,12 +235,12 @@ command_rec kerb_auth_cmds[] = {
        },
 
        {
-               "KrbDefaultRealm",
+               "KrbAuthRealm",
                ap_set_string_slot,
-               (void*)XtOffsetOf(kerb_auth_config, krb_default_realm),
+               (void*)XtOffsetOf(kerb_auth_config, krb_auth_realms),
                OR_AUTHCFG,
-               TAKE1,
-               "Default realm to authenticate users against."
+               ITERATE,
+               "Realms to attempt authentication against (can be multiple)."
        },
 
        {
@@ -277,8 +281,39 @@ command_rec kerb_auth_cmds[] = {
                "Lifetime of tickets retrieved."
        },
 
+#ifdef GSSAPI
+       {
+               "KrbMethodGSSAPI",
+               ap_set_flag_slot,
+               (void*)XtOffsetOf(kerb_auth_config, krb_method_gssapi),
+               OR_AUTHCFG,
+               FLAG,
+               "Enable GSSAPI authentication."
+       },
+#endif /* GSSAPI */
+
+#ifdef KRB4
+       {
+               "KrbMethodK4Pass",
+               ap_set_flag_slot,
+               (void*)XtOffsetOf(kerb_auth_config, krb_method_k4pass),
+               OR_AUTHCFG,
+               FLAG,
+               "Enable Kerberos V4 password authentication."
+       },
+#endif /* KRB4 */
+
 #ifdef KRB5
        {
+               "KrbMethodK5Pass",
+               ap_set_flag_slot,
+               (void*)XtOffsetOf(kerb_auth_config, krb_method_k5pass),
+               OR_AUTHCFG,
+               FLAG,
+               "Enable Kerberos V5 password authentication."
+       },
+
+       {
                "KrbRenewable",
                ap_set_string_slot,
                (void*)XtOffsetOf(kerb_auth_config, krb_renewable),
@@ -320,10 +355,10 @@ command_rec kerb_auth_cmds[] = {
 #else
 #ifdef APXS2
 static const command_rec kerb_auth_cmds[] = {
-       AP_INIT_TAKE1(
+       AP_INIT_FLAG(
                "AuthKerberos",
                kerb_set_type_slot,
-               (void*)APR_XtOffsetOf(kerb_auth_config, krb_auth_type),
+               (void*)APR_XtOffsetOf(kerb_auth_config, krb_auth_enable),
                OR_AUTHCFG,
                "Permit Kerberos auth without AuthType requirement."
        ),
@@ -356,12 +391,12 @@ static const command_rec kerb_auth_cmds[] = {
                "Refuse to pass request down to lower modules."
        ),
 
-       AP_INIT_TAKE1(
-               "KrbDefaultRealm",
+       AP_INIT_ITERATE(
+               "KrbAuthRealm",
                ap_set_string_slot,
-               (void*)APR_XtOffsetOf(kerb_auth_config, krb_default_realm),
+               (void*)APR_XtOffsetOf(kerb_auth_config, krb_auth_realms),
                OR_AUTHCFG,
-               "Default realm to authenticate users against."
+               "Realm to attempt authentication against (can be multiple)."
        ),
 
        AP_INIT_TAKE1(
@@ -398,7 +433,35 @@ static const command_rec kerb_auth_cmds[] = {
                "Lifetime of tickets retrieved."
        ),
 
+#ifdef GSSAPI
+       AP_INIT_FLAG(
+               "KrbMethodGSSAPI",
+               ap_set_flag_slot,
+               (void*)APR_XtOffsetOf(kerb_auth_config, krb_method_gssapi),
+               OR_AUTHCFG,
+               "Enable GSSAPI authentication."
+       ),
+#endif /* GSSAPI */
+
+#ifdef KRB4
+       AP_INIT_FLAG(
+               "KrbMethodK4Pass",
+               ap_set_flag_slot,
+               (void*)APR_XtOffsetOf(kerb_auth_config, krb_method_k4pass),
+               OR_AUTHCFG,
+               "Enable Kerberos V4 password authentication."
+       ),
+#endif /* KRB4 */
+
 #ifdef KRB5
+       AP_INIT_FLAG(
+               "KrbMethodK5Pass",
+               ap_set_flag_slot,
+               (void*)APR_XtOffsetOf(kerb_auth_config, krb_method_k5pass),
+               OR_AUTHCFG,
+               "Enable Kerberos V5 password authentication."
+       ),
+
        AP_INIT_TAKE1(
                "KrbRenewable",
                ap_set_string_slot,
@@ -444,14 +507,18 @@ krb5_verify_user(krb5_context context, krb5_principal principal,
                 krb5_ccache ccache, const char *password, krb5_boolean secure,
                 const char *service)
 {
-   int problem;
+   int ret;
+   krb5_context kcontext;
+   krb5_principal server, client;
    krb5_timestamp now;
    krb5_creds my_creds;
+   krb5_flags options = 0;
+   krb5_principal me = NULL;
    krb5_data tgtname = {
       0,
       KRB5_TGS_NAME_SIZE,
       KRB5_TGS_NAME
-   }
+   };
 
    memset((char *)&my_creds, 0, sizeof(my_creds));
    my_creds.client = principal;
@@ -477,7 +544,7 @@ krb5_verify_user(krb5_context context, krb5_principal principal,
    */
 
    ret = krb5_get_in_tkt_with_password(kcontext, options, 0, NULL, 0,
-                                      pass, ccache, &my_creds, 0);
+                                      password, ccache, &my_creds, 0);
    if (ret) {
        return ret;
    }
@@ -645,6 +712,7 @@ int kerb5_password_validate(request_rec *r, const char *user, const char *pass)
           lifetime = atoi(conf->krb_lifetime);
        }
 
+/* ????
        code = krb5_cc_gen_new(kcontext, &krb5_mcc_ops, &ccache);
        if (code) {
           snprintf(errstr, sizeof(errstr), "krb5_cc_gen_new(): %.100s",
@@ -653,8 +721,9 @@ int kerb5_password_validate(request_rec *r, const char *user, const char *pass)
           ret = SERVER_ERROR;
           goto end;
        }
+*/
 
-       realms = conf->krb_default_realm;
+       realms = conf->krb_auth_realms;
        do {
           code = 0;
           if (realms) {
@@ -794,6 +863,13 @@ int kerb4_password_validate(request_rec *r, const char *user, const char *pass)
 }
 #endif /* KRB4 */
 
+
+
+
+/*************************************************************************** 
+ GSSAPI Validation
+ ***************************************************************************/
+#ifdef GSSAPI
 static int
 get_gss_creds(request_rec *r,
               kerb_auth_config *conf,
@@ -1013,6 +1089,9 @@ end:
 
   return ret;
 }
+#endif /* GSSAPI */
+
+
 
 
 /*************************************************************************** 
@@ -1022,9 +1101,6 @@ int kerb_authenticate_user(request_rec *r)
 {
        const char *name;               /* AuthName specified */
        const char *type;               /* AuthType specified */
-       int KerberosV5 = 0;             /* Kerberos V5 check enabled */
-       int KerberosV4 = 0;             /* Kerberos V4 check enabled */
-       int KerberosV4first = 0;        /* Kerberos V4 check first */
        const char *sent_pw;            /* Password sent by browser */
        int res;                        /* Response holder */
        int retcode;                    /* Return code holder */
@@ -1040,38 +1116,8 @@ int kerb_authenticate_user(request_rec *r)
 
        type = ap_auth_type(r);
 
-       if (type != NULL) {
-#ifdef KRB5
-               if ((strncasecmp(type, "KerberosV5", 10) == 0) ||
-                   (strncasecmp(conf->krb_auth_type, "KerberosV5", 10) == 0)) {
-                       KerberosV5 = 1;
-               }
-#endif /* KRB5 */
-
-#ifdef KRB4
-               if ((strncasecmp(type, "KerberosV4", 10) == 0) ||
-                   (strncasecmp(conf->krb_auth_type, "KerberosV4", 10) == 0)) {
-                       KerberosV4 = 1;
-               }
-#endif /* KRB4 */
-
-#if defined(KRB5) && defined(KRB4)
-               if ((strncasecmp(type, "KerberosDualV5V4", 15) == 0) ||
-                   (strncasecmp(conf->krb_auth_type, "KerberosDualV5V4", 15) == 0)) {
-                       KerberosV5 = 1;
-                       KerberosV4 = 1;
-               }
-
-               if ((strncasecmp(type, "KerberosDualV4V5", 15) == 0) ||
-                   (strncasecmp(conf->krb_auth_type, "KerberosDualV4V5", 15) == 0)) {
-                       KerberosV5 = 1;
-                       KerberosV4 = 1;
-                       KerberosV4first = 1;
-               }
-#endif /* KRB5 && KRB4 */
-       }
-
-       if (!KerberosV4 && !KerberosV5) {
+       if (!conf->krb_auth_enable &&
+           (type == NULL || (strncasecmp(type, "Kerberos", 8) != 0))) {
                if (conf->krb_authoritative) {
                        return HTTP_UNAUTHORIZED;
                }
@@ -1100,8 +1146,23 @@ int kerb_authenticate_user(request_rec *r)
 
        retcode = DECLINED;
 
+#ifdef GSSAPI
+       if (conf->krb_method_gssapi && retcode != OK) {
+/*
+ Whatever you need to do here  =)
+               MK_AUTH_TYPE = "GSSAPI";
+               if (kerb5_password_validate(r, MK_USER, sent_pw)) {
+                       retcode = OK;
+               }
+               else {
+                       retcode = conf->krb_fail_status;
+               }
+*/
+       }
+#endif /* GSSAPI */
+
 #ifdef KRB5
-       if (KerberosV5 && !KerberosV4first && retcode != OK) {
+       if (conf->krb_method_k5pass && retcode != OK) {
                MK_AUTH_TYPE = "KerberosV5";
                if (kerb5_password_validate(r, MK_USER, sent_pw)) {
                        retcode = OK;
@@ -1114,7 +1175,7 @@ int kerb_authenticate_user(request_rec *r)
 #endif /* KRB5 */
 
 #ifdef KRB4
-       if (KerberosV4 && retcode != OK) {
+       if (conf->krb_method_k4pass && retcode != OK) {
                MK_AUTH_TYPE = "KerberosV4";
                if (kerb4_password_validate(r, MK_USER, sent_pw)) {
                        retcode = OK;
@@ -1125,18 +1186,6 @@ int kerb_authenticate_user(request_rec *r)
        }
 #endif /* KRB4 */
 
-#if defined(KRB5) && defined(KRB4)
-       if (KerberosV5 && KerberosV4first && retcode != OK) {
-               MK_AUTH_TYPE = "KerberosV5";
-               if (kerb5_password_validate(r, MK_USER, sent_pw)) {
-                       retcode = OK;
-               }
-               else {
-                       retcode = conf->krb_fail_status;
-               }
-       }
-#endif /* KRB5 && KRB4 */
-
        if (conf->krb_authoritative && retcode == DECLINED) {
                return HTTP_UNAUTHORIZED;
        }