{"action":"created","issue":{"url":"https://api.github.com/repos/pythongssapi/python-gssapi/issues/96","repository_url":"https://api.github.com/repos/pythongssapi/python-gssapi","labels_url":"https://api.github.com/repos/pythongssapi/python-gssapi/issues/96/labels{/name}","comments_url":"https://api.github.com/repos/pythongssapi/python-gssapi/issues/96/comments","events_url":"https://api.github.com/repos/pythongssapi/python-gssapi/issues/96/events","html_url":"https://github.com/pythongssapi/python-gssapi/issues/96","id":136155995,"number":96,"title":"the code for accepting delegated credentials is incorrect","user":{"login":"simo5","id":8332609,"avatar_url":"https://avatars.githubusercontent.com/u/8332609?v=3","gravatar_id":"","url":"https://api.github.com/users/simo5","html_url":"https://github.com/simo5","followers_url":"https://api.github.com/users/simo5/followers","following_url":"https://api.github.com/users/simo5/following{/other_user}","gists_url":"https://api.github.com/users/simo5/gists{/gist_id}","starred_url":"https://api.github.com/users/simo5/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/simo5/subscriptions","organizations_url":"https://api.github.com/users/simo5/orgs","repos_url":"https://api.github.com/users/simo5/repos","events_url":"https://api.github.com/users/simo5/events{/privacy}","received_events_url":"https://api.github.com/users/simo5/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/pythongssapi/python-gssapi/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"DirectXMan12","id":119737,"avatar_url":"https://avatars.githubusercontent.com/u/119737?v=3","gravatar_id":"","url":"https://api.github.com/users/DirectXMan12","html_url":"https://github.com/DirectXMan12","followers_url":"https://api.github.com/users/DirectXMan12/followers","following_url":"https://api.github.com/users/DirectXMan12/following{/other_user}","gists_url":"https://api.github.com/users/DirectXMan12/gists{/gist_id}","starred_url":"https://api.github.com/users/DirectXMan12/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DirectXMan12/subscriptions","organizations_url":"https://api.github.com/users/DirectXMan12/orgs","repos_url":"https://api.github.com/users/DirectXMan12/repos","events_url":"https://api.github.com/users/DirectXMan12/events{/privacy}","received_events_url":"https://api.github.com/users/DirectXMan12/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/pythongssapi/python-gssapi/milestones/8","html_url":"https://github.com/pythongssapi/python-gssapi/milestones/1.1.5","labels_url":"https://api.github.com/repos/pythongssapi/python-gssapi/milestones/8/labels","id":1420554,"number":8,"title":"1.1.5","description":"","creator":{"login":"frozencemetery","id":468294,"avatar_url":"https://avatars.githubusercontent.com/u/468294?v=3","gravatar_id":"","url":"https://api.github.com/users/frozencemetery","html_url":"https://github.com/frozencemetery","followers_url":"https://api.github.com/users/frozencemetery/followers","following_url":"https://api.github.com/users/frozencemetery/following{/other_user}","gists_url":"https://api.github.com/users/frozencemetery/gists{/gist_id}","starred_url":"https://api.github.com/users/frozencemetery/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/frozencemetery/subscriptions","organizations_url":"https://api.github.com/users/frozencemetery/orgs","repos_url":"https://api.github.com/users/frozencemetery/repos","events_url":"https://api.github.com/users/frozencemetery/events{/privacy}","received_events_url":"https://api.github.com/users/frozencemetery/received_events","type":"User","site_admin":false},"open_issues":3,"closed_issues":0,"state":"open","created_at":"2015-11-19T19:28:34Z","updated_at":"2016-02-24T19:22:45Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2016-02-24T19:05:16Z","updated_at":"2016-02-25T16:07:46Z","closed_at":null,"body":"Both the low level and the high level API unconditionally try at any step of the context extablishment (on the acceptor side) to return delegated credentials and create the appropriate classes.\r\n\r\nDelegated credentials are returned only if the context establishment return GSS_S_COMPLETE and are undefined in any other step.\r\n\r\nIn the high level API care need to be taken so that if the lower level returns None the delegated_creds should be set straight to None as well, as calling Credentials(None) will istead try to fetch the default credentials for the process, and that is an error."},"comment":{"url":"https://api.github.com/repos/pythongssapi/python-gssapi/issues/comments/188855548","html_url":"https://github.com/pythongssapi/python-gssapi/issues/96#issuecomment-188855548","issue_url":"https://api.github.com/repos/pythongssapi/python-gssapi/issues/96","id":188855548,"user":{"login":"DirectXMan12","id":119737,"avatar_url":"https://avatars.githubusercontent.com/u/119737?v=3","gravatar_id":"","url":"https://api.github.com/users/DirectXMan12","html_url":"https://github.com/DirectXMan12","followers_url":"https://api.github.com/users/DirectXMan12/followers","following_url":"https://api.github.com/users/DirectXMan12/following{/other_user}","gists_url":"https://api.github.com/users/DirectXMan12/gists{/gist_id}","starred_url":"https://api.github.com/users/DirectXMan12/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DirectXMan12/subscriptions","organizations_url":"https://api.github.com/users/DirectXMan12/orgs","repos_url":"https://api.github.com/users/DirectXMan12/repos","events_url":"https://api.github.com/users/DirectXMan12/events{/privacy}","received_events_url":"https://api.github.com/users/DirectXMan12/received_events","type":"User","site_admin":false},"created_at":"2016-02-25T16:07:45Z","updated_at":"2016-02-25T16:07:45Z","body":"So the question is: does \"undefined\" mean \"up to the implementation\" or \"in an invalid state\" here?\r\nIf it means \"up to the implementation\", it seems to me according to 2744, we can count on:\r\n\r\n- if DELEG_FLAG is false, delegated_creds is NULL\r\n- if DELEG_FLAG is true, delegated_creds is *valid*\r\n- DELEG_FLAG will always be either true or false\r\n\r\nmeaning that it's fine to just check NULL.  My concern is that if we add more complicated logic than \"is it NULL or not\" and miss a valid pointer, we'll have a memory leak, since \r\n\r\n> If a credential handle is returned, the associated resources must be released by the application after use with a call to gss_release_cred()\r\n\r\n(this phrasing seems to support the case that delegated_creds will always be either NULL or valid).\r\n\r\ncc @simo5 @kaduk WDYT"}}