Numerous times i have met the expression SASL/GSSAPI. I have searched Google many times, but i simply do no understand what it is and how it relate to Kerberos.

Anybody that have a simple explanation on this?

2 Answers 2


SASL and GSSAPI are frameworks that various authentication providers can be plugged into. People wishing to use Kerberos authentication in an app that supports SASL or GSSAPI need only to provide the appropriate Kerberos plugin, rather than rewrite the app with Kerberos-specific code.

  • 2
    Indeed, as I said, "SASL . . . that various authentication providers can be plugged into". They are two different frameworks that you can plug various authentication providers, such as Kerberos or NTLM, into.
    – dsolimano
    May 10, 2010 at 2:13
  • SASL is more of a implementation specification usually for text based protocols (like SMTP, IMAP, etc). GSSAPI is an application interface definition for plugins that support various authentications mechanisms. SASL can use GSSAPI to extend it's auth mechanisms.
    – Chris S
    Jun 4, 2011 at 0:52
  • 1
    without giving a concrete '''example''' which actual provider plugs into which real-world framework, most people don't know what you are talking about.
    – dotbit
    Dec 30, 2019 at 16:03

SASL stands for Simple Authentication and Security Layer; it's a framework that allows developers to implement different authentication mechanisms, and allows clients and servers to negotiate a mutually acceptable mechanism for each connection (rather than hard-coding or pre-configuring them).

GSSAPI stands for Generic Security Services Application Program Interface; it is usually made available as one of the mechanisms that SASL can use. It is itself another framework for developing and implementing various authentication mechanisms. These mechanisms include Kerberos, NTLM, and SPNEGO (Simple and Protected GSSAPI Negotiation Mechanism): a GSSAPI pseudo-mechanism which allows GSSAPI-compatible clients to negotiate which GSSAPI mechanism they want to use.

Here's an example to help make this a little clearer (brutally simplified for clarity's sake):

  1. Client connects to server and says, "I support SASL! How should I authenticate myself?"
  2. Server receives the connection and responds, "I also support SASL, and can use these mechanisms, in descending order of preference: GSSAPI, CRAM-MD5, PLAIN."
  3. Client responds, "Of the choices, I'd like to use GSSAPI."
  4. Server responds "GSSAPI? Capital. I support Kerberos and NTLM."
  5. Client responds "Let's use Kerberos. Here's my encrypted ticket etc. etc."
  • 1
    A great example for a quote from Albert Einstein: "If you can't explain it simply, you don't understand it well enough." :) Dec 15, 2022 at 10:08
  • From what I read in the wiki. On step 2, the server should include NTLM, not after the client has chosen GSSAPI?
    – DrizzleX
    May 20, 2023 at 12:56

You must log in to answer this question.