Why is Kerberos programming so frustratingly difficult?

Question

I have implemented an application a few years ago using both kerberos functions and GSSAPI to authenticate to a kerberos server but when I look back at the code, it always took time to understand what those calls do (I think I need to put comments on my comments).

What is the best way to understand how kerberos works and how to effectively debug problems across the entire setup?

Answer 1

The Moron's Guide to Kerberos, Version 2.0.

Answer 2

Try looking at the Heimdal code: http://www.h5l.org

Very well commented and they have a great doxygen interface.