anchor.diff:  ;; -------------------- for everyone ------------
   ;; everyone calls this, but the semantics are different if you are a server or client 
   
  +;; (defclass kerberos-credential ()
  +;;   ())
  +
  +;; (defclass kerberos-client-credential (kerberos-credential)
  +;;   ((tgt :initarg :tgt :reader client-credential-tgt)))
  +
  +;; (defclass kerberos-server-credential (kerberos-credential)
  +;;   ((keylist :initarg :keylist :reader server-credential-keylist)))
  +
  +
  +
   (defclass kerberos-context ()
     ((creds :initarg :creds :initform nil :accessor kerberos-context-creds)
      (req :initarg :req :initform nil :accessor kerberos-context-req)
  -   (buffer :initform nil :initarg :buffer :accessor kerberos-context-buffer)
      (key :initform nil :accessor kerberos-context-key)
  -   (seqno :initform 0 :accessor kerberos-context-seqno)
  -   (initiator :initform nil :initarg :initiator :accessor kerberos-context-initiator)))
  -
  -(defmethod glass:acquire-credential ((mech-type (eql :kerberos)) 
  -				     &key principal username password realm kdc-address till-time keylist)
  +   (seqno :initform 0 :accessor kerberos-context-seqno)))
  +
  +(defclass kerberos-client-context (kerberos-context)
  +  ())
  +
  +(defclass kerberos-server-context (kerberos-context)
  +  ())
  +
  +(defmethod print-object ((context kerberos-context) stream)
  +  (print-unreadable-object (context stream :type t)))
  +
  +;; it is assumed a TGT is already available via a previous call to login-user. 
  +(defmethod glass:acquire-credential ((mech-type (eql :kerberos)) &key principal realm keylist)
     (cond
  -    ((and kdc-address username password realm)
  -     ;; client logging into the domain
  -     (let ((tgt (request-tgt username password realm 
  -			      :kdc-address kdc-address
  -			      :till-time till-time)))
  -       (let ((creds (request-credentials tgt principal :till-time till-time)))
  -	 (make-instance 'kerberos-context
  -			:creds creds
  -			:initiator t))))
  -    ((and (not kdc-address) username password realm)
  -     ;; application server generatigna keylist
  -     (make-instance 'kerberos-context
  -		    :creds (generate-keylist username password realm)))
       (keylist 
        ;; application server providing keylist
  -     (make-instance 'kerberos-context 
  +     (make-instance 'kerberos-server-context 
                       :creds keylist))
  -    (realm
  +    (t 
        ;; try to get a tgt we already have
  -     (let ((tgt (find-if (lambda (tgt)
  -			   (string= (login-token-realm tgt) realm))
  -			 *tgt-cache*)))
  -       (unless tgt (error "No TGT for the specified user, login by providing user credentials."))
  -       (let ((creds (request-credentials tgt principal :till-time till-time)))
  -	 (make-instance 'kerberos-context
  +     (let ((tgt (if realm
  +		    (find-if (lambda (tgt)
  +			       (string= (login-token-realm tgt) realm))
  +			     *tgt-cache*)
  +		    (first *tgt-cache*))))
  +       (unless tgt (error 'glass:gss-error :major :no-cred)) ;;(error "No TGT for the specified user, call LOGIN-USER first."))
  +       (let ((creds (request-credentials tgt principal)))
  +	 (make-instance 'kerberos-client-context
   			:creds creds
  -			:initiator t))))
  -    (t (error "must provide a realm"))))
  +			:initiator t))))))
   
   ;; ----------- for the client ---------------
         
  -(defmethod glass:initialize-security-context ((context kerberos-context) &key mutual)
  +;; FIXME: need some mechanism to indicate whether more exhanges are required
  +(defmethod glass:initialize-security-context ((context kerberos-client-context) &key mutual)
     (let* ((req (make-ap-request (kerberos-context-creds context) 
   			       :mutual mutual
  -			       :seqno (kerberos-context-seqno context))) ;; FIXME: also need the checksum!
  +			       :seqno (kerberos-context-seqno context))) ;; FIXME: also need the special packed checksum!
   	 (buffer (pack-initial-context-token req)))
       (setf (kerberos-context-req context) req
  -	  (kerberos-context-buffer context) buffer
   	  (kerberos-context-key context)
   	  ;; the session key can be found in the crednetials (which is a kdc-rep)
   	  (enc-kdc-rep-part-key (kdc-rep-enc-part (kerberos-context-creds context))))
  
positive.code: 	 (req (kerberos-context-req context))
  	 (session-key (subseq (encryption-key-value (kerberos-context-key context))
  			      0 8))
  	 (initiator (kerberos-context-initiator context)))
      ;; get the seqno, cksum and encrypted body
      (let ((eseqno (subseq tok 8 16))
  	  (cksum (subseq tok 16 24))
  
negative.code:   (let* ((req (kerberos-context-req context))
  	 (session-key (subseq (encryption-key-value (kerberos-context-key context))
  			      0 8))
  	 (initiator (typep context 'kerberos-client-context))
  	 (message (concatenate '(vector (unsigned-byte 8)) message)))
      ;; start by padding the message
      (let* ((len (length message))
  