Andres Freund <andres(at)anarazel(dot)de> writes:
> Initializing the gss cache at all isn't so much the problem. It's that we do
> it for every connection. And that doing so requires locking inside gss. So
> maybe we could just globally cache that gss isn't available, instead of
> rediscovering it over and over for every new connection.
I had the impression that krb5 already had such a cache internally.
Maybe they don't cache the "failed" state though. I doubt we'd
want to either in long-lived processes --- what if the user
installs the credential while we're running?
regards, tom lane