diff --git a/lib/dns/config/confctx.c b/lib/dns/config/confctx.c
index 441e3334f1..24322a978d 100644
--- a/lib/dns/config/confctx.c
+++ b/lib/dns/config/confctx.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: confctx.c,v 1.91 2000/10/04 18:47:23 bwelling Exp $ */
+/* $Id: confctx.c,v 1.92 2000/10/12 00:38:29 bwelling Exp $ */
 
 #include <config.h>
 
@@ -1163,6 +1163,7 @@ dns_c_ctx_optionsprint(FILE *fp, int indent, dns_c_options_t *options)
 			options->tkeydhkeycp, options->tkeydhkeyi);
 	}
 
+	PRINT_CHAR_P(tkeygsscred, "tkey-gssapi-credential");
 
 	dns_c_printtabs(fp, indent);
 	fprintf(fp,"};\n");
@@ -1635,6 +1636,7 @@ dns_c_ctx_optionsnew(isc_mem_t *mem, dns_c_options_t **options)
 	opts->tkeydhkeycp = NULL;
 	opts->tkeydhkeyi = 0;
 	opts->tkeydomain = NULL;
+	opts->tkeygsscred = NULL;
 
 	opts->also_notify = NULL;
 
@@ -1785,6 +1787,7 @@ dns_c_ctx_optionsdelete(dns_c_options_t **opts)
 
 	FREESTRING(tkeydomain);
 	FREESTRING(tkeydhkeycp);
+	FREESTRING(tkeygsscred);
 
 	if (options->also_notify != NULL) {
 		dns_c_iplist_detach(&options->also_notify);
@@ -1978,6 +1981,23 @@ dns_c_ctx_settkeydhkey(dns_c_ctx_t *cfg,
 }
 
 
+isc_result_t
+dns_c_ctx_settkeygsscred(dns_c_ctx_t *cfg, const char *newval)
+{
+	isc_result_t res;
+
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
+
+	res = make_options(cfg);
+	if (res != ISC_R_SUCCESS) {
+		return (res);
+	}
+
+	return (cfg_set_string(cfg->options,
+			       &cfg->options->tkeygsscred,
+			       newval));
+}
+
 
 
 
@@ -2247,6 +2267,24 @@ dns_c_ctx_gettkeydhkey(dns_c_ctx_t *cfg,
 }
 
 
+isc_result_t
+dns_c_ctx_gettkeygsscred(dns_c_ctx_t *cfg, char **retval)
+{
+	REQUIRE(DNS_C_CONFCTX_VALID(cfg));
+	REQUIRE(retval != NULL);
+
+	if (cfg->options == NULL) {
+		return (ISC_R_NOTFOUND);
+	}
+
+	REQUIRE(DNS_C_CONFOPT_VALID(cfg->options));
+
+	*retval = cfg->options->tkeygsscred;
+
+	return (*retval == NULL ? ISC_R_NOTFOUND : ISC_R_SUCCESS);
+}
+
+
 
 isc_result_t
 dns_c_ctx_addlisten_on(dns_c_ctx_t *cfg, in_port_t port,
diff --git a/lib/dns/config/confparser.y.dirty b/lib/dns/config/confparser.y.dirty
index d943449ae9..4f36e987f4 100644
--- a/lib/dns/config/confparser.y.dirty
+++ b/lib/dns/config/confparser.y.dirty
@@ -17,7 +17,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: confparser.y.dirty,v 1.19 2000/10/09 18:20:18 bwelling Exp $ */
+/* $Id: confparser.y.dirty,v 1.20 2000/10/12 00:38:27 bwelling Exp $ */
 
 #include <config.h>
 
@@ -389,6 +389,7 @@ static isc_boolean_t	int_too_big(isc_uint32_t base, isc_uint32_t mult);
 %token		L_TCP_CLIENTS
 %token		L_TKEY_DHKEY
 %token		L_TKEY_DOMAIN
+%token		L_TKEY_GSSAPI_CREDENTIAL
 %token		L_TOPOLOGY
 %token		L_TRANSFERS
 %token		L_TRANSFERS_IN
@@ -687,6 +688,23 @@ option: /* Empty */
 
 		isc_mem_free(memctx, $2);
 	}
+	| L_TKEY_GSSAPI_CREDENTIAL L_QSTRING
+	{
+		tmpres = dns_c_ctx_settkeygsscred(currcfg, $2);
+
+		if (tmpres == ISC_R_EXISTS) {
+			parser_error(ISC_FALSE,
+				     "cannot redefine tkey-gssapi-credential");
+			YYABORT;
+		} else if (tmpres != ISC_R_SUCCESS) {
+			parser_error(ISC_FALSE,
+				     "set tkey-gssapi-credential error: %s: %s",
+				     isc_result_totext(tmpres), $2);
+			YYABORT;
+		}
+
+		isc_mem_free(memctx, $2);
+	}
 	| L_PIDFILE L_QSTRING
 	{
 		tmpres = dns_c_ctx_setpidfilename(currcfg, $2);
@@ -5844,6 +5862,7 @@ static struct token keyword_tokens [] = {
 	{ "tcp-clients",		L_TCP_CLIENTS },
 	{ "tkey-dhkey",			L_TKEY_DHKEY },
 	{ "tkey-domain",		L_TKEY_DOMAIN },
+	{ "tkey-gssapi-credential",	L_TKEY_GSSAPI_CREDENTIAL },
 	{ "topology",			L_TOPOLOGY },
 	{ "transfer-format",		L_TRANSFER_FORMAT },
 	{ "transfer-source",		L_TRANSFER_SOURCE },
diff --git a/lib/dns/include/dns/confctx.h b/lib/dns/include/dns/confctx.h
index a34dffe8c5..1b891a88fa 100644
--- a/lib/dns/include/dns/confctx.h
+++ b/lib/dns/include/dns/confctx.h
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: confctx.h,v 1.53 2000/10/04 18:47:17 bwelling Exp $ */
+/* $Id: confctx.h,v 1.54 2000/10/12 00:38:30 bwelling Exp $ */
 
 #ifndef DNS_CONFCTX_H
 #define DNS_CONFCTX_H 1
@@ -196,6 +196,7 @@ struct dns_c_options {
 	char 		       *tkeydhkeycp;
 	isc_uint32_t		tkeydhkeyi;
 	char 		       *tkeydomain;
+	char 		       *tkeygsscred;
 
 	dns_notifytype_t       *notify;
 	dns_c_iplist_t	       *also_notify;
@@ -708,6 +709,10 @@ isc_result_t dns_c_ctx_settkeydomain(dns_c_ctx_t *cfg, const char *newval);
 isc_result_t dns_c_ctx_gettkeydomain(dns_c_ctx_t *cfg, char **retval);
 /* XXX need unset version */
 
+isc_result_t dns_c_ctx_settkeygsscred(dns_c_ctx_t *cfg, const char *newval);
+isc_result_t dns_c_ctx_gettkeygsscred(dns_c_ctx_t *cfg, char **retval);
+/* XXX need unset version */
+
 
 isc_result_t dns_c_ctx_setalsonotify(dns_c_ctx_t *ctx, dns_c_iplist_t *newval);
 isc_result_t dns_c_ctx_getalsonotify(dns_c_ctx_t *ctx, dns_c_iplist_t **ret);