[30813] in Kerberos

home	help	back	first	fref	pref	prev	next	nref	lref	last	post

Re: WS-Security and GSS-API: How do I get the session key?

daemon@ATHENA.MIT.EDU (weijun.wang@sun.com)
Fri Mar 6 14:03:25 2009

From: weijun.wang@sun.com
Date: Thu, 5 Mar 2009 18:29:17 -0800 (PST)
Message-ID: <e1426fee-e5a5-41a9-aafa-48653903cfb0@v35g2000pro.googlegroups.com>
Mime-Version: 1.0
X-Complaints-To: groups-abuse@google.com
Complaints-To: groups-abuse@google.com
To: kerberos@mit.edu
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit

Hi Luke

On Feb 24, 9:36 pm, Luke Howard <lu...@padl.com> wrote:
> > I don't recall offhand if there's been an IETF draft proposing the
> > specific extension we've got for extracting the session key.
>

>    major = gss_inquire_sec_context_by_oid(&minor,
>                                          ctx,
>                                          GSS_C_INQ_SSPI_SESSION_KEY,
>                                          &skey);

Cool, we (Java SE Team at Sun) are also preparing to add a new method
getSessionKey() to OpenJDK's JGSS-API for Java EE needs.

BTW, I read the krb5-1.7 codes and notice you're supporting some other
OIDs for this new function:

  KRB5_GET_TKT_FLAGS
  KRB5_EXTRACT_AUTHZ_DATA_FROM_SEC_CONTEXT
  KRB5_EXPORT_LUCID_SEC_CONTEXT
  KRB5_EXTRACT_AUTHTIME_FROM_SEC_CONTEXT

I wonder how widely they are required and whether we should also
support them. Can you give me some background info?

Thanks
Weijun
________________________________________________
Kerberos mailing list           Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

home	help	back	first	fref	pref	prev	next	nref	lref	last	post