[2365] in Kerberos
Re: GSSAPI documentation for Kerberos
daemon@ATHENA.MIT.EDU (Theodore Ts'o)
Tue Nov 10 20:17:28 1992
Date: Tue, 10 Nov 92 19:58:45 EST
From: tytso@Athena.MIT.EDU (Theodore Ts'o)
To: nessett@ocfmail.ocf.llnl.gov
Cc: kerberos@Athena.MIT.EDU, nessett@ocfmail.ocf.llnl.gov
In-Reply-To: Danny Nessett's message of Tue, 10 Nov 92 14:26:50 PST,
Date: Tue, 10 Nov 92 14:26:50 PST
From: nessett@ocfmail.ocf.llnl.gov (Danny Nessett)
Cliff Neuman suggested that I contact you about documentation on the GSSAPI
interface for Kerberos. We are interested in using this interface in an
application we are working on. In particular we would like to know the
subset of GSSAPI that is implemented for Kerberos V5 and what the C language
bindings are. We are hoping there is more documentation than the
source code.
A couple of points; I actually haven't looked at the GSSAPI interface in
a while; it did not change between Beta 1 and Beta 2, mostly because my
attention was focused on other issues, and there really wasn't any
clients which have been written against the GSSAPI interface I could use
to do testing.
I believe all of the calls listed in the C binding specification of the
GSSAPI were implemented, and they've been each unit tested, although I
never had a chance to try compiling them with a sample application to
do a full integration test --- this is one reason why the README in that
directory still states that the code is Alpha-quality.
Unfortunately, the GSSAPI does not specify quite enough
functionality such that it is possible to write a completely generic
client. For example, the flogin provided with SPX uses the following
non-specified GSSAPI routines:
/*
* WARNING: UNOFFICIAL GSSAPI ROUTINE!!
*
* gss__stash_default_cred() - Allows remote peer to bind delegated credential
* handle with remote application. Called by applications to set the
* delegated credentials as the default credentials for a process.
*
* OM_uint32 *minor_status (output) - mechanism specific status code
* gss_cred_id_t delegated_cred_handle (input) - handle for credentials
* received from context initiator.
*
*/
/*
* WARNING: UNOFFICIAL GSSAPI ROUTINE!!
*
* gss__check_authorization() - Check authorization rights for principal
* using the ACL file specified.
*
* OM_uint32 *minor_status (output) - mechanism specific status code
* gss_buffer_t fullname_buffer (input) - principal's printable name
* gss_buffer_t luser_buffer (input) - local user name
* gss_buffer_t acl_file_buffer (input) - acl file name
* gss_buffer_t service_buffer (input) - service name
* int access_mode (input) - type of access (rwx, etc.)
* gss_buffer_t resource_buffer (input) - resource name
*
*/
I am _not_ advocating that these functions be added to the
GSSAPI, since I don't believe they are quite general enough, especially
the gss__check_authorization() function. However, they are required if
you want to try linking the flogin GSSAPI client application which came
with SPX, and I never got around to implementing them for the Kerberos
GSSAPI library. Other than that, unless I overlooked something, I
believe it should be all there.
- Ted
P.S. If someone else has written some GSSAPI client programs, I would
be interested in hearing about them. Also, if someone is interested in
working with the Kerberos V5 GSSAPI implementation, and improving it,
please feel free to do so, and send me your improvements. I do plan to
polish the GSSAPI library eventually, but not in the immediate future; I
want to concentrate on the core portions of Kerberos V5 first.
