[15563] in Kerberos_V5_Development
Re: Creating GSSAPI initiate credential using keytab entry
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Mar 8 12:11:32 2010
From: Greg Hudson <ghudson@mit.edu>
To: Richard Evans <richard.evans@datanomic.com>
In-Reply-To: <974066EF77EEA44EB8AED6ADA05DBD02019A8225@THHS2EXBE1X.hostedservice2.net>
Date: Mon, 08 Mar 2010 12:11:27 -0500
Message-ID: <1268068287.18898.334.camel@ray>
Mime-Version: 1.0
Cc: "krbdev@mit.edu" <krbdev@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Mon, 2010-03-08 at 05:00 -0500, Richard Evans wrote:
> 1. Use a KRB5 API call to get the credentials for the relevant keytab
> entry
> 2. Store them in a temporary cache file (I don't want to mess with the
> cache for the current user)
> 3. Set the KRB5CCNAME environment variable to point at this location
> 4. Call gss_acquire_cred to get the initiator credentials
> 5. Restore the previous value of KRB5CCNAME, if any
> 6. Delete the temporary cache file
I don't have example code on hand but I can provide some guidance on
what APIs to use.
* Start by creating a krb5 context with krb5_init_context(). Clean this
up later with krb5_free_context().
* Create a ccache with krb5_cc_new_unique(). Pass "MEMORY" as the type
parameter and NULL as the hint. Clean this up later with
krb5_cc_destroy().
* Open your keytab with krb5_kt_default() or krb5_kt_resolve(). Clean
this up later with krb5_kt_close().
* Acquire the credential with krb5_get_init_creds_keytab(). If you need
to supply any options beyond the arguments to that function, create the
options structure with krb5_get_init_creds_opt_alloc(), other
krb5_get_init_creds_opt_* calls to set the options, and clean it up
later with krb5_get_init_creds_opt_free(). Clean up the resulting
credential later with krb5_free_creds().
* Store the returned credential into the memory ccache with
krb5_cc_store_cred().
* Use gss_krb5_ccache_name() to get GSSAPI to use your memory ccache.
(Call krb5_cc_get_name() to get the ccache name.) This function sets a
thread-specific variable.
Now you should be ready to acquire credentials.
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
