HP Open Source Security for OpenVMS Volume 3: Kerberos

Legal Notice

Preface Intended Audience Document Structure Related Documents Reader's Comments How to Order Additional Documentation Conventions

Introduction to Kerberos Kerberos Terminology Understanding Kerberos Kerberos Components

Installation and Configuration Prerequisites Downloading the Kit Expanding the Kit Installing and Configuring Kerberos on OpenVMS Version 7.3-2 and Higher Updating and Configuring Kerberos on OpenVMS Version 7.3-1 Installing and Configuring Kerberos on OpenVMS Version 7.2-2 and 7.3

Kerberos Client Programs User Client Programs Administrative Client Programs

Kerberos Programming Concepts Overview of Building a Kerberos Application on OpenVMS Kerberos Example Programs

GSSAPI (Generic Security Services Application Programming Interface) gss_accept_sec_context Establish a security context gss_acquire_cred Acquire credential handle gss_add_cred Construct credentials incrementally gss_add_oid_set_member Add an object identifier to a set gss_canonicalize_name Convert internal name to internal mechanism name gss_compare_name Allow application to compare two internal names gss_context_time Check how much longer context is valid gss_create_empty_oid_set Create a set containing no object identifiers gss_delete_sec_context Delete a security context gss_display_name Provide textual representation of opaque internal name gss_display_status Convert GSSAPI status code to text for user display gss_duplicate_name Create a copy of an internal name gss_export_name Convert an internal mechanism name to export form gss_export_sec_context Transfer a security context to another process gss_get_mic Generate a cryptographic MIC for a message gss_import_name Convert a printable string to an internal form gss_import_sec_context Import a transferred context gss_indicate_mechs Allow an application to determine which security mechanisms are available gss_init_sec_context Establish a security context gss_inquire_context Extract security context information gss_inquire_cred Provide calling application with information about a credential gss_inquire_cred_by_mech Obtain per-mechanism information about a credential gss_inquire_names_for_mech Return set of supported nametypes gss_process_context_token Pass a security context to the security service gss_release_buffer Free storage associated with a buffer gss_release_cred Mark a credential for deletion gss_release_name Free storage associated with an internal name that was allocated by a GSSAPI routine gss_release_oid_set Free storage associated with a gss_OID_set object gss_test_oid_set_member Determine whether an object identifier is a member of the set gss_unwrap Verify a message with attached MIC and decrypt message content gss_verify_mic Check that a cryptographic MIC fits the applied message gss_wrap Attach a MIC to a message and encrypt the message gss_wrap_size_limit Check expected size of wrapped output

KRB5 (Kerberos V5) Application Programming Interface krb5_425_conv_principal Convert a Kerberos V4 principal name to V5 format krb5_address_compare Compare two addresses krb5_address_order Return an ordering of two addresses krb5_address_search Search for address in address list krb5_aname_to_localname Convert a principal name to a local name krb5_auth_con_free Free auth_context krb5_auth_con_init Initialize the auth_context krb5_auth_con_getaddrs Retrieve address fields from the auth_context krb5_auth_con_getauthenticator Retrieve authenticator used during mutual authentication krb5_auth_con_getflags Retrieve the flags in auth_context krb5_auth_con_getkey Retrieve keyblock from auth_context krb5_auth_con_getlocalseqnumber Retrieve and store the local sequence number krb5_auth_con_getlocalsubkey Retrieve the local_subkey keyblock from auth_context krb5_auth_con_getremoteseqnumber Retrieve and store the remote sequence number krb5_auth_con_getremotesubkey Retrieve the remote_subkey keyblock from auth_context krb5_auth_con_setaddrs Set address fields in auth_context krb5_auth_con_setflags Set the flags in auth_context krb5_auth_con_setports Set port fields in the auth_context krb5_auth_con_setrcache Set the replay cache krb5_auth_con_setuseruserkey Set keyblock field in auth_context to temporary key krb5_build_principal Build a principal name krb5_build_principal_ext Build a principal name extension krb5_cc_close Close the credentials cache krb5_cc_default Resolve the default credentials cache name krb5_cc_default_name Return the name of the default credentials cache krb5_cc_destroy Destroy a credentials cache krb5_cc_end_seq_get Finish processing credentials cache entries krb5_cc_gen_new Generate a new credentials cache identifier krb5_cc_get_name Return the name of the credentials cache krb5_cc_get_principal Retrieve the primary principal of the credentials cache krb5_cc_initialize Create/refresh a credentials cache krb5_cc_next_cred Fetch the next credentials entry krb5_cc_remove_cred Remove credentials from the credentials cache krb5_cc_resolve Resolve a credentials cache name krb5_cc_retrieve_cred Search the cache for a credential and return it if found krb5_cc_set_flags Set the flags on the credentials cache krb5_cc_start_seq_get Start sequential read of cached credentials krb5_cc_store_cred Store a credential in the credentials cache krb5_copy_addresses Copy Kerberos addresses krb5_copy_authdata Copy a Kerberos authdata structure krb5_copy_authenticator Copy an authenticator structure krb5_copy_checksum Copy a checksum structure krb5_copy_creds Copy a credentials structure krb5_copy_data Copy a Kerberos data structure krb5_copy_keyblock Copy a keyblock krb5_copy_keyblock_contents Copy a keyblocks contents krb5_copy_principal Copy a principal structure krb5_copy_ticket Copy a Kerberos ticket structure krb5_free_addresses Free addresses allocated by krb5_copy_addresses krb5_free_ap_rep_enc_part Free subkey and other data allocated by krb5_rd_rep or krb5_send_auth krb5_free_authdata Free an authdata structure krb5_free_authenticator Free authenticator storage krb5_free_checksum Free a checksum krb5_free_context Free a context structure krb5_free_cred_contents Free credential structures krb5_free_creds Free credentials krb5_free_data Free storage associated with a krb5_data object krb5_free_error Free error information krb5_free_host_realm Free storage allocated by krb5_get_host_realm krb5_free_keyblock Free keyblock memory krb5_free_principal Free the pwd_data allocated by krb5_copy_principal krb5_free_tgt_creds Free TGT credentials krb5_free_ticket Free ticket allocated by krb5_copy_ticket krb5_get_credentials Get an additional ticket for the client krb5_get_default_realm Retrieve the default realm krb5_get_host_realm Get the Kerberos realm names for a host krb5_get_message Convert an error code into the string representation krb5_get_server_rcache Create a replay cache for server use krb5_init_context Initialize a Kerberos context structure krb5_kt_add_entry Add an entry to a key table krb5_kt_close Close a key table krb5_kt_default Return a handle to the default keytab krb5_kt_default_name Get default key table name krb5_kt_end_seq_get Complete a series of sequential key table entry retrievals krb5_kt_get_entry Retrieve an entry from the key table krb5_kt_get_name Get key table name krb5_kt_next_entry Retrieve the next entry from the key table krb5_kt_read_service_key Retrieve a service key from the key table krb5_kt_remove_entry Remove an entry from a key table krb5_kt_start_seq_get Start a sequential retrieve of key table entries krb5_kuserok Determine whether the local user is authorized to log in krb5_mk_error Format an error message krb5_mk_priv Format a KRB_PRIV message krb5_mk_rep Format and encrypt an AP_REP message krb5_mk_req Format a KRB_AP_REQ message krb5_mk_req_extended Format a KRB_AP_REQ message with additional options krb5_mk_safe Format a KRB_SAFE message krb5_os_localaddr Return all protocol addresses of this host krb5_parse_name Convert string principal name to protocol format krb5_principal_compare Compare two principals krb5_read_password Read a password from the keyboard krb5_rd_priv Parse a KRB_PRIV message krb5_rd_rep Parse and decrypt an AP_REP message krb5_rd_req Parse a KRB_AP_REQ message krb5_rd_safe Parse a KRB_SAFE message krb5_recvauth Receive authenticated message krb5_sendauth Send authenticated message krb5_set_default_realm Sets the default realm krb5_sname_to_principal Generate a full principal name from a service name krb5_timeofday Retrieves the system time of day (in seconds) since local systems epoch krb5_unparse_name Convert protocol format principal name to string format krb5_unparse_name_ext Convert multiple protocol format principal names to string format krb5_us_timeofday Retrieves the system time of day (in seconds and microseconds)

Open Source Notices Acknowledgements Kerberos Copyright Notice OpenVision Technologies Copyright Notice University of California Copyright Notice

Glossary

Index