HP Open Source Security for OpenVMS Volume 3: Kerberos

Legal Notice

Preface Intended Audience Document Structure Related Documents Reader's Comments How to Order Additional Documentation Conventions

Introduction to Kerberos Kerberos Terminology Understanding Kerberos Kerberos Components

Installation and Configuration Prerequisites Downloading the Kit Installing and Configuring Kerberos on OpenVMS Version 8.2 and Higher Installing and Configuring Kerberos on OpenVMS Alpha Version 7.3-2 Installing and Configuring Kerberos on OpenVMS VAX Version 7.3 Configuring HP TCP/IP Services for OpenVMS Telnet with Kerberos

Kerberos Client Programs User Client Programs Administrative Client Programs

Kerberos Programming Concepts Overview of Building a Kerberos Application on OpenVMS Kerberos Example Programs

GSSAPI (Generic Security Services Application Programming Interface) gss_accept_sec_context Establish a security context gss_acquire_cred Acquire credential handle gss_add_cred Construct credentials incrementally gss_add_oid_set_member Add an object identifier to a set gss_compare_name Allow application to compare two internal names gss_canonicalize_name Convert internal name to internal mechanism name gss_context_time Check how much longer context is valid gss_create_empty_oid_set Create a set containing no object identifiers gss_delete_sec_context Delete a security context gss_display_name Provide textual representation of opaque internal name gss_display_status Convert GSSAPI status code to text for user display gss_duplicate_name Create a copy of an internal name gss_export_name Convert an internal mechanism name to export form gss_export_sec_context Transfer a security context to another process gss_get_mic Generate a cryptographic MIC for a message gss_import_name Convert a printable string to an internal form gss_import_sec_context Import a transferred context gss_indicate_mechs Allow an application to determine which security mechanisms are available gss_init_sec_context Establish a security context gss_inquire_context Extract security context information gss_inquire_cred Provide calling application with information about a credential gss_inquire_cred_by_mech Obtain per-mechanism information about a credential gss_inquire_names_for_mech Return set of supported nametypes gss_process_context_token Pass a security context to the security service gss_release_buffer Free storage associated with a buffer gss_release_cred Mark a credential for deletion gss_release_name Free storage associated with an internal name that was allocated by a GSSAPI routine gss_release_oid_set Free storage associated with a gss_OID_set object gss_test_oid_set_member Determine whether an object identifier is a member of the set gss_unwrap Verify a message with attached MIC and decrypt message content gss_verify_mic Check that a cryptographic MIC fits the applied message gss_wrap Attach a MIC to a message and encrypt the message gss_wrap_size_limit Check expected size of wrapped output

KRB5 (Kerberos V5) Application Programming Interface krb5_425_conv_principal Convert a Kerberos V4 principal name to V5 format krb5_524_conv_principal Separate a Kerberos V5 principal into components krb5_address_compare Compare two addresses krb5_address_order Return an ordering of two addresses krb5_address_search Search for address in address list krb5_aname_to_localname Convert a principal name to a local name krb5_appdefault_boolean Check Boolean values in appdefault krb5_appdefault_string Check string values in appdefault krb5_auth_con_free Free auth_context krb5_auth_con_genaddrs Get full IP address from address and port krb5_auth_con_getrcache Get the rcache element from the auth_context krb5_auth_con_getaddrs Retrieve address fields from the auth_context krb5_auth_con_getauthenticator Retrieve authenticator used during mutual authentication krb5_auth_con_getflags Retrieve the flags in auth_context krb5_auth_con_getkey Retrieve keyblock from auth_context krb5_auth_con_getlocalseqnumber Retrieve and store the local sequence number krb5_auth_con_getlocalsubkey Retrieve the local_subkey keyblock from auth_context krb5_auth_con_getremoteseqnumber Retrieve and store the remote sequence number krb5_auth_con_getremotesubkey Retrieve the remote_subkey keyblock from auth_context krb5_auth_con_init Initialize the auth_context krb5_auth_con_setaddrs Set address fields in auth_context krb5_auth_con_setflags Set the flags in auth_context krb5_auth_con_setports Set port fields in the auth_context krb5_auth_con_setrcache Set the replay cache krb5_auth_con_setuseruserkey Set keyblock field in auth_context to temporary key krb5_build_principal Build a principal name krb5_build_principal_va Fill in pointer to principal structure krb5_c_block_size Get the block size for the given encryption type krb5_c_checksum_length Get the checksum length for a checksum type krb5_c_decrypt Decrypt encrypted data krb5_c_encrypt Encrypt data krb5_c_encrypt_length Get the length of encrypted data krb5_c_enctype_compare Compare two encryption types krb5_c_is_coll_proof_cksum Test to see if a checksum is collision proof krb5_c_is_keyed_cksum Test to see if a checksum uses derived keys krb5_c_keyed_checksum_types Get a list of derived key checksums krb5_c_make_checksum Compute a checksum krb5_c_make_random_key Generate a random key krb5_c_random_make_octets Create random data krb5_c_random_seed Get a random seed krb5_c_string_to_key Convert a string to a key krb5_c_valid_cksumtype Validate a checksum type krb5_c_valid_enctype Validate an encryption type krb5_c_verify_checksum Verify a checksum krb5_cc_close Close the credentials cache krb5_cc_copy_creds Copy a set of credentials krb5_cc_default Resolve the default credentials cache name krb5_cc_default_name Return the name of the default credentials cache krb5_cc_destroy Destroy a credentials cache krb5_cc_end_seq_get Finish processing credentials cache entries krb5_cc_gen_new Generate a new credentials cache identifier krb5_cc_get_name Return the name of the credentials cache krb5_cc_get_principal Retrieve the primary principal of the credentials cache krb5_cc_get_type Return the CC prefix krb5_cc_initialize Create/refresh a credentials cache krb5_cc_next_cred Fetch the next credentials entry krb5_cc_remove_cred Remove credentials from the credentials cache krb5_cc_resolve Resolve a credentials cache name krb5_cc_retrieve_cred Search the cache for a credential and return it if found krb5_cc_set_default_name Set default CC name krb5_cc_set_flags Set the flags on the credentials cache krb5_cc_start_seq_get Start sequential read of cached credentials krb5_cc_store_cred Store a credential in the credentials cache krb5_change_password Change an existing password krb5_cksumtype_to_string Convert checksum type to string representation krb5_copy_addresses Copy Kerberos addresses krb5_copy_authdata Copy a Kerberos authdata structure krb5_copy_authenticator Copy an authenticator structure krb5_copy_checksum Copy a checksum structure krb5_copy_creds Copy a credentials structure krb5_copy_data Copy a Kerberos data structure krb5_copy_keyblock Copy a keyblock krb5_copy_keyblock_contents Copy a keyblocks contents krb5_copy_principal Copy a principal structure krb5_copy_ticket Copy a Kerberos ticket structure krb5_decode_ticket Decode a formatted ticket krb5_deltat_to_string Convert a Kerberos relative time value to a string krb5_enctype_to_string Convert a Kerberos encryption type value to a string krb5_free_addresses Free addresses allocated by krb5_copy_addresses krb5_free_ap_rep_enc_part Free subkey and other data allocated by krb5_rd_rep or krb5_send_auth krb5_free_authdata Free an authdata structure krb5_free_authenticator Free authenticator storage krb5_free_checksum Free a checksum krb5_free_checksum_contents Free the contents of a checksum structure krb5_free_cksumtypes Free a checksum structure krb5_free_context Free a context structure krb5_free_creds Free credentials krb5_free_cred_contents Free credential structures krb5_free_data Free storage associated with a krb5_data object krb5_free_data_contents Frees contents of a krb5_data structure krb5_free_default_realm Free the Kerberos default realm structure krb5_free_error Free error information krb5_free_host_realm Free storage allocated by krb5_get_host_realm krb5_free_keyblock Free keyblock memory krb5_free_keyblock_contents Free the contents of a key structure krb5_free_keytab_entry_contents Free the contents of a keytab entry krb5_free_principal Free the pwd_data allocated by krb5_copy_principal krb5_free_tgt_creds Free TGT credentials krb5_free_ticket Free ticket allocated by krb5_copy_ticket krb5_free_unparsed_name Free a simple name krb5_fwd_tgt_creds Get a TGT for use at a remote host krb5_get_credentials Get an additional ticket for the client krb5_get_credentials_renew Renew a set of existing credentials krb5_get_credentials_validate Validate a set of existing credentials krb5_get_default_realm Retrieve the default realm krb5_get_init_creds_keytab Get initial credentials keytab krb5_get_init_creds_opt_init Initialize options for krb5_get_init_creds* routines krb5_get_init_creds_opt_set_address_list Set the address list in krb5_get_init_creds_opt krb5_get_init_creds_opt_set_etype_list Set the encryption list field in krb5_get_init_creds_opt krb5_get_init_creds_opt_set_forwardable Set the forwardable field in krb5_get_init_creds_opt krb5_get_init_creds_opt_set_preauth_list Set the preauth_list field in krb5_get_init_creds_opt krb5_get_init_creds_opt_set_proxiable Set the proxiable field in krb5_get_init_creds_opt krb5_get_init_creds_opt_set_renew_life Set the renewal lifetime field in krb5_get_init_creds_opt krb5_get_init_creds_opt_set_salt Set the salt field in krb5_get_init_creds_opt krb5_get_init_creds_opt_set_tkt_life Initialize the ticket lifetime for krb5_get_init_creds* routines krb5_get_init_creds_password Get the initial credentials password krb5_get_host_realm Get the Kerberos realm names for a host krb5_get_message Convert an error code into the string representation krb5_get_prompt_types Get prompt_types from the Kerberos context krb5_get_renewed_creds Renew existing credentials krb5_get_server_rcache Create a replay cache for server use krb5_get_time_offsets Get the time offsets from the os context krb5_get_validated_creds Get validated credentials krb5_init_context Initialize a Kerberos context structure krb5_init_keyblock Set up an empty keyblock krb5_init_secure_context Initialize a secure Kerberos context block krb5_kt_add_entry Add an entry to a key table krb5_kt_close Close a key table krb5_kt_default Return a handle to the default keytab krb5_kt_default_name Get default key table name krb5_kt_end_seq_get Complete a series of sequential key table entry retrievals krb5_kt_get_entry Retrieve an entry from the key table krb5_kt_get_name Get key table name krb5_kt_get_type Return the keytab prefix krb5_kt_next_entry Retrieve the next entry from the key table krb5_kt_read_service_key Retrieve a service key from the key table krb5_kt_remove_entry Remove an entry from a key table krb5_kt_resolve Get keytab handle krb5_kt_start_seq_get Start a sequential retrieve of key table entries krb5_kuserok Determine whether the local user is authorized to log in krb5_mk_1cred Encode a KRB_CRED message for krb5_rd_cred krb5_mk_error Format an error message krb5_mk_ncred Encode a KRB_CRED message for krb5_rd_cred krb5_mk_priv Format a KRB_PRIV message krb5_mk_rep Format and encrypt an AP_REP message krb5_mk_req Format a KRB_AP_REQ message krb5_mk_req_extended Format a KRB_AP_REQ message with additional options krb5_mk_safe Format a KRB_SAFE message krb5_os_localaddr Return all protocol addresses of this host krb5_parse_name Convert string principal name to protocol format krb5_principal_compare Compare two principals krb5_prompter_posix Prompt the user for the Kerberos password krb5_rd_cred Read a KRB_CRED message krb5_rd_error Read an error protocol message krb5_rd_priv Parse a KRB_PRIV message krb5_rd_rep Parse and decrypt an AP_REP message krb5_rd_req Parse a KRB_AP_REQ message krb5_rd_safe Parse a KRB_SAFE message krb5_read_password Read a password from the keyboard krb5_realm_compare Compare the realms of two principals krb5_recvauth Receive authenticated message krb5_recvauth_version Receive authenticated message with version information krb5_salttype_to_string Convert a salttype (krb5_int32) to a string krb5_sendauth Send authenticated message krb5_set_default_realm Sets the default realm krb5_set_default_tgs_enctypes Set default TGS encryption types krb5_set_principal_realm Set the realm in the current context krb5_sname_to_principal Generate a full principal name from a service name krb5_string_to_cksumtype Convert a string to a checksum type krb5_string_to_deltat Convert a string to a delta time value krb5_string_to_enctype Convert a string to an encryption type krb5_string_to_salttype Convert a string to a salt type krb5_string_to_timestamp Convert a string to a timestamp krb5_timestamp_to_sfstring Convert a timestamp to a string krb5_timestamp_to_string Convert a timestamp to a string krb5_unparse_name Convert protocol format principal name to string format krb5_unparse_name_ext Convert multiple protocol format principal names to string format krb5_us_timeofday Retrieves the system time of day (in seconds and microseconds) krb5_verify_init_creds Verify initial credentials krb5_verify_init_creds_opt_init Initialize krb5_verify_init_creds_opt structure krb5_verify_init_creds_opt_set_ap_req_nofail Initialize the ap_req_nofail field in krb5_verify_init_creds_opt

Open Source Notices Acknowledgments Kerberos Copyright Notice OpenVision Technologies Copyright Notice University of California Copyright Notice

Glossary

Index