[19275] in Kerberos_V5_Development
Re: gss_krb5_import_cred
daemon@ATHENA.MIT.EDU (Sorin Manolache)
Thu Oct 1 18:09:04 2015
Message-ID: <560DAE46.1020106@gmail.com>
Date: Fri, 02 Oct 2015 00:05:58 +0200
From: Sorin Manolache <sorinm@gmail.com>
MIME-Version: 1.0
To: krbdev@mit.edu
In-Reply-To: <560D8C57.90608@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On 2015-10-01 21:41, Greg Hudson wrote:
> On 10/01/2015 02:25 PM, sorin.manolache@orange.com wrote:
>> gss_krb5_import_cred(&minor, NULL /* ccache */, princ, keytab, &cred);
>>
>> can this call acquire any credentials that I could use later for
>> gss_init_sec_context? It seems to me that no, but I would like a
>> confirmation.
>
> No, you will only get acceptor creds this way.
>
>> Or, to put it differently, if all I have is a keytab file (i.e. I have
>> nothing in the caches, I have never called kinit, I have never called
>> gss_acquire_cred or gss_acquire_cred_by_password) is there a way to
>> acquire credentials only with that keytab file? (The keytab file is not
>> empty, obviously.)
>
> Yes, as of MIT krb5 1.11. The basic outline is:
>
> * Configure a client keytab name, typically using the KRB5_CLIENT_KTNAME
> environment variable.
>
> * Configure a ccache (with KRB5CCNAME or otherwise) that won't be
> disturbed by a human. Don't populate this cache manually.
>
> * Call gss_acquire_cred() with usage GSS_C_INITIATE. Ticket acquisition
> and refreshes from the keytab will happen automatically behind the scenes.
>
> As of 1.12, you can use gss_acquire_cred_from() to specify the client
> keytab name and ccache name, if you want to do that programmatically
> rather than through the program environment.
>
> There is more at:
>
> http://k5wiki.kerberos.org/wiki/Projects/Keytab_initiation
>
> This is under-documented in the main documentation; the component
> features are documented, but there ought to be a better "how to."
Thank you.
Sorin
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
