HP Open Source Security for OpenVMS Volume 3: Kerberos
» Table of Contents |  | | » Glossary | | | » Index | | |
| | |
| ||
| ||
HP Part Number: BA554-90008
July 2006
© Copyright 2006 Hewlett-Packard Development Company, L.P.
Table of Contents
- Preface
- 1 Introduction to Kerberos
- 2 Installation and Configuration
- Prerequisites
- Downloading the Kit
- Secure Delivery and Kerberos
- Installing and Configuring Kerberos on OpenVMS Version 8.2 or Higher
- Installing and Configuring Kerberos on OpenVMS Alpha Version 7.3-2
- Configuring Kerberos for OpenVMS Telnet and OpenVMS SSH
- Configuring HP TCP/IP Services for OpenVMS SSH with Kerberos
- Configuring HP TCP/IP Services for OpenVMS Telnet with Kerberos
- Configuring and Starting the Kerberos ACME Agent
- 3 Kerberos Client Programs
- 4 Kerberos Programming Concepts
- 5 GSSAPI (Generic Security Services Application Programming Interface)
- gss_accept_sec_context — Establish a security context
- gss_acquire_cred — Acquire credential handle
- gss_add_cred — Construct credentials incrementally
- gss_add_oid_set_member — Add an object identifier to a set
- gss_compare_name — Allow application to compare two internal names
- gss_canonicalize_name — Convert internal name to internal mechanism name
- gss_context_time — Check how much longer context is valid
- gss_create_empty_oid_set — Create a set containing no object identifiers
- gss_delete_sec_context — Delete a security context
- gss_display_name — Provide textual representation of opaque internal name
- gss_display_status — Convert GSSAPI status code to text for user display
- gss_duplicate_name — Create a copy of an internal name
- gss_export_name — Convert an internal mechanism name to export form
- gss_export_sec_context — Transfer a security context to another process
- gss_get_mic — Generate a cryptographic MIC for a message
- gss_import_name — Convert a printable string to an internal form
- gss_import_sec_context — Import a transferred context
- gss_indicate_mechs — Allow an application to determine which security mechanisms are available
- gss_init_sec_context — Establish a security context
- gss_inquire_context — Extract security context information
- gss_inquire_cred — Provide calling application with information about a credential
- gss_inquire_cred_by_mech — Obtain per-mechanism information about a credential
- gss_inquire_names_for_mech — Return set of supported nametypes
- gss_process_context_token — Pass a security context to the security service
- gss_release_buffer — Free storage associated with a buffer
- gss_release_cred — Mark a credential for deletion
- gss_release_name — Free storage associated with an internal name that was allocated by a GSSAPI routine
- gss_release_oid_set — Free storage associated with a gss_OID_set object
- gss_test_oid_set_member — Determine whether an object identifier is a member of the set
- gss_unwrap — Verify a message with attached MIC and decrypt message content
- gss_verify_mic — Check that a cryptographic MIC fits the applied message
- gss_wrap — Attach a MIC to a message and encrypt the message
- gss_wrap_size_limit — Check expected size of wrapped output
- 6 KRB5 (Kerberos V5) Application Programming Interface
- krb5_425_conv_principal — Convert a Kerberos V4 principal name to V5 format
- krb5_524_conv_principal — Separate a Kerberos V5 principal into components
- krb5_524_convert_creds — Convert Kerberos V5 credentials to V4
- krb5_address_compare — Compare two addresses
- krb5_address_order — Return an ordering of two addresses
- krb5_address_search — Search for address in address list
- krb5_aname_to_localname — Convert a principal name to a local name
- krb5_appdefault_boolean — Check Boolean values in appdefault
- krb5_appdefault_string — Check string values in appdefault
- krb5_auth_con_free — Free auth_context
- krb5_auth_con_genaddrs — Get full IP address from address and port
- krb5_auth_con_get_checksum_func — Get the checksum function and data structure
- krb5_auth_con_getrcache — Get the rcache element from the auth_context
- krb5_auth_con_getaddrs — Retrieve address fields from the auth_context
- krb5_auth_con_getauthenticator — Retrieve authenticator used during mutual authentication
- krb5_auth_con_getflags — Retrieve the flags in auth_context
- krb5_auth_con_getkey — Retrieve keyblock from auth_context
- krb5_auth_con_getlocalseqnumber — Retrieve and store the local sequence number
- krb5_auth_con_getrecvsubkey — Retrieve the recv_subkey keyblock from auth_context
- krb5_auth_con_getremoteseqnumber — Retrieve and store the remote sequence number
- krb5_auth_con_getsendsubkey — Retrieve the send_subkey keyblock from auth_context
- krb5_auth_con_init — Initialize the auth_context
- krb5_auth_con_set_checksum_func — Set the checksum function and data structure
- krb5_auth_con_setaddrs — Set address fields in auth_context
- krb5_auth_con_setflags — Set the flags in auth_context
- krb5_auth_con_setports — Set port fields in the auth_context
- krb5_auth_con_setrcache — Set the replay cache
- krb5_auth_con_setrecvsubkey — Set the recv_subkey keyblock in auth_context
- krb5_auth_con_setsendsubkey — Set the send_subkey keyblock in auth_context
- krb5_auth_con_setuseruserkey — Set keyblock field in auth_context to temporary key
- krb5_build_principal — Build a principal name
- krb5_build_principal_va — Fill in pointer to principal structure
- krb5_c_block_size — Get the block size for the given encryption type
- krb5_c_checksum_length — Get the checksum length for a checksum type
- krb5_c_decrypt — Decrypt encrypted data
- krb5_c_encrypt — Encrypt data
- krb5_c_encrypt_length — Get the length of encrypted data
- krb5_c_enctype_compare — Compare two encryption types
- krb5_c_is_coll_proof_cksum — Test to see if a checksum is collision proof
- krb5_c_is_keyed_cksum — Test to see if a checksum uses derived keys
- krb5_c_keyed_checksum_types — Get a list of derived key checksums
- krb5_c_make_checksum — Compute a checksum
- krb5_c_make_random_key — Generate a random key
- krb5_c_random_make_octets — Create random data
- krb5_c_random_seed — Get a random seed
- krb5_c_string_to_key — Convert a string to a key
- krb5_c_string_to_key_with_params — Convert string key to keyblock
- krb5_c_valid_cksumtype — Validate a checksum type
- krb5_c_valid_enctype — Validate an encryption type
- krb5_c_verify_checksum — Verify a checksum
- krb5_cc_close — Close the credentials cache
- krb5_cc_copy_creds — Copy a set of credentials
- krb5_cc_default — Resolve the default credentials cache name
- krb5_cc_default_name — Return the name of the default credentials cache
- krb5_cc_destroy — Destroy a credentials cache
- krb5_cc_end_seq_get — Finish processing credentials cache entries
- krb5_cc_gen_new — Generate a new credentials cache identifier
- krb5_cc_get_name — Return the name of the credentials cache
- krb5_cc_get_principal — Retrieve the primary principal of the credentials cache
- krb5_cc_get_type — Return the CC prefix
- krb5_cc_initialize — Create/refresh a credentials cache
- krb5_cc_next_cred — Fetch the next credentials entry
- krb5_cc_remove_cred — Remove credentials from the credentials cache
- krb5_cc_resolve — Resolve a credentials cache name
- krb5_cc_retrieve_cred — Search the cache for a credential and return it if found
- krb5_cc_set_default_name — Set default CC name
- krb5_cc_set_flags — Set the flags on the credentials cache
- krb5_cc_start_seq_get — Start sequential read of cached credentials
- krb5_cc_store_cred — Store a credential in the credentials cache
- krb5_change_password — Change an existing password
- krb5_cksumtype_to_string — Convert checksum type to string representation
- krb5_copy_addresses — Copy Kerberos addresses
- krb5_copy_authdata — Copy a Kerberos authdata structure
- krb5_copy_authenticator — Copy an authenticator structure
- krb5_copy_checksum — Copy a checksum structure
- krb5_copy_creds — Copy a credentials structure
- krb5_copy_data — Copy a Kerberos data structure
- krb5_copy_keyblock — Copy a keyblock
- krb5_copy_keyblock_contents — Copy a keyblock’s contents
- krb5_copy_principal — Copy a principal structure
- krb5_copy_ticket — Copy a Kerberos ticket structure
- krb5_decode_ticket — Decode a formatted ticket
- krb5_deltat_to_string — Convert a Kerberos relative time value to a string
- krb5_enctype_to_string — Convert a Kerberos encryption type value to a string
- krb5_free_addresses — Free a group of addresses
- krb5_free_ap_rep_enc_part — Free subkey and other data allocated by krb5_rd_rep or krb5_send_auth
- krb5_free_authdata — Free an authdata structure
- krb5_free_authenticator — Free authenticator storage
- krb5_free_checksum — Free a checksum
- krb5_free_checksum_contents — Free the contents of a checksum structure
- krb5_free_cksumtypes — Free a checksum structure
- krb5_free_context — Free a context structure
- krb5_free_creds — Free credentials
- krb5_free_cred_contents — Free credential structures
- krb5_free_data — Free storage associated with a krb5_data object
- krb5_free_data_contents — Frees contents of a krb5_data structure
- krb5_free_default_realm — Free the Kerberos default realm structure
- krb5_free_error — Free error information
- krb5_free_host_realm — Free storage allocated by krb5_get_host_realm
- krb5_free_keyblock — Free keyblock memory
- krb5_free_keyblock_contents — Free the contents of a key structure
- krb5_free_keytab_entry_contents — Free the contents of a keytab entry
- krb5_free_principal — Free the pwd_data allocated by krb5_copy_principal
- krb5_free_tgt_creds — Free TGT credentials
- krb5_free_ticket — Free ticket allocated by krb5_copy_ticket
- krb5_free_unparsed_name — Free a simple name
- krb5_fwd_tgt_creds — Get a TGT for use at a remote host
- krb5_get_credentials — Get an additional ticket for the client
- krb5_get_credentials_renew — Renew a set of existing credentials
- krb5_get_credentials_validate — Validate a set of existing credentials
- krb5_get_default_realm— Retrieve the default realm
- krb5_get_init_creds_keytab — Get initial credentials’ keytab
- krb5_get_init_creds_opt_init — Initialize options for krb5_get_init_creds* routines
- krb5_get_init_creds_opt_set_address_list — Set the address list in krb5_get_init_creds_opt
- krb5_get_init_creds_opt_set_etype_list — Set the encryption list field in krb5_get_init_creds_opt
- krb5_get_init_creds_opt_set_forwardable — Set the forwardable field in krb5_get_init_creds_opt
- krb5_get_init_creds_opt_set_preauth_list — Set the preauth_list field in krb5_get_init_creds_opt
- krb5_get_init_creds_opt_set_proxiable — Set the proxiable field in krb5_get_init_creds_opt
- krb5_get_init_creds_opt_set_renew_life — Set the renewal lifetime field in krb5_get_init_creds_opt
- krb5_get_init_creds_opt_set_salt — Set the salt field in krb5_get_init_creds_opt
- krb5_get_init_creds_opt_set_tkt_life — Initialize the ticket lifetime for krb5_get_init_creds* routines
- krb5_get_init_creds_password — Get the initial credentials password
- krb5_get_host_realm — Get the Kerberos realm names for a host
- krb5_get_message — Convert an error code into the string representation
- krb5_get_permitted_enctypes — Return a list of supported encryption types
- krb5_get_prompt_types — Get prompt_types from the Kerberos context
- krb5_get_renewed_creds — Renew existing credentials
- krb5_get_server_rcache — Create a replay cache for server use
- krb5_get_time_offsets — Get the time offsets from the os context
- krb5_get_validated_creds — Get validated credentials
- krb5_init_context — Initialize a Kerberos context structure
- krb5_init_keyblock — Set up an empty keyblock
- krb5_init_secure_context — Initialize a secure Kerberos context block
- krb5_is_thread_safe — Check whether the Kerberos client code supports multithreading
- krb5_kt_add_entry — Add an entry to a key table
- krb5_kt_close — Close a key table
- krb5_kt_default — Return a handle to the default keytab
- krb5_kt_default_name — Get default key table name
- krb5_kt_end_seq_get — Complete a series of sequential key table entry retrievals
- krb5_kt_get_entry — Retrieve an entry from the key table
- krb5_kt_get_name — Get key table name
- krb5_kt_get_type — Return the keytab prefix
- krb5_kt_next_entry — Retrieve the next entry from the key table
- krb5_kt_read_service_key — Retrieve a service key from the key table
- krb5_kt_remove_entry — Remove an entry from a key table
- krb5_kt_resolve — Get keytab handle
- krb5_kt_start_seq_get — Start a sequential retrieve of key table entries
- krb5_kuserok — Determine whether the local user is authorized to log in
- krb5_mk_1cred — Encode a KRB_CRED message for krb5_rd_cred
- krb5_mk_error — Format an error message
- krb5_mk_ncred — Encode a KRB_CRED message for krb5_rd_cred
- krb5_mk_priv — Format a KRB_PRIV message
- krb5_mk_rep — Format and encrypt an AP_REP message
- krb5_mk_req — Format a KRB_AP_REQ message
- krb5_mk_req_extended — Format a KRB_AP_REQ message with additional options
- krb5_mk_safe — Format a KRB_SAFE message
- krb5_os_localaddr — Return all protocol addresses of this host
- krb5_parse_name — Convert string principal name to protocol format
- krb5_principal2salt — Convert a krb5_principal into it’s default salt
- krb5_principal_compare — Compare two principals
- krb5_prompter_posix — Prompt the user for the Kerberos password
- krb5_rd_cred — Read a KRB_CRED message
- krb5_rd_error — Read an error protocol message
- krb5_rd_priv — Parse a KRB_PRIV message
- krb5_rd_rep — Parse and decrypt an AP_REP message
- krb5_rd_req — Parse a KRB_AP_REQ message
- krb5_rd_safe — Parse a KRB_SAFE message
- krb5_read_password — Read a password from the keyboard
- krb5_realm_compare — Compare the realms of two principals
- krb5_recvauth — Receive authenticated message
- krb5_recvauth_version — Receive authenticated message with version information
- krb5_salttype_to_string — Convert a salttype (krb5_int32) to a string
- krb5_sendauth — Send authenticated message
- krb5_set_default_realm — Sets the default realm
- krb5_set_default_tgs_enctypes — Set default TGS encryption types
- krb5_set_password — Implements set password per RFC 3244
- krb5_set_password_using_ccache — Implements RFC 3244 set password using credentials cache
- krb5_set_principal_realm — Set the realm in the current context
- krb5_set_real_time — Set time offset field in context structure
- krb5_sname_to_principal — Generate a full principal name from a service name
- krb5_string_to_cksumtype — Convert a string to a checksum type
- krb5_string_to_deltat — Convert a string to a delta time value
- krb5_string_to_enctype — Convert a string to an encryption type
- krb5_string_to_salttype — Convert a string to a salt type
- krb5_string_to_timestamp — Convert a string to a timestamp
- krb5_timestamp_to_sfstring — Convert a timestamp to a string
- krb5_timestamp_to_string — Convert a timestamp to a string
- krb5_unparse_name — Convert protocol format principal name to string format
- krb5_unparse_name_ext — Convert multiple protocol format principal names to string format
- krb5_us_timeofday — Retrieves the system time of day (in seconds and microseconds)
- krb5_verify_init_creds — Verify initial credentials
- krb5_verify_init_creds_opt_init — Initialize krb5_verify_init_creds_opt structure
- krb5_verify_init_creds_opt_set_ap_req_nofail — Initialize the ap_req_nofail field in krb5_verify_init_creds_opt
- A Open Source Notices
- Glossary
- Index
List of Figures
List of Tables