diff options
Diffstat (limited to 'crypto/krb5/doc/pdf')
44 files changed, 0 insertions, 62094 deletions
diff --git a/crypto/krb5/doc/pdf/GMakefile b/crypto/krb5/doc/pdf/GMakefile deleted file mode 100644 index e4653f236452..000000000000 --- a/crypto/krb5/doc/pdf/GMakefile +++ /dev/null @@ -1,64 +0,0 @@ -# Makefile for Sphinx LaTeX output - -ALLDOCS = $(basename $(wildcard *.tex)) -ALLPDF = $(addsuffix .pdf,$(ALLDOCS)) -ALLDVI = $(addsuffix .dvi,$(ALLDOCS)) -ALLXDV = -ALLPS = $(addsuffix .ps,$(ALLDOCS)) - -# Prefix for archive names -ARCHIVEPREFIX = -# Additional LaTeX options (passed via variables in latexmkrc/latexmkjarc file) -export LATEXOPTS ?= -# Additional latexmk options -LATEXMKOPTS ?= -# format: pdf or dvi (used only by archive targets) -FMT = pdf - -LATEX = latexmk -dvi -PDFLATEX = latexmk -pdf -dvi- -ps- - - -%.dvi: %.tex FORCE_MAKE - $(LATEX) $(LATEXMKOPTS) '$<' - -%.ps: %.dvi - dvips '$<' - -%.pdf: %.tex FORCE_MAKE - $(PDFLATEX) $(LATEXMKOPTS) '$<' - -all: $(ALLPDF) - -all-dvi: $(ALLDVI) - -all-ps: $(ALLPS) - -all-pdf: $(ALLPDF) - -zip: all-$(FMT) - mkdir $(ARCHIVEPREFIX)docs-$(FMT) - cp $(ALLPDF) $(ARCHIVEPREFIX)docs-$(FMT) - zip -q -r -9 $(ARCHIVEPREFIX)docs-$(FMT).zip $(ARCHIVEPREFIX)docs-$(FMT) - rm -r $(ARCHIVEPREFIX)docs-$(FMT) - -tar: all-$(FMT) - mkdir $(ARCHIVEPREFIX)docs-$(FMT) - cp $(ALLPDF) $(ARCHIVEPREFIX)docs-$(FMT) - tar cf $(ARCHIVEPREFIX)docs-$(FMT).tar $(ARCHIVEPREFIX)docs-$(FMT) - rm -r $(ARCHIVEPREFIX)docs-$(FMT) - -gz: tar - gzip -9 < $(ARCHIVEPREFIX)docs-$(FMT).tar > $(ARCHIVEPREFIX)docs-$(FMT).tar.gz - -bz2: tar - bzip2 -9 -k $(ARCHIVEPREFIX)docs-$(FMT).tar - -xz: tar - xz -9 -k $(ARCHIVEPREFIX)docs-$(FMT).tar - -clean: - rm -f *.log *.ind *.aux *.toc *.syn *.idx *.out *.ilg *.pla *.ps *.tar *.tar.gz *.tar.bz2 *.tar.xz $(ALLPDF) $(ALLDVI) $(ALLXDV) *.fls *.fdb_latexmk - -.PHONY: all all-pdf all-dvi all-ps clean zip tar gz bz2 xz -.PHONY: FORCE_MAKE
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/LICRcyr2utf8.xdy b/crypto/krb5/doc/pdf/LICRcyr2utf8.xdy deleted file mode 100644 index a9ca1c82cd66..000000000000 --- a/crypto/krb5/doc/pdf/LICRcyr2utf8.xdy +++ /dev/null @@ -1,101 +0,0 @@ -;; -*- coding: utf-8; mode: Lisp; -*- -;; style file for xindy -;; filename: LICRcyr2utf8.xdy -;; description: style file for xindy which maps back LaTeX Internal -;; Character Representation of Cyrillic to utf-8 -;; usage: for use with pdflatex produced .idx files. -;; Contributed by the Sphinx team, July 2018. -(merge-rule "\IeC {\'\CYRG }" "Ѓ" :string) -(merge-rule "\IeC {\'\CYRK }" "Ќ" :string) -(merge-rule "\IeC {\'\cyrg }" "ѓ" :string) -(merge-rule "\IeC {\'\cyrk }" "ќ" :string) -(merge-rule "\IeC {\CYRA }" "А" :string) -(merge-rule "\IeC {\CYRB }" "Б" :string) -(merge-rule "\IeC {\CYRC }" "Ц" :string) -(merge-rule "\IeC {\CYRCH }" "Ч" :string) -(merge-rule "\IeC {\CYRD }" "Д" :string) -(merge-rule "\IeC {\CYRDJE }" "Ђ" :string) -(merge-rule "\IeC {\CYRDZE }" "Ѕ" :string) -(merge-rule "\IeC {\CYRDZHE }" "Џ" :string) -(merge-rule "\IeC {\CYRE }" "Е" :string) -(merge-rule "\IeC {\CYREREV }" "Э" :string) -(merge-rule "\IeC {\CYRERY }" "Ы" :string) -(merge-rule "\IeC {\CYRF }" "Ф" :string) -(merge-rule "\IeC {\CYRG }" "Г" :string) -(merge-rule "\IeC {\CYRGUP }" "Ґ" :string) -(merge-rule "\IeC {\CYRH }" "Х" :string) -(merge-rule "\IeC {\CYRHRDSN }" "Ъ" :string) -(merge-rule "\IeC {\CYRI }" "И" :string) -(merge-rule "\IeC {\CYRIE }" "Є" :string) -(merge-rule "\IeC {\CYRII }" "І" :string) -(merge-rule "\IeC {\CYRISHRT }" "Й" :string) -(merge-rule "\IeC {\CYRJE }" "Ј" :string) -(merge-rule "\IeC {\CYRK }" "К" :string) -(merge-rule "\IeC {\CYRL }" "Л" :string) -(merge-rule "\IeC {\CYRLJE }" "Љ" :string) -(merge-rule "\IeC {\CYRM }" "М" :string) -(merge-rule "\IeC {\CYRN }" "Н" :string) -(merge-rule "\IeC {\CYRNJE }" "Њ" :string) -(merge-rule "\IeC {\CYRO }" "О" :string) -(merge-rule "\IeC {\CYRP }" "П" :string) -(merge-rule "\IeC {\CYRR }" "Р" :string) -(merge-rule "\IeC {\CYRS }" "С" :string) -(merge-rule "\IeC {\CYRSFTSN }" "Ь" :string) -(merge-rule "\IeC {\CYRSH }" "Ш" :string) -(merge-rule "\IeC {\CYRSHCH }" "Щ" :string) -(merge-rule "\IeC {\CYRT }" "Т" :string) -(merge-rule "\IeC {\CYRTSHE }" "Ћ" :string) -(merge-rule "\IeC {\CYRU }" "У" :string) -(merge-rule "\IeC {\CYRUSHRT }" "Ў" :string) -(merge-rule "\IeC {\CYRV }" "В" :string) -(merge-rule "\IeC {\CYRYA }" "Я" :string) -(merge-rule "\IeC {\CYRYI }" "Ї" :string) -(merge-rule "\IeC {\CYRYO }" "Ё" :string) -(merge-rule "\IeC {\CYRYU }" "Ю" :string) -(merge-rule "\IeC {\CYRZ }" "З" :string) -(merge-rule "\IeC {\CYRZH }" "Ж" :string) -(merge-rule "\IeC {\cyra }" "а" :string) -(merge-rule "\IeC {\cyrb }" "б" :string) -(merge-rule "\IeC {\cyrc }" "ц" :string) -(merge-rule "\IeC {\cyrch }" "ч" :string) -(merge-rule "\IeC {\cyrd }" "д" :string) -(merge-rule "\IeC {\cyrdje }" "ђ" :string) -(merge-rule "\IeC {\cyrdze }" "ѕ" :string) -(merge-rule "\IeC {\cyrdzhe }" "џ" :string) -(merge-rule "\IeC {\cyre }" "е" :string) -(merge-rule "\IeC {\cyrerev }" "э" :string) -(merge-rule "\IeC {\cyrery }" "ы" :string) -(merge-rule "\IeC {\cyrf }" "ф" :string) -(merge-rule "\IeC {\cyrg }" "г" :string) -(merge-rule "\IeC {\cyrgup }" "ґ" :string) -(merge-rule "\IeC {\cyrh }" "х" :string) -(merge-rule "\IeC {\cyrhrdsn }" "ъ" :string) -(merge-rule "\IeC {\cyri }" "и" :string) -(merge-rule "\IeC {\cyrie }" "є" :string) -(merge-rule "\IeC {\cyrii }" "і" :string) -(merge-rule "\IeC {\cyrishrt }" "й" :string) -(merge-rule "\IeC {\cyrje }" "ј" :string) -(merge-rule "\IeC {\cyrk }" "к" :string) -(merge-rule "\IeC {\cyrl }" "л" :string) -(merge-rule "\IeC {\cyrlje }" "љ" :string) -(merge-rule "\IeC {\cyrm }" "м" :string) -(merge-rule "\IeC {\cyrn }" "н" :string) -(merge-rule "\IeC {\cyrnje }" "њ" :string) -(merge-rule "\IeC {\cyro }" "о" :string) -(merge-rule "\IeC {\cyrp }" "п" :string) -(merge-rule "\IeC {\cyrr }" "р" :string) -(merge-rule "\IeC {\cyrs }" "с" :string) -(merge-rule "\IeC {\cyrsftsn }" "ь" :string) -(merge-rule "\IeC {\cyrsh }" "ш" :string) -(merge-rule "\IeC {\cyrshch }" "щ" :string) -(merge-rule "\IeC {\cyrt }" "т" :string) -(merge-rule "\IeC {\cyrtshe }" "ћ" :string) -(merge-rule "\IeC {\cyru }" "у" :string) -(merge-rule "\IeC {\cyrushrt }" "ў" :string) -(merge-rule "\IeC {\cyrv }" "в" :string) -(merge-rule "\IeC {\cyrya }" "я" :string) -(merge-rule "\IeC {\cyryi }" "ї" :string) -(merge-rule "\IeC {\cyryo }" "ё" :string) -(merge-rule "\IeC {\cyryu }" "ю" :string) -(merge-rule "\IeC {\cyrz }" "з" :string) -(merge-rule "\IeC {\cyrzh }" "ж" :string) diff --git a/crypto/krb5/doc/pdf/LICRlatin2utf8.xdy b/crypto/krb5/doc/pdf/LICRlatin2utf8.xdy deleted file mode 100644 index 1d768259cdbc..000000000000 --- a/crypto/krb5/doc/pdf/LICRlatin2utf8.xdy +++ /dev/null @@ -1,239 +0,0 @@ -;; style file for xindy -;; filename: LICRlatin2utf8.xdy -;; description: style file for xindy which maps back LaTeX Internal -;; Character Representation of letters (as arising in .idx index -;; file) to UTF-8 encoding for correct sorting by xindy. -;; usage: for use with the pdflatex engine, -;; *not* for use with xelatex or lualatex. -;; -;; This is based upon xindy's distributed file tex/inputenc/utf8.xdy. -;; The modifications include: -;; -;; - Updates for compatibility with current LaTeX macro encoding. -;; -;; - Systematic usage of the \IeC {...} mark-up, because mark-up in -;; tex/inputenc/utf8.xdy was using it on seemingly random basis, and -;; Sphinx coercing of xindy usability for both Latin and Cyrillic scripts -;; with pdflatex requires its systematic presence here. -;; -;; - Support for some extra letters: Ÿ, Ŋ, ŋ, Œ, œ, IJ, ij, ȷ and ẞ. -;; -;; Indeed Sphinx needs to support for pdflatex engine all Unicode letters -;; available in TeX T1 font encoding. The above letters are found in -;; that encoding but not in the Latin1, 2, 3 charsets which are those -;; covered by original tex/inputenc/utf8.xdy. -;; -;; - There is a problem that ȷ is not supported out-of-the box by LaTeX -;; with inputenc, one must add explicitly -;; \DeclareUnicodeCharacter{0237}{\j} -;; to preamble of LaTeX document. However this character is not supported -;; by the TeX "times" font used by default by Sphinx for pdflatex engine. -;; -;; **Update**: since LaTeX 2018/12/01, the \j as well as \SS, \k{} and -;; \.{} need no extra user declaration anymore. -;; -;; - ẞ needs \DeclareUnicodeCharacter{1E9E}{\SS} (but ß needs no extra set-up). -;; -;; - U+02DB (˛) and U+02D9 (˙) are also not supported by inputenc -;; out of the box and require -;; \DeclareUnicodeCharacter{02DB}{\k{}} -;; \DeclareUnicodeCharacter{02D9}{\.{}} -;; to be added to preamble. -;; -;; - U+0127 ħ and U+0126 Ħ are absent from TeX T1+TS1 font encodings. -;; -;; - Characters Ŋ and ŋ are not supported by TeX font "times" used by -;; default by Sphinx for pdflatex engine but they are supported by -;; some TeX fonts, in particular by the default LaTeX font for T1 -;; encoding. -;; -;; - " and ~ must be escaped as ~" and resp. ~~ in xindy merge rules. -;; -;; Contributed by the Sphinx team, July 2018. -;; -;; See sphinx.xdy for superior figures, as they are escaped by LaTeX writer. -(merge-rule "\IeC {\textonesuperior }" "¹" :string) -(merge-rule "\IeC {\texttwosuperior }" "²" :string) -(merge-rule "\IeC {\textthreesuperior }" "³" :string) -(merge-rule "\IeC {\'a}" "á" :string) -(merge-rule "\IeC {\'A}" "Á" :string) -(merge-rule "\IeC {\`a}" "à" :string) -(merge-rule "\IeC {\`A}" "À" :string) -(merge-rule "\IeC {\^a}" "â" :string) -(merge-rule "\IeC {\^A}" "Â" :string) -(merge-rule "\IeC {\~"a}" "ä" :string) -(merge-rule "\IeC {\~"A}" "Ä" :string) -(merge-rule "\IeC {\~~a}" "ã" :string) -(merge-rule "\IeC {\~~A}" "Ã" :string) -(merge-rule "\IeC {\c c}" "ç" :string) -(merge-rule "\IeC {\c C}" "Ç" :string) -(merge-rule "\IeC {\'c}" "ć" :string) -(merge-rule "\IeC {\'C}" "Ć" :string) -(merge-rule "\IeC {\^c}" "ĉ" :string) -(merge-rule "\IeC {\^C}" "Ĉ" :string) -(merge-rule "\IeC {\.c}" "ċ" :string) -(merge-rule "\IeC {\.C}" "Ċ" :string) -(merge-rule "\IeC {\c s}" "ş" :string) -(merge-rule "\IeC {\c S}" "Ş" :string) -(merge-rule "\IeC {\c t}" "ţ" :string) -(merge-rule "\IeC {\c T}" "Ţ" :string) -(merge-rule "\IeC {\-}" "" :string); soft hyphen -(merge-rule "\IeC {\textdiv }" "÷" :string) -(merge-rule "\IeC {\'e}" "é" :string) -(merge-rule "\IeC {\'E}" "É" :string) -(merge-rule "\IeC {\`e}" "è" :string) -(merge-rule "\IeC {\`E}" "È" :string) -(merge-rule "\IeC {\^e}" "ê" :string) -(merge-rule "\IeC {\^E}" "Ê" :string) -(merge-rule "\IeC {\~"e}" "ë" :string) -(merge-rule "\IeC {\~"E}" "Ë" :string) -(merge-rule "\IeC {\^g}" "ĝ" :string) -(merge-rule "\IeC {\^G}" "Ĝ" :string) -(merge-rule "\IeC {\.g}" "ġ" :string) -(merge-rule "\IeC {\.G}" "Ġ" :string) -(merge-rule "\IeC {\^h}" "ĥ" :string) -(merge-rule "\IeC {\^H}" "Ĥ" :string) -(merge-rule "\IeC {\H o}" "ő" :string) -(merge-rule "\IeC {\H O}" "Ő" :string) -(merge-rule "\IeC {\textacutedbl }" "˝" :string) -(merge-rule "\IeC {\H u}" "ű" :string) -(merge-rule "\IeC {\H U}" "Ű" :string) -(merge-rule "\IeC {\ae }" "æ" :string) -(merge-rule "\IeC {\AE }" "Æ" :string) -(merge-rule "\IeC {\textcopyright }" "©" :string) -(merge-rule "\IeC {\c \ }" "¸" :string) -(merge-rule "\IeC {\dh }" "ð" :string) -(merge-rule "\IeC {\DH }" "Ð" :string) -(merge-rule "\IeC {\dj }" "đ" :string) -(merge-rule "\IeC {\DJ }" "Đ" :string) -(merge-rule "\IeC {\guillemotleft }" "«" :string) -(merge-rule "\IeC {\guillemotright }" "»" :string) -(merge-rule "\IeC {\'\i }" "í" :string) -(merge-rule "\IeC {\`\i }" "ì" :string) -(merge-rule "\IeC {\^\i }" "î" :string) -(merge-rule "\IeC {\~"\i }" "ï" :string) -(merge-rule "\IeC {\i }" "ı" :string) -(merge-rule "\IeC {\^\j }" "ĵ" :string) -(merge-rule "\IeC {\k {}}" "˛" :string) -(merge-rule "\IeC {\l }" "ł" :string) -(merge-rule "\IeC {\L }" "Ł" :string) -(merge-rule "\IeC {\nobreakspace }" " " :string) -(merge-rule "\IeC {\o }" "ø" :string) -(merge-rule "\IeC {\O }" "Ø" :string) -(merge-rule "\IeC {\textsterling }" "£" :string) -(merge-rule "\IeC {\textparagraph }" "¶" :string) -(merge-rule "\IeC {\ss }" "ß" :string) -(merge-rule "\IeC {\textsection }" "§" :string) -(merge-rule "\IeC {\textbrokenbar }" "¦" :string) -(merge-rule "\IeC {\textcent }" "¢" :string) -(merge-rule "\IeC {\textcurrency }" "¤" :string) -(merge-rule "\IeC {\textdegree }" "°" :string) -(merge-rule "\IeC {\textexclamdown }" "¡" :string) -(merge-rule "\IeC {\texthbar }" "ħ" :string) -(merge-rule "\IeC {\textHbar }" "Ħ" :string) -(merge-rule "\IeC {\textonehalf }" "½" :string) -(merge-rule "\IeC {\textonequarter }" "¼" :string) -(merge-rule "\IeC {\textordfeminine }" "ª" :string) -(merge-rule "\IeC {\textordmasculine }" "º" :string) -(merge-rule "\IeC {\textperiodcentered }" "·" :string) -(merge-rule "\IeC {\textquestiondown }" "¿" :string) -(merge-rule "\IeC {\textregistered }" "®" :string) -(merge-rule "\IeC {\textthreequarters }" "¾" :string) -(merge-rule "\IeC {\textyen }" "¥" :string) -(merge-rule "\IeC {\th }" "þ" :string) -(merge-rule "\IeC {\TH }" "Þ" :string) -(merge-rule "\IeC {\'I}" "Í" :string) -(merge-rule "\IeC {\`I}" "Ì" :string) -(merge-rule "\IeC {\^I}" "Î" :string) -(merge-rule "\IeC {\~"I}" "Ï" :string) -(merge-rule "\IeC {\.I}" "İ" :string) -(merge-rule "\IeC {\^J}" "Ĵ" :string) -(merge-rule "\IeC {\k a}" "ą" :string) -(merge-rule "\IeC {\k A}" "Ą" :string) -(merge-rule "\IeC {\k e}" "ę" :string) -(merge-rule "\IeC {\k E}" "Ę" :string) -(merge-rule "\IeC {\'l}" "ĺ" :string) -(merge-rule "\IeC {\'L}" "Ĺ" :string) -(merge-rule "\IeC {\textlnot }" "¬" :string) -(merge-rule "\IeC {\textmu }" "µ" :string) -(merge-rule "\IeC {\'n}" "ń" :string) -(merge-rule "\IeC {\'N}" "Ń" :string) -(merge-rule "\IeC {\~~n}" "ñ" :string) -(merge-rule "\IeC {\~~N}" "Ñ" :string) -(merge-rule "\IeC {\'o}" "ó" :string) -(merge-rule "\IeC {\'O}" "Ó" :string) -(merge-rule "\IeC {\`o}" "ò" :string) -(merge-rule "\IeC {\`O}" "Ò" :string) -(merge-rule "\IeC {\^o}" "ô" :string) -(merge-rule "\IeC {\^O}" "Ô" :string) -(merge-rule "\IeC {\~"o}" "ö" :string) -(merge-rule "\IeC {\~"O}" "Ö" :string) -(merge-rule "\IeC {\~~o}" "õ" :string) -(merge-rule "\IeC {\~~O}" "Õ" :string) -(merge-rule "\IeC {\textpm }" "±" :string) -(merge-rule "\IeC {\r a}" "å" :string) -(merge-rule "\IeC {\r A}" "Å" :string) -(merge-rule "\IeC {\'r}" "ŕ" :string) -(merge-rule "\IeC {\'R}" "Ŕ" :string) -(merge-rule "\IeC {\r u}" "ů" :string) -(merge-rule "\IeC {\r U}" "Ů" :string) -(merge-rule "\IeC {\'s}" "ś" :string) -(merge-rule "\IeC {\'S}" "Ś" :string) -(merge-rule "\IeC {\^s}" "ŝ" :string) -(merge-rule "\IeC {\^S}" "Ŝ" :string) -(merge-rule "\IeC {\textasciidieresis }" "¨" :string) -(merge-rule "\IeC {\textasciimacron }" "¯" :string) -(merge-rule "\IeC {\.{}}" "˙" :string) -(merge-rule "\IeC {\textasciiacute }" "´" :string) -(merge-rule "\IeC {\texttimes }" "×" :string) -(merge-rule "\IeC {\u a}" "ă" :string) -(merge-rule "\IeC {\u A}" "Ă" :string) -(merge-rule "\IeC {\u g}" "ğ" :string) -(merge-rule "\IeC {\u G}" "Ğ" :string) -(merge-rule "\IeC {\textasciibreve }" "˘" :string) -(merge-rule "\IeC {\'u}" "ú" :string) -(merge-rule "\IeC {\'U}" "Ú" :string) -(merge-rule "\IeC {\`u}" "ù" :string) -(merge-rule "\IeC {\`U}" "Ù" :string) -(merge-rule "\IeC {\^u}" "û" :string) -(merge-rule "\IeC {\^U}" "Û" :string) -(merge-rule "\IeC {\~"u}" "ü" :string) -(merge-rule "\IeC {\~"U}" "Ü" :string) -(merge-rule "\IeC {\u u}" "ŭ" :string) -(merge-rule "\IeC {\u U}" "Ŭ" :string) -(merge-rule "\IeC {\v c}" "č" :string) -(merge-rule "\IeC {\v C}" "Č" :string) -(merge-rule "\IeC {\v d}" "ď" :string) -(merge-rule "\IeC {\v D}" "Ď" :string) -(merge-rule "\IeC {\v e}" "ě" :string) -(merge-rule "\IeC {\v E}" "Ě" :string) -(merge-rule "\IeC {\v l}" "ľ" :string) -(merge-rule "\IeC {\v L}" "Ľ" :string) -(merge-rule "\IeC {\v n}" "ň" :string) -(merge-rule "\IeC {\v N}" "Ň" :string) -(merge-rule "\IeC {\v r}" "ř" :string) -(merge-rule "\IeC {\v R}" "Ř" :string) -(merge-rule "\IeC {\v s}" "š" :string) -(merge-rule "\IeC {\v S}" "Š" :string) -(merge-rule "\IeC {\textasciicaron }" "ˇ" :string) -(merge-rule "\IeC {\v t}" "ť" :string) -(merge-rule "\IeC {\v T}" "Ť" :string) -(merge-rule "\IeC {\v z}" "ž" :string) -(merge-rule "\IeC {\v Z}" "Ž" :string) -(merge-rule "\IeC {\'y}" "ý" :string) -(merge-rule "\IeC {\'Y}" "Ý" :string) -(merge-rule "\IeC {\~"y}" "ÿ" :string) -(merge-rule "\IeC {\'z}" "ź" :string) -(merge-rule "\IeC {\'Z}" "Ź" :string) -(merge-rule "\IeC {\.z}" "ż" :string) -(merge-rule "\IeC {\.Z}" "Ż" :string) -;; letters not in Latin1, 2, 3 but available in TeX T1 font encoding -(merge-rule "\IeC {\~"Y}" "Ÿ" :string) -(merge-rule "\IeC {\NG }" "Ŋ" :string) -(merge-rule "\IeC {\ng }" "ŋ" :string) -(merge-rule "\IeC {\OE }" "Œ" :string) -(merge-rule "\IeC {\oe }" "œ" :string) -(merge-rule "\IeC {\IJ }" "IJ" :string) -(merge-rule "\IeC {\ij }" "ij" :string) -(merge-rule "\IeC {\j }" "ȷ" :string) -(merge-rule "\IeC {\SS }" "ẞ" :string) diff --git a/crypto/krb5/doc/pdf/LatinRules.xdy b/crypto/krb5/doc/pdf/LatinRules.xdy deleted file mode 100644 index b20fbbb83a55..000000000000 --- a/crypto/krb5/doc/pdf/LatinRules.xdy +++ /dev/null @@ -1,611 +0,0 @@ -;; Common Lisp style file for xindy -;; filename: LatinRules.xdy -;; -;; Please note that this data file deliberately uses strings -;; with single non-ascii bytes. This is intentional and -;; follows the usage observed in similar xindy support files. -;; -;; It is based upon xindy's files lang/general/utf8.xdy and -;; lang/general/utf8-lang.xdy which implement -;; "a general sorting order for Western European languages". -;; -;; The aim for Sphinx is to be able to index in a Cyrillic document -;; also terms using the Latin alphabets, inclusive of letters -;; with diacritics. To this effect the xindy rules from lang/general -;; got manually re-coded to avoid collisions with the encoding -;; done by xindy for sorting words in Cyrillic languages, which was -;; observed not to use bytes with octal encoding 0o266 or higher. -;; -;; So here we use only 0o266 or higher bytes. -;; (Ŋ, ŋ, IJ, and ij are absent from -;; lang/general/utf8.xdy and not included here.) -;; Contributed by the Sphinx team, 2018. - -(define-letter-group "A" :prefixes ("")) -(define-letter-group "B" :after "A" :prefixes ("")) -(define-letter-group "C" :after "B" :prefixes ("")) -(define-letter-group "D" :after "C" :prefixes ("")) -(define-letter-group "E" :after "D" :prefixes ("")) -(define-letter-group "F" :after "E" :prefixes ("")) -(define-letter-group "G" :after "F" :prefixes ("")) -(define-letter-group "H" :after "G" :prefixes ("")) -(define-letter-group "I" :after "H" :prefixes ("")) -(define-letter-group "J" :after "I" :prefixes ("")) -(define-letter-group "K" :after "J" :prefixes ("")) -(define-letter-group "L" :after "K" :prefixes ("")) -(define-letter-group "M" :after "L" :prefixes ("")) -(define-letter-group "N" :after "M" :prefixes ("")) -(define-letter-group "O" :after "N" :prefixes ("")) -(define-letter-group "P" :after "O" :prefixes ("")) -(define-letter-group "Q" :after "P" :prefixes ("")) -(define-letter-group "R" :after "Q" :prefixes ("")) -(define-letter-group "S" :after "R" :prefixes ("")) -(define-letter-group "T" :after "S" :prefixes ("")) -(define-letter-group "U" :after "T" :prefixes ("")) -(define-letter-group "V" :after "U" :prefixes ("")) -(define-letter-group "W" :after "V" :prefixes ("")) -(define-letter-group "X" :after "W" :prefixes ("")) -(define-letter-group "Y" :after "X" :prefixes ("")) -(define-letter-group "Z" :after "Y" :prefixes ("")) - -(define-rule-set "sphinx-xy-alphabetize" - - :rules (("À" "" :string) - ("Ă" "" :string) - ("â" "" :string) - ("Ä" "" :string) - ("à" "" :string) - ("Å" "" :string) - ("Ã" "" :string) - ("Á" "" :string) - ("á" "" :string) - ("ã" "" :string) - ("Â" "" :string) - ("ă" "" :string) - ("å" "" :string) - ("ą" "" :string) - ("ä" "" :string) - ("Ą" "" :string) - ("æ" "" :string) - ("Æ" "" :string) - ("ć" "" :string) - ("ĉ" "" :string) - ("ç" "" :string) - ("Č" "" :string) - ("č" "" :string) - ("Ĉ" "" :string) - ("Ç" "" :string) - ("Ć" "" :string) - ("ď" "" :string) - ("Đ" "" :string) - ("Ď" "" :string) - ("đ" "" :string) - ("ê" "" :string) - ("Ę" "" :string) - ("Ě" "" :string) - ("ë" "" :string) - ("ě" "" :string) - ("é" "" :string) - ("È" "" :string) - ("Ë" "" :string) - ("É" "" :string) - ("è" "" :string) - ("Ê" "" :string) - ("ę" "" :string) - ("ĝ" "" :string) - ("ğ" "" :string) - ("Ğ" "" :string) - ("Ĝ" "" :string) - ("ĥ" "" :string) - ("Ĥ" "" :string) - ("Ï" "" :string) - ("Í" "" :string) - ("ï" "" :string) - ("Î" "" :string) - ("î" "" :string) - ("ı" "" :string) - ("İ" "" :string) - ("í" "" :string) - ("Ì" "" :string) - ("ì" "" :string) - ("Ĵ" "" :string) - ("ĵ" "" :string) - ("ł" "" :string) - ("Ł" "" :string) - ("ľ" "" :string) - ("Ľ" "" :string) - ("ń" "" :string) - ("Ń" "" :string) - ("ñ" "" :string) - ("ň" "" :string) - ("Ñ" "" :string) - ("Ň" "" :string) - ("Õ" "" :string) - ("Ő" "" :string) - ("ó" "" :string) - ("ö" "" :string) - ("ô" "" :string) - ("ő" "" :string) - ("Ø" "" :string) - ("Ö" "" :string) - ("õ" "" :string) - ("Ô" "" :string) - ("ø" "" :string) - ("Ó" "" :string) - ("Ò" "" :string) - ("ò" "" :string) - ("œ" "ĺ" :string) - ("Œ" "ĺ" :string) - ("Ř" "" :string) - ("ř" "" :string) - ("Ŕ" "" :string) - ("ŕ" "" :string) - ("ŝ" "" :string) - ("Ś" "" :string) - ("ș" "" :string) - ("ş" "" :string) - ("Ŝ" "" :string) - ("ś" "" :string) - ("Ș" "" :string) - ("š" "" :string) - ("Ş" "" :string) - ("Š" "" :string) - ("ß" "" :string) - ("Ț" "" :string) - ("Ť" "" :string) - ("ț" "" :string) - ("ť" "" :string) - ("û" "" :string) - ("ŭ" "" :string) - ("ů" "" :string) - ("ű" "" :string) - ("ù" "" :string) - ("Ŭ" "" :string) - ("Ù" "" :string) - ("Ű" "" :string) - ("Ü" "" :string) - ("Ů" "" :string) - ("ú" "" :string) - ("Ú" "" :string) - ("Û" "" :string) - ("ü" "" :string) - ("ÿ" "" :string) - ("Ý" "" :string) - ("Ÿ" "" :string) - ("ý" "" :string) - ("Ż" "" :string) - ("Ž" "" :string) - ("Ź" "" :string) - ("ž" "" :string) - ("ż" "" :string) - ("ź" "" :string) - ("a" "" :string) - ("A" "" :string) - ("b" "" :string) - ("B" "" :string) - ("c" "" :string) - ("C" "" :string) - ("d" "" :string) - ("D" "" :string) - ("e" "" :string) - ("E" "" :string) - ("F" "" :string) - ("f" "" :string) - ("G" "" :string) - ("g" "" :string) - ("H" "" :string) - ("h" "" :string) - ("i" "" :string) - ("I" "" :string) - ("J" "" :string) - ("j" "" :string) - ("K" "" :string) - ("k" "" :string) - ("L" "" :string) - ("l" "" :string) - ("M" "" :string) - ("m" "" :string) - ("n" "" :string) - ("N" "" :string) - ("O" "" :string) - ("o" "" :string) - ("p" "" :string) - ("P" "" :string) - ("Q" "" :string) - ("q" "" :string) - ("r" "" :string) - ("R" "" :string) - ("S" "" :string) - ("s" "" :string) - ("t" "" :string) - ("T" "" :string) - ("u" "" :string) - ("U" "" :string) - ("v" "" :string) - ("V" "" :string) - ("W" "" :string) - ("w" "" :string) - ("x" "" :string) - ("X" "" :string) - ("Y" "" :string) - ("y" "" :string) - ("z" "" :string) - ("Z" "" :string) - )) - -(define-rule-set "sphinx-xy-resolve-diacritics" - - :rules (("Ĥ" "" :string) - ("ó" "" :string) - ("ľ" "" :string) - ("Ř" "" :string) - ("ĝ" "" :string) - ("ď" "" :string) - ("Ě" "" :string) - ("ĥ" "" :string) - ("Č" "" :string) - ("Ĵ" "" :string) - ("ě" "" :string) - ("ž" "" :string) - ("Ď" "" :string) - ("ř" "" :string) - ("Ž" "" :string) - ("ı" "" :string) - ("Ť" "" :string) - ("á" "" :string) - ("č" "" :string) - ("Á" "" :string) - ("ň" "" :string) - ("Š" "" :string) - ("Ň" "" :string) - ("ĵ" "" :string) - ("ť" "" :string) - ("Ó" "" :string) - ("ý" "" :string) - ("Ĝ" "" :string) - ("Ú" "" :string) - ("Ľ" "" :string) - ("š" "" :string) - ("Ý" "" :string) - ("ú" "" :string) - ("Ś" "" :string) - ("ć" "" :string) - ("Ł" "" :string) - ("ł" "" :string) - ("ń" "" :string) - ("À" "" :string) - ("Ź" "" :string) - ("à" "" :string) - ("Ń" "" :string) - ("Đ" "" :string) - ("ÿ" "" :string) - ("ś" "" :string) - ("Ğ" "" :string) - ("ğ" "" :string) - ("Ù" "" :string) - ("İ" "" :string) - ("đ" "" :string) - ("ù" "" :string) - ("Ț" "" :string) - ("é" "" :string) - ("ŕ" "" :string) - ("Ć" "" :string) - ("ț" "" :string) - ("ò" "" :string) - ("ź" "" :string) - ("Ò" "" :string) - ("Ÿ" "" :string) - ("Ŕ" "" :string) - ("É" "" :string) - ("ĉ" "" :string) - ("ô" "" :string) - ("Í" "" :string) - ("ŝ" "" :string) - ("Ż" "" :string) - ("Ă" "" :string) - ("Ŝ" "" :string) - ("ñ" "" :string) - ("ŭ" "" :string) - ("í" "" :string) - ("È" "" :string) - ("Ô" "" :string) - ("Ŭ" "" :string) - ("ż" "" :string) - ("Ñ" "" :string) - ("è" "" :string) - ("Ĉ" "" :string) - ("ă" "" :string) - ("â" "" :string) - ("û" "" :string) - ("ê" "" :string) - ("Õ" "" :string) - ("õ" "" :string) - ("ș" "" :string) - ("ç" "" :string) - ("Â" "" :string) - ("Ê" "" :string) - ("Û" "" :string) - ("Ç" "" :string) - ("ì" "" :string) - ("Ì" "" :string) - ("Ș" "" :string) - ("ö" "" :string) - ("Ö" "" :string) - ("ş" "" :string) - ("ů" "" :string) - ("ë" "" :string) - ("ã" "" :string) - ("î" "" :string) - ("Î" "" :string) - ("Ã" "" :string) - ("Ş" "" :string) - ("Ů" "" :string) - ("Ë" "" :string) - ("ï" "" :string) - ("Ő" "" :string) - ("Ï" "" :string) - ("Ę" "" :string) - ("ő" "" :string) - ("Ü" "" :string) - ("Å" "" :string) - ("ü" "" :string) - ("ę" "" :string) - ("å" "" :string) - ("Ä" "" :string) - ("ű" "" :string) - ("Ø" "" :string) - ("ø" "" :string) - ("Ű" "" :string) - ("ä" "" :string) - ("Ą" "" :string) - ("ą" "" :string) - ("œ" "" :string) - ("ß" "" :string) - ("Æ" "" :string) - ("Œ" "" :string) - ("æ" "" :string) - ("e" "" :string) - ("t" "" :string) - ("L" "" :string) - ("Y" "" :string) - ("J" "" :string) - ("a" "" :string) - ("p" "" :string) - ("u" "" :string) - ("j" "" :string) - ("b" "" :string) - ("G" "" :string) - ("U" "" :string) - ("F" "" :string) - ("H" "" :string) - ("i" "" :string) - ("z" "" :string) - ("c" "" :string) - ("l" "" :string) - ("A" "" :string) - ("Q" "" :string) - ("w" "" :string) - ("D" "" :string) - ("R" "" :string) - ("d" "" :string) - ("s" "" :string) - ("r" "" :string) - ("k" "" :string) - ("v" "" :string) - ("m" "" :string) - ("P" "" :string) - ("y" "" :string) - ("K" "" :string) - ("q" "" :string) - ("S" "" :string) - ("I" "" :string) - ("C" "" :string) - ("M" "" :string) - ("Z" "" :string) - ("T" "" :string) - ("W" "" :string) - ("B" "" :string) - ("h" "" :string) - ("x" "" :string) - ("X" "" :string) - ("f" "" :string) - ("E" "" :string) - ("V" "" :string) - ("N" "" :string) - ("O" "" :string) - ("o" "" :string) - ("g" "" :string) - ("n" "" :string) - )) - -(define-rule-set "sphinx-xy-resolve-case" - - :rules (("Ú" "8" :string) - ("Ÿ" "8" :string) - ("Ç" "8" :string) - ("Ĉ" "8" :string) - ("Ŕ" "8" :string) - ("Ľ" "8" :string) - ("Ů" "8" :string) - ("Ý" "8" :string) - ("É" "8" :string) - ("Ë" "8" :string) - ("Ș" "8" :string) - ("Ì" "8" :string) - ("Ê" "8" :string) - ("Ň" "8" :string) - ("Ą" "8" :string) - ("Š" "8" :string) - ("Û" "8" :string) - ("Ş" "8" :string) - ("Ć" "8" :string) - ("Ò" "8" :string) - ("Ĝ" "8" :string) - ("Ñ" "8" :string) - ("Ó" "8" :string) - ("Î" "8" :string) - ("Á" "8" :string) - ("Ã" "8" :string) - ("Ț" "8" :string) - ("Å" "8" :string) - ("Ğ" "8" :string) - ("Ü" "8" :string) - ("È" "8" :string) - ("Ô" "8" :string) - ("İ" "8" :string) - ("Ű" "8" :string) - ("Ù" "8" :string) - ("Ŭ" "8" :string) - ("Â" "8" :string) - ("Ť" "8" :string) - ("Ń" "8" :string) - ("Ď" "8" :string) - ("Ź" "8" :string) - ("Ž" "8" :string) - ("Đ" "8" :string) - ("Ŝ" "8" :string) - ("Č" "8" :string) - ("Ĵ" "8" :string) - ("Ö" "8" :string) - ("Ø" "8" :string) - ("Ż" "8" :string) - ("Ł" "8" :string) - ("Ă" "8" :string) - ("Ě" "8" :string) - ("Ő" "8" :string) - ("Õ" "8" :string) - ("Ę" "8" :string) - ("Ï" "8" :string) - ("À" "8" :string) - ("Ĥ" "8" :string) - ("Ä" "8" :string) - ("Ś" "8" :string) - ("Ř" "8" :string) - ("Í" "8" :string) - ("Œ" "89" :string) - ("Æ" "89" :string) - ("ì" "9" :string) - ("è" "9" :string) - ("ą" "9" :string) - ("š" "9" :string) - ("ú" "9" :string) - ("å" "9" :string) - ("ă" "9" :string) - ("ę" "9" :string) - ("ü" "9" :string) - ("ź" "9" :string) - ("ò" "9" :string) - ("ť" "9" :string) - ("ț" "9" :string) - ("ĵ" "9" :string) - ("ŕ" "9" :string) - ("ż" "9" :string) - ("ä" "9" :string) - ("ý" "9" :string) - ("ù" "9" :string) - ("á" "9" :string) - ("é" "9" :string) - ("č" "9" :string) - ("ň" "9" :string) - ("ś" "9" :string) - ("ø" "9" :string) - ("í" "9" :string) - ("đ" "9" :string) - ("ı" "9" :string) - ("ğ" "9" :string) - ("î" "9" :string) - ("ã" "9" :string) - ("à" "9" :string) - ("ř" "9" :string) - ("ő" "9" :string) - ("ů" "9" :string) - ("ș" "9" :string) - ("ÿ" "9" :string) - ("ë" "9" :string) - ("ŭ" "9" :string) - ("ç" "9" :string) - ("ű" "9" :string) - ("ñ" "9" :string) - ("õ" "9" :string) - ("ě" "9" :string) - ("ş" "9" :string) - ("ž" "9" :string) - ("ĝ" "9" :string) - ("ŝ" "9" :string) - ("ń" "9" :string) - ("û" "9" :string) - ("ł" "9" :string) - ("ď" "9" :string) - ("ĥ" "9" :string) - ("ê" "9" :string) - ("ô" "9" :string) - ("ĉ" "9" :string) - ("â" "9" :string) - ("ć" "9" :string) - ("ï" "9" :string) - ("ö" "9" :string) - ("ľ" "9" :string) - ("ó" "9" :string) - ("æ" "99" :string) - ("ß" "99" :string) - ("œ" "99" :string) - ("N" "8" :string) - ("V" "8" :string) - ("O" "8" :string) - ("X" "8" :string) - ("E" "8" :string) - ("P" "8" :string) - ("K" "8" :string) - ("T" "8" :string) - ("Z" "8" :string) - ("M" "8" :string) - ("C" "8" :string) - ("I" "8" :string) - ("S" "8" :string) - ("B" "8" :string) - ("W" "8" :string) - ("D" "8" :string) - ("R" "8" :string) - ("H" "8" :string) - ("F" "8" :string) - ("Q" "8" :string) - ("A" "8" :string) - ("G" "8" :string) - ("U" "8" :string) - ("J" "8" :string) - ("Y" "8" :string) - ("L" "8" :string) - ("o" "9" :string) - ("n" "9" :string) - ("g" "9" :string) - ("x" "9" :string) - ("f" "9" :string) - ("y" "9" :string) - ("q" "9" :string) - ("h" "9" :string) - ("w" "9" :string) - ("s" "9" :string) - ("d" "9" :string) - ("v" "9" :string) - ("k" "9" :string) - ("r" "9" :string) - ("m" "9" :string) - ("z" "9" :string) - ("c" "9" :string) - ("i" "9" :string) - ("l" "9" :string) - ("b" "9" :string) - ("j" "9" :string) - ("a" "9" :string) - ("p" "9" :string) - ("u" "9" :string) - ("t" "9" :string) - ("e" "9" :string) - )) - -(use-rule-set :run 0 - :rule-set ("sphinx-xy-alphabetize")) -(use-rule-set :run 1 - :rule-set ("sphinx-xy-resolve-diacritics")) -(use-rule-set :run 2 - :rule-set ("sphinx-xy-resolve-case")) diff --git a/crypto/krb5/doc/pdf/admin.pdf b/crypto/krb5/doc/pdf/admin.pdf Binary files differdeleted file mode 100644 index c43de5e42bbe..000000000000 --- a/crypto/krb5/doc/pdf/admin.pdf +++ /dev/null diff --git a/crypto/krb5/doc/pdf/admin.tex b/crypto/krb5/doc/pdf/admin.tex deleted file mode 100644 index 42c2b5ba486e..000000000000 --- a/crypto/krb5/doc/pdf/admin.tex +++ /dev/null @@ -1,12502 +0,0 @@ -%% Generated by Sphinx. -\def\sphinxdocclass{report} -\documentclass[letterpaper,10pt,english]{sphinxmanual} -\ifdefined\pdfpxdimen - \let\sphinxpxdimen\pdfpxdimen\else\newdimen\sphinxpxdimen -\fi \sphinxpxdimen=.75bp\relax -\ifdefined\pdfimageresolution - \pdfimageresolution= \numexpr \dimexpr1in\relax/\sphinxpxdimen\relax -\fi -%% let collapsible pdf bookmarks panel have high depth per default -\PassOptionsToPackage{bookmarksdepth=5}{hyperref} - -\PassOptionsToPackage{booktabs}{sphinx} -\PassOptionsToPackage{colorrows}{sphinx} - -\PassOptionsToPackage{warn}{textcomp} -\usepackage[utf8]{inputenc} -\ifdefined\DeclareUnicodeCharacter -% support both utf8 and utf8x syntaxes - \ifdefined\DeclareUnicodeCharacterAsOptional - \def\sphinxDUC#1{\DeclareUnicodeCharacter{"#1}} - \else - \let\sphinxDUC\DeclareUnicodeCharacter - \fi - \sphinxDUC{00A0}{\nobreakspace} - \sphinxDUC{2500}{\sphinxunichar{2500}} - \sphinxDUC{2502}{\sphinxunichar{2502}} - \sphinxDUC{2514}{\sphinxunichar{2514}} - \sphinxDUC{251C}{\sphinxunichar{251C}} - \sphinxDUC{2572}{\textbackslash} -\fi -\usepackage{cmap} -\usepackage[T1]{fontenc} -\usepackage{amsmath,amssymb,amstext} -\usepackage{babel} - - - -\usepackage{tgtermes} -\usepackage{tgheros} -\renewcommand{\ttdefault}{txtt} - - - -\usepackage[Bjarne]{fncychap} -\usepackage{sphinx} - -\fvset{fontsize=auto} -\usepackage{geometry} - - -% Include hyperref last. -\usepackage{hyperref} -% Fix anchor placement for figures with captions. -\usepackage{hypcap}% it must be loaded after hyperref. -% Set up styles of URL: it should be placed after hyperref. -\urlstyle{same} - - -\usepackage{sphinxmessages} -\setcounter{tocdepth}{0} - - - -\title{Kerberos Administration Guide} -\date{ } -\release{1.22\sphinxhyphen{}final} -\author{MIT} -\newcommand{\sphinxlogo}{\vbox{}} -\renewcommand{\releasename}{Release} -\makeindex -\begin{document} - -\ifdefined\shorthandoff - \ifnum\catcode`\=\string=\active\shorthandoff{=}\fi - \ifnum\catcode`\"=\active\shorthandoff{"}\fi -\fi - -\pagestyle{empty} -\sphinxmaketitle -\pagestyle{plain} -\sphinxtableofcontents -\pagestyle{normal} -\phantomsection\label{\detokenize{admin/index::doc}} - - -\sphinxstepscope - - -\chapter{Installation guide} -\label{\detokenize{admin/install:installation-guide}}\label{\detokenize{admin/install::doc}} - -\section{Contents} -\label{\detokenize{admin/install:contents}} -\sphinxstepscope - - -\subsection{Installing KDCs} -\label{\detokenize{admin/install_kdc:installing-kdcs}}\label{\detokenize{admin/install_kdc::doc}} -\sphinxAtStartPar -When setting up Kerberos in a production environment, it is best to -have multiple replica KDCs alongside with a primary KDC to ensure the -continued availability of the Kerberized services. Each KDC contains -a copy of the Kerberos database. The primary KDC contains the -writable copy of the realm database, which it replicates to the -replica KDCs at regular intervals. All database changes (such as -password changes) are made on the primary KDC. Replica KDCs provide -Kerberos ticket\sphinxhyphen{}granting services, but not database administration, -when the primary KDC is unavailable. MIT recommends that you install -all of your KDCs to be able to function as either the primary or one -of the replicas. This will enable you to easily switch your primary -KDC with one of the replicas if necessary (see -{\hyperref[\detokenize{admin/install_kdc:switch-primary-replica}]{\sphinxcrossref{\DUrole{std,std-ref}{Switching primary and replica KDCs}}}}). This installation procedure is based -on that recommendation. - -\begin{sphinxadmonition}{warning}{Warning:}\begin{itemize} -\item {} -\sphinxAtStartPar -The Kerberos system relies on the availability of correct time -information. Ensure that the primary and all replica KDCs have -properly synchronized clocks. - -\item {} -\sphinxAtStartPar -It is best to install and run KDCs on secured and dedicated -hardware with limited access. If your KDC is also a file -server, FTP server, Web server, or even just a client machine, -someone who obtained root access through a security hole in any -of those areas could potentially gain access to the Kerberos -database. - -\end{itemize} -\end{sphinxadmonition} - - -\subsubsection{Install and configure the primary KDC} -\label{\detokenize{admin/install_kdc:install-and-configure-the-primary-kdc}} -\sphinxAtStartPar -Install Kerberos either from the OS\sphinxhyphen{}provided packages or from the -source (See \DUrole{xref,std,std-ref}{do\_build}). - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -For the purpose of this document we will use the following -names: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{\PYGZhy{}} \PYG{n}{primary} \PYG{n}{KDC} -\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{\PYGZhy{}} \PYG{n}{replica} \PYG{n}{KDC} -\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{\PYGZhy{}} \PYG{n}{realm} \PYG{n}{name} -\PYG{o}{.}\PYG{n}{k5}\PYG{o}{.}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{\PYGZhy{}} \PYG{n}{stash} \PYG{n}{file} -\PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin} \PYG{o}{\PYGZhy{}} \PYG{n}{admin} \PYG{n}{principal} -\end{sphinxVerbatim} - -\sphinxAtStartPar -See {\hyperref[\detokenize{mitK5defaults:mitk5defaults}]{\sphinxcrossref{\DUrole{std,std-ref}{MIT Kerberos defaults}}}} for the default names and locations -of the relevant to this topic files. Adjust the names and -paths to your system environment. -\end{sphinxadmonition} - - -\subsubsection{Edit KDC configuration files} -\label{\detokenize{admin/install_kdc:edit-kdc-configuration-files}} -\sphinxAtStartPar -Modify the configuration files, {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} and -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, to reflect the correct information (such as -domain\sphinxhyphen{}realm mappings and Kerberos servers names) for your realm. -(See {\hyperref[\detokenize{mitK5defaults:mitk5defaults}]{\sphinxcrossref{\DUrole{std,std-ref}{MIT Kerberos defaults}}}} for the recommended default locations for -these files). - -\sphinxAtStartPar -Most of the tags in the configuration have default values that will -work well for most sites. There are some tags in the -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file whose values must be specified, and this -section will explain those. - -\sphinxAtStartPar -If the locations for these configuration files differs from the -default ones, set \sphinxstylestrong{KRB5\_CONFIG} and \sphinxstylestrong{KRB5\_KDC\_PROFILE} environment -variables to point to the krb5.conf and kdc.conf respectively. For -example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{export} \PYG{n}{KRB5\PYGZus{}CONFIG}\PYG{o}{=}\PYG{o}{/}\PYG{n}{yourdir}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{conf} -\PYG{n}{export} \PYG{n}{KRB5\PYGZus{}KDC\PYGZus{}PROFILE}\PYG{o}{=}\PYG{o}{/}\PYG{n}{yourdir}\PYG{o}{/}\PYG{n}{kdc}\PYG{o}{.}\PYG{n}{conf} -\end{sphinxVerbatim} - - -\paragraph{krb5.conf} -\label{\detokenize{admin/install_kdc:krb5-conf}} -\sphinxAtStartPar -If you are not using DNS TXT records (see {\hyperref[\detokenize{admin/realm_config:mapping-hostnames}]{\sphinxcrossref{\DUrole{std,std-ref}{Mapping hostnames onto Kerberos realms}}}}), -you must specify the \sphinxstylestrong{default\_realm} in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} -section. If you are not using DNS URI or SRV records (see -{\hyperref[\detokenize{admin/realm_config:kdc-hostnames}]{\sphinxcrossref{\DUrole{std,std-ref}{Hostnames for KDCs}}}} and {\hyperref[\detokenize{admin/realm_config:kdc-discovery}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC Discovery}}}}), you must include the -\sphinxstylestrong{kdc} tag for each \sphinxstyleemphasis{realm} in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section. To -communicate with the kadmin server in each realm, the \sphinxstylestrong{admin\_server} -tag must be set in the -{\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section. - -\sphinxAtStartPar -An example krb5.conf file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} - \PYG{n}{default\PYGZus{}realm} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - - -\paragraph{kdc.conf} -\label{\detokenize{admin/install_kdc:kdc-conf}} -\sphinxAtStartPar -The kdc.conf file can be used to control the listening ports of the -KDC and kadmind, as well as realm\sphinxhyphen{}specific defaults, the database type -and location, and logging. - -\sphinxAtStartPar -An example kdc.conf file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} - \PYG{n}{kdc\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} - \PYG{n}{kdc\PYGZus{}tcp\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} - -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{kadmind\PYGZus{}port} \PYG{o}{=} \PYG{l+m+mi}{749} - \PYG{n}{max\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{12}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} - \PYG{n}{max\PYGZus{}renewable\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{7}\PYG{n}{d} \PYG{l+m+mi}{0}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} - \PYG{n}{master\PYGZus{}key\PYGZus{}type} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts} - \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{p}{:}\PYG{n}{normal} - \PYG{c+c1}{\PYGZsh{} If the default location does not suit your setup,} - \PYG{c+c1}{\PYGZsh{} explicitly configure the following values:} - \PYG{c+c1}{\PYGZsh{} database\PYGZus{}name = /var/krb5kdc/principal} - \PYG{c+c1}{\PYGZsh{} key\PYGZus{}stash\PYGZus{}file = /var/krb5kdc/.k5.ATHENA.MIT.EDU} - \PYG{c+c1}{\PYGZsh{} acl\PYGZus{}file = /var/krb5kdc/kadm5.acl} - \PYG{p}{\PYGZcb{}} - -\PYG{p}{[}\PYG{n}{logging}\PYG{p}{]} - \PYG{c+c1}{\PYGZsh{} By default, the KDC and kadmind will log output using} - \PYG{c+c1}{\PYGZsh{} syslog. You can instead send log output to files like this:} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{.}\PYG{n}{log} - \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{log} - \PYG{n}{default} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{krb5lib}\PYG{o}{.}\PYG{n}{log} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Replace \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} and \sphinxcode{\sphinxupquote{kerberos.mit.edu}} with the name of -your Kerberos realm and server respectively. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -You have to have write permission on the target directories -(these directories must exist) used by \sphinxstylestrong{database\_name}, -\sphinxstylestrong{key\_stash\_file}, and \sphinxstylestrong{acl\_file}. -\end{sphinxadmonition} - - -\subsubsection{Create the KDC database} -\label{\detokenize{admin/install_kdc:create-the-kdc-database}}\label{\detokenize{admin/install_kdc:create-db}} -\sphinxAtStartPar -You will use the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} command on the primary KDC to -create the Kerberos database and the optional \DUrole{xref,std,std-ref}{stash\_definition}. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If you choose not to install a stash file, the KDC will -prompt you for the master key each time it starts up. This -means that the KDC will not be able to start automatically, -such as after a system reboot. -\end{sphinxadmonition} - -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} will prompt you for the master password for the -Kerberos database. This password can be any string. A good password -is one you can remember, but that no one else can guess. Examples of -bad passwords are words that can be found in a dictionary, any common -or popular name, especially a famous person (or cartoon character), -your username in any form (e.g., forward, backward, repeated twice, -etc.), and any of the sample passwords that appear in this manual. -One example of a password which might be good if it did not appear in -this manual is “MITiys4K5!”, which represents the sentence “MIT is -your source for Kerberos 5!” (It’s the first letter of each word, -substituting the numeral “4” for the word “for”, and includes the -punctuation mark at the end.) - -\sphinxAtStartPar -The following is an example of how to create a Kerberos database and -stash file on the primary KDC, using the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} command. -Replace \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} with the name of your Kerberos realm: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdb5\PYGZus{}util} \PYG{n}{create} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{\PYGZhy{}}\PYG{n}{s} - -\PYG{n}{Initializing} \PYG{n}{database} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{/usr/local/var/krb5kdc/principal}\PYG{l+s+s1}{\PYGZsq{}} \PYG{k}{for} \PYG{n}{realm} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{ATHENA.MIT.EDU}\PYG{l+s+s1}{\PYGZsq{}}\PYG{p}{,} -\PYG{n}{master} \PYG{n}{key} \PYG{n}{name} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{K/M@ATHENA.MIT.EDU}\PYG{l+s+s1}{\PYGZsq{}} -\PYG{n}{You} \PYG{n}{will} \PYG{n}{be} \PYG{n}{prompted} \PYG{k}{for} \PYG{n}{the} \PYG{n}{database} \PYG{n}{Master} \PYG{n}{Password}\PYG{o}{.} -\PYG{n}{It} \PYG{o+ow}{is} \PYG{n}{important} \PYG{n}{that} \PYG{n}{you} \PYG{n}{NOT} \PYG{n}{FORGET} \PYG{n}{this} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Enter} \PYG{n}{KDC} \PYG{n}{database} \PYG{n}{master} \PYG{n}{key}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{=} \PYG{n}{Type} \PYG{n}{the} \PYG{n}{master} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{KDC} \PYG{n}{database} \PYG{n}{master} \PYG{n}{key} \PYG{n}{to} \PYG{n}{verify}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{=} \PYG{n}{Type} \PYG{n}{it} \PYG{n}{again}\PYG{o}{.} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This will create five files in {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}} (or at the locations specified -in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}): -\begin{itemize} -\item {} -\sphinxAtStartPar -two Kerberos database files, \sphinxcode{\sphinxupquote{principal}}, and \sphinxcode{\sphinxupquote{principal.ok}} - -\item {} -\sphinxAtStartPar -the Kerberos administrative database file, \sphinxcode{\sphinxupquote{principal.kadm5}} - -\item {} -\sphinxAtStartPar -the administrative database lock file, \sphinxcode{\sphinxupquote{principal.kadm5.lock}} - -\item {} -\sphinxAtStartPar -the stash file, in this example \sphinxcode{\sphinxupquote{.k5.ATHENA.MIT.EDU}}. If you do -not want a stash file, run the above command without the \sphinxstylestrong{\sphinxhyphen{}s} -option. - -\end{itemize} - -\sphinxAtStartPar -For more information on administrating Kerberos database see -{\hyperref[\detokenize{admin/database:db-operations}]{\sphinxcrossref{\DUrole{std,std-ref}{Operations on the Kerberos database}}}}. - - -\subsubsection{Add administrators to the ACL file} -\label{\detokenize{admin/install_kdc:add-administrators-to-the-acl-file}}\label{\detokenize{admin/install_kdc:admin-acl}} -\sphinxAtStartPar -Next, you need create an Access Control List (ACL) file and put the -Kerberos principal of at least one of the administrators into it. -This file is used by the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon to control which -principals may view and make privileged modifications to the Kerberos -database files. The ACL filename is determined by the \sphinxstylestrong{acl\_file} -variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}; the default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}}. - -\sphinxAtStartPar -For more information on Kerberos ACL file see {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}. - - -\subsubsection{Add administrators to the Kerberos database} -\label{\detokenize{admin/install_kdc:add-administrators-to-the-kerberos-database}}\label{\detokenize{admin/install_kdc:addadmin-kdb}} -\sphinxAtStartPar -Next you need to add administrative principals (i.e., principals who -are allowed to administer Kerberos database) to the Kerberos database. -You \sphinxstyleemphasis{must} add at least one principal now to allow communication -between the Kerberos administration daemon kadmind and the kadmin -program over the network for further administration. To do this, use -the kadmin.local utility on the primary KDC. kadmin.local is designed -to be run on the primary KDC host without using Kerberos -authentication to an admin server; instead, it must have read and -write access to the Kerberos database on the local filesystem. - -\sphinxAtStartPar -The administrative principals you create should be the ones you added -to the ACL file (see {\hyperref[\detokenize{admin/install_kdc:admin-acl}]{\sphinxcrossref{\DUrole{std,std-ref}{Add administrators to the ACL file}}}}). - -\sphinxAtStartPar -In the following example, the administrative principal \sphinxcode{\sphinxupquote{admin/admin}} -is created: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{local} - -\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{local}\PYG{p}{:} \PYG{n}{addprinc} \PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - -\PYG{n}{No} \PYG{n}{policy} \PYG{n}{specified} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{admin/admin@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} -\PYG{n}{assigning} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{default}\PYG{l+s+s2}{\PYGZdq{}}\PYG{o}{.} -\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{=} \PYG{n}{Enter} \PYG{n}{a} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{=} \PYG{n}{Type} \PYG{n}{it} \PYG{n}{again}\PYG{o}{.} -\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{admin/admin@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{created}\PYG{o}{.} -\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{local}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{Start the Kerberos daemons on the primary KDC} -\label{\detokenize{admin/install_kdc:start-the-kerberos-daemons-on-the-primary-kdc}}\label{\detokenize{admin/install_kdc:start-kdc-daemons}} -\sphinxAtStartPar -At this point, you are ready to start the Kerberos KDC -({\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}) and administrative daemons on the primary KDC. To -do so, type: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{krb5kdc} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kadmind} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Each server daemon will fork and run in the background. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Assuming you want these daemons to start up automatically at -boot time, you can add them to the KDC’s \sphinxcode{\sphinxupquote{/etc/rc}} or -\sphinxcode{\sphinxupquote{/etc/inittab}} file. You need to have a -\DUrole{xref,std,std-ref}{stash\_definition} in order to do this. -\end{sphinxadmonition} - -\sphinxAtStartPar -You can verify that they started properly by checking for their -startup messages in the logging locations you defined in -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} (see {\hyperref[\detokenize{admin/conf_files/kdc_conf:logging}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}logging{]}}}}}). For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{tail} \PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{.}\PYG{n}{log} -\PYG{n}{Dec} \PYG{l+m+mi}{02} \PYG{l+m+mi}{12}\PYG{p}{:}\PYG{l+m+mi}{35}\PYG{p}{:}\PYG{l+m+mi}{47} \PYG{n}{beeblebrox} \PYG{n}{krb5kdc}\PYG{p}{[}\PYG{l+m+mi}{3187}\PYG{p}{]}\PYG{p}{(}\PYG{n}{info}\PYG{p}{)}\PYG{p}{:} \PYG{n}{commencing} \PYG{n}{operation} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{tail} \PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{log} -\PYG{n}{Dec} \PYG{l+m+mi}{02} \PYG{l+m+mi}{12}\PYG{p}{:}\PYG{l+m+mi}{35}\PYG{p}{:}\PYG{l+m+mi}{52} \PYG{n}{beeblebrox} \PYG{n}{kadmind}\PYG{p}{[}\PYG{l+m+mi}{3189}\PYG{p}{]}\PYG{p}{(}\PYG{n}{info}\PYG{p}{)}\PYG{p}{:} \PYG{n}{starting} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Any errors the daemons encounter while starting will also be listed in -the logging output. - -\sphinxAtStartPar -As an additional verification, check if \DUrole{xref,std,std-ref}{kinit(1)} succeeds -against the principals that you have created on the previous step -({\hyperref[\detokenize{admin/install_kdc:addadmin-kdb}]{\sphinxcrossref{\DUrole{std,std-ref}{Add administrators to the Kerberos database}}}}). Run: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kinit} \PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - - -\subsubsection{Install the replica KDCs} -\label{\detokenize{admin/install_kdc:install-the-replica-kdcs}} -\sphinxAtStartPar -You are now ready to start configuring the replica KDCs. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Assuming you are setting the KDCs up so that you can easily -switch the primary KDC with one of the replicas, you should -perform each of these steps on the primary KDC as well as -the replica KDCs, unless these instructions specify -otherwise. -\end{sphinxadmonition} - - -\paragraph{Create host keytabs for replica KDCs} -\label{\detokenize{admin/install_kdc:create-host-keytabs-for-replica-kdcs}}\label{\detokenize{admin/install_kdc:replica-host-key}} -\sphinxAtStartPar -Each KDC needs a \sphinxcode{\sphinxupquote{host}} key in the Kerberos database. These keys -are used for mutual authentication when propagating the database dump -file from the primary KDC to the secondary KDC servers. - -\sphinxAtStartPar -On the primary KDC, connect to administrative interface and create the -host principal for each of the KDCs’ \sphinxcode{\sphinxupquote{host}} services. For example, -if the primary KDC were called \sphinxcode{\sphinxupquote{kerberos.mit.edu}}, and you had a -replica KDC named \sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1.mit.edu}}, you would type the -following: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kadmin} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{randkey} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{n}{No} \PYG{n}{policy} \PYG{n}{specified} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{host/kerberos.mit.edu@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} \PYG{n}{assigning} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{default}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{host/kerberos.mit.edu@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{created}\PYG{o}{.} - -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{randkey} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{n}{No} \PYG{n}{policy} \PYG{n}{specified} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{host/kerberos\PYGZhy{}1.mit.edu@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} \PYG{n}{assigning} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{default}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{host/kerberos\PYGZhy{}1.mit.edu@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{created}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -It is not strictly necessary to have the primary KDC server in the -Kerberos database, but it can be handy if you want to be able to swap -the primary KDC with one of the replicas. - -\sphinxAtStartPar -Next, extract \sphinxcode{\sphinxupquote{host}} random keys for all participating KDCs and -store them in each host’s default keytab file. Ideally, you should -extract each keytab locally on its own KDC. If this is not feasible, -you should use an encrypted session to send them across the network. -To extract a keytab directly on a replica KDC called -\sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1.mit.edu}}, you would execute the following command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} - \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} - \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} - \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} - \PYG{n+nb}{type} \PYG{n}{arcfour}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If you are instead extracting a keytab for the replica KDC called -\sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1.mit.edu}} on the primary KDC, you should use a dedicated -temporary keytab file for that machine’s keytab: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{keytab} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} - \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} - \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The file \sphinxcode{\sphinxupquote{/tmp/kerberos\sphinxhyphen{}1.keytab}} can then be installed as -\sphinxcode{\sphinxupquote{/etc/krb5.keytab}} on the host \sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1.mit.edu}}. - - -\paragraph{Configure replica KDCs} -\label{\detokenize{admin/install_kdc:configure-replica-kdcs}} -\sphinxAtStartPar -Database propagation copies the contents of the primary’s database, -but does not propagate configuration files, stash files, or the kadm5 -ACL file. The following files must be copied by hand to each replica -(see {\hyperref[\detokenize{mitK5defaults:mitk5defaults}]{\sphinxcrossref{\DUrole{std,std-ref}{MIT Kerberos defaults}}}} for the default locations for these files): -\begin{itemize} -\item {} -\sphinxAtStartPar -krb5.conf - -\item {} -\sphinxAtStartPar -kdc.conf - -\item {} -\sphinxAtStartPar -kadm5.acl - -\item {} -\sphinxAtStartPar -master key stash file - -\end{itemize} - -\sphinxAtStartPar -Move the copied files into their appropriate directories, exactly as -on the primary KDC. kadm5.acl is only needed to allow a replica to -swap with the primary KDC. - -\sphinxAtStartPar -The database is propagated from the primary KDC to the replica KDCs -via the {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} daemon. You must explicitly specify the -principals which are allowed to provide Kerberos dump updates on the -replica machine with a new database. Create a file named kpropd.acl -in the KDC state directory containing the \sphinxcode{\sphinxupquote{host}} principals for each -of the KDCs: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If you expect that the primary and replica KDCs will be -switched at some point of time, list the host principals -from all participating KDC servers in kpropd.acl files on -all of the KDCs. Otherwise, you only need to list the -primary KDC’s host principal in the kpropd.acl files of the -replica KDCs. -\end{sphinxadmonition} - -\sphinxAtStartPar -Then, add the following line to \sphinxcode{\sphinxupquote{/etc/inetd.conf}} on each KDC -(adjust the path to kpropd): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5\PYGZus{}prop} \PYG{n}{stream} \PYG{n}{tcp} \PYG{n}{nowait} \PYG{n}{root} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{sbin}\PYG{o}{/}\PYG{n}{kpropd} \PYG{n}{kpropd} -\end{sphinxVerbatim} - -\sphinxAtStartPar -You also need to add the following line to \sphinxcode{\sphinxupquote{/etc/services}} on each -KDC, if it is not already present (assuming that the default port is -used): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5\PYGZus{}prop} \PYG{l+m+mi}{754}\PYG{o}{/}\PYG{n}{tcp} \PYG{c+c1}{\PYGZsh{} Kerberos replica propagation} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Restart inetd daemon. - -\sphinxAtStartPar -Alternatively, start {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} as a stand\sphinxhyphen{}alone daemon. This is -required when incremental propagation is enabled. - -\sphinxAtStartPar -Now that the replica KDC is able to accept database propagation, -you’ll need to propagate the database from the primary server. - -\sphinxAtStartPar -NOTE: Do not start the replica KDC yet; you still do not have a copy -of the primary’s database. - - -\paragraph{Propagate the database to each replica KDC} -\label{\detokenize{admin/install_kdc:propagate-the-database-to-each-replica-kdc}}\label{\detokenize{admin/install_kdc:kprop-to-replicas}} -\sphinxAtStartPar -First, create a dump file of the database on the primary KDC, as -follows: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdb5\PYGZus{}util} \PYG{n}{dump} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{replica\PYGZus{}datatrans} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Then, manually propagate the database to each replica KDC, as in the -following example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kprop} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{replica\PYGZus{}datatrans} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - -\PYG{n}{Database} \PYG{n}{propagation} \PYG{n}{to} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{p}{:} \PYG{n}{SUCCEEDED} -\end{sphinxVerbatim} - -\sphinxAtStartPar -You will need a script to dump and propagate the database. The -following is an example of a Bourne shell script that will do this. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Remember that you need to replace \sphinxcode{\sphinxupquote{/usr/local/var/krb5kdc}} -with the name of the KDC state directory. -\end{sphinxadmonition} - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZsh{}!/bin/sh - -kdclist = \PYGZdq{}kerberos\PYGZhy{}1.mit.edu kerberos\PYGZhy{}2.mit.edu\PYGZdq{} - -kdb5\PYGZus{}util dump /usr/local/var/krb5kdc/replica\PYGZus{}datatrans - -for kdc in \PYGZdl{}kdclist -do - kprop \PYGZhy{}f /usr/local/var/krb5kdc/replica\PYGZus{}datatrans \PYGZdl{}kdc -done -\end{sphinxVerbatim} - -\sphinxAtStartPar -You will need to set up a cron job to run this script at the intervals -you decided on earlier (see {\hyperref[\detokenize{admin/realm_config:db-prop}]{\sphinxcrossref{\DUrole{std,std-ref}{Database propagation}}}}). - -\sphinxAtStartPar -Now that the replica KDC has a copy of the Kerberos database, you can -start the krb5kdc daemon: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{krb5kdc} -\end{sphinxVerbatim} - -\sphinxAtStartPar -As with the primary KDC, you will probably want to add this command to -the KDCs’ \sphinxcode{\sphinxupquote{/etc/rc}} or \sphinxcode{\sphinxupquote{/etc/inittab}} files, so they will start -the krb5kdc daemon automatically at boot time. - - -\subparagraph{Propagation failed?} -\label{\detokenize{admin/install_kdc:propagation-failed}} -\sphinxAtStartPar -You may encounter the following error messages. For a more detailed -discussion on possible causes and solutions click on the error link -to be redirected to {\hyperref[\detokenize{admin/troubleshoot:troubleshoot}]{\sphinxcrossref{\DUrole{std,std-ref}{Troubleshooting}}}} section. -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:kprop-no-route}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: No route to host while connecting to server}}}} - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:kprop-con-refused}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: Connection refused while connecting to server}}}} - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:kprop-sendauth-exchange}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: Server rejected authentication (during sendauth exchange) while authenticating to server}}}} - -\end{enumerate} - - -\subsubsection{Add Kerberos principals to the database} -\label{\detokenize{admin/install_kdc:add-kerberos-principals-to-the-database}} -\sphinxAtStartPar -Once your KDCs are set up and running, you are ready to use -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} to load principals for your users, hosts, and other -services into the Kerberos database. This procedure is described -fully in {\hyperref[\detokenize{admin/database:principals}]{\sphinxcrossref{\DUrole{std,std-ref}{Principals}}}}. - -\sphinxAtStartPar -You may occasionally want to use one of your replica KDCs as the -primary. This might happen if you are upgrading the primary KDC, or -if your primary KDC has a disk crash. See the following section for -the instructions. - - -\subsubsection{Switching primary and replica KDCs} -\label{\detokenize{admin/install_kdc:switching-primary-and-replica-kdcs}}\label{\detokenize{admin/install_kdc:switch-primary-replica}} -\sphinxAtStartPar -You may occasionally want to use one of your replica KDCs as the -primary. This might happen if you are upgrading the primary KDC, or -if your primary KDC has a disk crash. - -\sphinxAtStartPar -Assuming you have configured all of your KDCs to be able to function -as either the primary KDC or a replica KDC (as this document -recommends), all you need to do to make the changeover is: - -\sphinxAtStartPar -If the primary KDC is still running, do the following on the \sphinxstyleemphasis{old} -primary KDC: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -Kill the kadmind process. - -\item {} -\sphinxAtStartPar -Disable the cron job that propagates the database. - -\item {} -\sphinxAtStartPar -Run your database propagation script manually, to ensure that the -replicas all have the latest copy of the database (see -{\hyperref[\detokenize{admin/install_kdc:kprop-to-replicas}]{\sphinxcrossref{\DUrole{std,std-ref}{Propagate the database to each replica KDC}}}}). - -\end{enumerate} - -\sphinxAtStartPar -On the \sphinxstyleemphasis{new} primary KDC: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -Start the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon (see {\hyperref[\detokenize{admin/install_kdc:start-kdc-daemons}]{\sphinxcrossref{\DUrole{std,std-ref}{Start the Kerberos daemons on the primary KDC}}}}). - -\item {} -\sphinxAtStartPar -Set up the cron job to propagate the database (see -{\hyperref[\detokenize{admin/install_kdc:kprop-to-replicas}]{\sphinxcrossref{\DUrole{std,std-ref}{Propagate the database to each replica KDC}}}}). - -\item {} -\sphinxAtStartPar -Switch the CNAMEs of the old and new primary KDCs. If you can’t do -this, you’ll need to change the {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file on every -client machine in your Kerberos realm. - -\end{enumerate} - - -\subsubsection{Incremental database propagation} -\label{\detokenize{admin/install_kdc:incremental-database-propagation}} -\sphinxAtStartPar -If you expect your Kerberos database to become large, you may wish to -set up incremental propagation to replica KDCs. See -{\hyperref[\detokenize{admin/database:incr-db-prop}]{\sphinxcrossref{\DUrole{std,std-ref}{Incremental database propagation}}}} for details. - -\sphinxstepscope - - -\subsection{Installing and configuring UNIX client machines} -\label{\detokenize{admin/install_clients:installing-and-configuring-unix-client-machines}}\label{\detokenize{admin/install_clients::doc}} -\sphinxAtStartPar -The Kerberized client programs include \DUrole{xref,std,std-ref}{kinit(1)}, -\DUrole{xref,std,std-ref}{klist(1)}, \DUrole{xref,std,std-ref}{kdestroy(1)}, and \DUrole{xref,std,std-ref}{kpasswd(1)}. All of -these programs are in the directory {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{BINDIR}}}}. - -\sphinxAtStartPar -You can often integrate Kerberos with the login system on client -machines, typically through the use of PAM. The details vary by -operating system, and should be covered in your operating system’s -documentation. If you do this, you will need to make sure your users -know to use their Kerberos passwords when they log in. - -\sphinxAtStartPar -You will also need to educate your users to use the ticket management -programs kinit, klist, and kdestroy. If you do not have Kerberos -password changing integrated into the native password program (again, -typically through PAM), you will need to educate users to use kpasswd -in place of its non\sphinxhyphen{}Kerberos counterparts passwd. - - -\subsubsection{Client machine configuration files} -\label{\detokenize{admin/install_clients:client-machine-configuration-files}} -\sphinxAtStartPar -Each machine running Kerberos should have a {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file. -At a minimum, it should define a \sphinxstylestrong{default\_realm} setting in -{\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}. If you are not using DNS SRV records -({\hyperref[\detokenize{admin/realm_config:kdc-hostnames}]{\sphinxcrossref{\DUrole{std,std-ref}{Hostnames for KDCs}}}}) or URI records ({\hyperref[\detokenize{admin/realm_config:kdc-discovery}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC Discovery}}}}), it must -also contain a {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section containing information for your -realm’s KDCs. - -\sphinxAtStartPar -Consider setting \sphinxstylestrong{rdns} to false in order to reduce your dependence -on precisely correct DNS information for service hostnames. Turning -this flag off means that service hostnames will be canonicalized -through forward name resolution (which adds your domain name to -unqualified hostnames, and resolves CNAME records in DNS), but not -through reverse address lookup. The default value of this flag is -true for historical reasons only. - -\sphinxAtStartPar -If you anticipate users frequently logging into remote hosts -(e.g., using ssh) using forwardable credentials, consider setting -\sphinxstylestrong{forwardable} to true so that users obtain forwardable tickets by -default. Otherwise users will need to use \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}f}} to get -forwardable tickets. - -\sphinxAtStartPar -Consider adjusting the \sphinxstylestrong{ticket\_lifetime} setting to match the likely -length of sessions for your users. For instance, if most of your -users will be logging in for an eight\sphinxhyphen{}hour workday, you could set the -default to ten hours so that tickets obtained in the morning expire -shortly after the end of the workday. Users can still manually -request longer tickets when necessary, up to the maximum allowed by -each user’s principal record on the KDC. - -\sphinxAtStartPar -If a client host may access services in different realms, it may be -useful to define a {\hyperref[\detokenize{admin/conf_files/krb5_conf:domain-realm}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}domain\_realm{]}}}}} mapping so that clients know -which hosts belong to which realms. However, if your clients and KDC -are running release 1.7 or later, it is also reasonable to leave this -section out on client machines and just define it in the KDC’s -krb5.conf. - -\sphinxstepscope - - -\subsection{UNIX Application Servers} -\label{\detokenize{admin/install_appl_srv:unix-application-servers}}\label{\detokenize{admin/install_appl_srv::doc}} -\sphinxAtStartPar -An application server is a host that provides one or more services -over the network. Application servers can be “secure” or “insecure.” -A “secure” host is set up to require authentication from every client -connecting to it. An “insecure” host will still provide Kerberos -authentication, but will also allow unauthenticated clients to -connect. - -\sphinxAtStartPar -If you have Kerberos V5 installed on all of your client machines, MIT -recommends that you make your hosts secure, to take advantage of the -security that Kerberos authentication affords. However, if you have -some clients that do not have Kerberos V5 installed, you can run an -insecure server, and still take advantage of Kerberos V5’s single -sign\sphinxhyphen{}on capability. - - -\subsubsection{The keytab file} -\label{\detokenize{admin/install_appl_srv:the-keytab-file}}\label{\detokenize{admin/install_appl_srv:keytab-file}} -\sphinxAtStartPar -All Kerberos server machines need a keytab file to authenticate to the -KDC. By default on UNIX\sphinxhyphen{}like systems this file is named {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}. -The keytab file is an local copy of the host’s key. The keytab file -is a potential point of entry for a break\sphinxhyphen{}in, and if compromised, -would allow unrestricted access to its host. The keytab file should -be readable only by root, and should exist only on the machine’s local -disk. The file should not be part of any backup of the machine, -unless access to the backup data is secured as tightly as access to -the machine’s root password. - -\sphinxAtStartPar -In order to generate a keytab for a host, the host must have a -principal in the Kerberos database. The procedure for adding hosts to -the database is described fully in {\hyperref[\detokenize{admin/database:principals}]{\sphinxcrossref{\DUrole{std,std-ref}{Principals}}}}. (See -{\hyperref[\detokenize{admin/install_kdc:replica-host-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Create host keytabs for replica KDCs}}}} for a brief description.) The keytab is -generated by running {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} and issuing the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:ktadd}]{\sphinxcrossref{\DUrole{std,std-ref}{ktadd}}}} -command. - -\sphinxAtStartPar -For example, to generate a keytab file to allow the host -\sphinxcode{\sphinxupquote{trillium.mit.edu}} to authenticate for the services host, ftp, and -pop, the administrator \sphinxcode{\sphinxupquote{joeadmin}} would issue the command (on -\sphinxcode{\sphinxupquote{trillium.mit.edu}}): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{trillium}\PYG{o}{\PYGZpc{}} \PYG{n}{kadmin} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{n}{host}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{ftp}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{pop}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{ftp}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{pop}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{quit} -\PYG{n}{trillium}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If you generate the keytab file on another host, you need to get a -copy of the keytab file onto the destination host (\sphinxcode{\sphinxupquote{trillium}}, in -the above example) without sending it unencrypted over the network. - - -\subsubsection{Some advice about secure hosts} -\label{\detokenize{admin/install_appl_srv:some-advice-about-secure-hosts}} -\sphinxAtStartPar -Kerberos V5 can protect your host from certain types of break\sphinxhyphen{}ins, but -it is possible to install Kerberos V5 and still leave your host -vulnerable to attack. Obviously an installation guide is not the -place to try to include an exhaustive list of countermeasures for -every possible attack, but it is worth noting some of the larger holes -and how to close them. - -\sphinxAtStartPar -We recommend that backups of secure machines exclude the keytab file -({\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}). If this is not possible, the backups should at least be -done locally, rather than over a network, and the backup tapes should -be physically secured. - -\sphinxAtStartPar -The keytab file and any programs run by root, including the Kerberos -V5 binaries, should be kept on local disk. The keytab file should be -readable only by root. - - -\section{Additional references} -\label{\detokenize{admin/install:additional-references}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -Debian: \sphinxhref{http://techpubs.spinlocksolutions.com/dklar/kerberos.html}{Setting up MIT Kerberos 5} - -\item {} -\sphinxAtStartPar -Solaris: \sphinxhref{https://docs.oracle.com/cd/E19253-01/816-4557/6maosrjv2/index.html}{Configuring the Kerberos Service} - -\end{enumerate} - -\sphinxstepscope - - -\chapter{Configuration Files} -\label{\detokenize{admin/conf_files/index:configuration-files}}\label{\detokenize{admin/conf_files/index::doc}} -\sphinxAtStartPar -Kerberos uses configuration files to allow administrators to specify -settings on a per\sphinxhyphen{}machine basis. {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} applies to all -applications using the Kerboros library, on clients and servers. -For KDC\sphinxhyphen{}specific applications, additional settings can be specified in -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}; the two files are merged into a configuration profile -used by applications accessing the KDC database directly. {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} -is also only used on the KDC, it controls permissions for modifying the -KDC database. - - -\section{Contents} -\label{\detokenize{admin/conf_files/index:contents}} -\sphinxstepscope - - -\subsection{krb5.conf} -\label{\detokenize{admin/conf_files/krb5_conf:krb5-conf}}\label{\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}}\label{\detokenize{admin/conf_files/krb5_conf::doc}} -\sphinxAtStartPar -The krb5.conf file contains Kerberos configuration information, -including the locations of KDCs and admin servers for the Kerberos -realms of interest, defaults for the current realm and for Kerberos -applications, and mappings of hostnames onto Kerberos realms. -Normally, you should install your krb5.conf file in the directory -\sphinxcode{\sphinxupquote{/etc}}. You can override the default location by setting the -environment variable \sphinxstylestrong{KRB5\_CONFIG}. Multiple colon\sphinxhyphen{}separated -filenames may be specified in \sphinxstylestrong{KRB5\_CONFIG}; all files which are -present will be read. Starting in release 1.14, directory names can -also be specified in \sphinxstylestrong{KRB5\_CONFIG}; all files within the directory -whose names consist solely of alphanumeric characters, dashes, or -underscores will be read. - - -\subsubsection{Structure} -\label{\detokenize{admin/conf_files/krb5_conf:structure}} -\sphinxAtStartPar -The krb5.conf file is set up in the style of a Windows INI file. -Lines beginning with ‘\#’ or ‘;’ (possibly after initial whitespace) -are ignored as comments. Sections are headed by the section name, in -square brackets. Each section may contain zero or more relations, of -the form: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{foo} \PYG{o}{=} \PYG{n}{bar} -\end{sphinxVerbatim} - -\sphinxAtStartPar -or: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{fubar} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{foo} \PYG{o}{=} \PYG{n}{bar} - \PYG{n}{baz} \PYG{o}{=} \PYG{n}{quux} -\PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The krb5.conf file can include other files using either of the -following directives at the beginning of a line: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{include} \PYG{n}{FILENAME} -\PYG{n}{includedir} \PYG{n}{DIRNAME} -\end{sphinxVerbatim} - -\sphinxAtStartPar -\sphinxstyleemphasis{FILENAME} or \sphinxstyleemphasis{DIRNAME} should be an absolute path. The named file or -directory must exist and be readable. Including a directory includes -all files within the directory whose names consist solely of -alphanumeric characters, dashes, or underscores. Starting in release -1.15, files with names ending in “.conf” are also included, unless the -name begins with “.”. Included profile files are syntactically -independent of their parents, so each included file must begin with a -section header. Starting in release 1.17, files are read in -alphanumeric order; in previous releases, they may be read in any -order. - -\sphinxAtStartPar -Placing a ‘*’ after the closing bracket of a section name indicates -that the section is \sphinxstyleemphasis{final}, meaning that if the same section appears -again later, it will be ignored. A subsection can be marked as final -by placing a ‘*’ after either the tag name or the closing brace. A -relation can be marked as final by placing a ‘*’ after the tag name. -Prior to release 1.22, only sections and subsections can be marked as -final, and the flag only causes values to be ignored if they appear in -later files specified in \sphinxstylestrong{KRB5\_CONFIG}, not if they appear later -within the same file or an included file. - -\sphinxAtStartPar -The krb5.conf file can specify that configuration should be obtained -from a loadable module, rather than the file itself, using the -following directive at the beginning of a line before any section -headers: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{module} \PYG{n}{MODULEPATH}\PYG{p}{:}\PYG{n}{RESIDUAL} -\end{sphinxVerbatim} - -\sphinxAtStartPar -\sphinxstyleemphasis{MODULEPATH} may be relative to the library path of the krb5 -installation, or it may be an absolute path. \sphinxstyleemphasis{RESIDUAL} is provided -to the module at initialization time. If krb5.conf uses a module -directive, {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} should also use one if it exists. - - -\subsubsection{Sections} -\label{\detokenize{admin/conf_files/krb5_conf:sections}} -\sphinxAtStartPar -The krb5.conf file may contain the following sections: - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} -& -\sphinxAtStartPar -Settings used by the Kerberos V5 library -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} -& -\sphinxAtStartPar -Realm\sphinxhyphen{}specific contact information and settings -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:domain-realm}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}domain\_realm{]}}}}} -& -\sphinxAtStartPar -Maps server hostnames to Kerberos realms -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:capaths}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}capaths{]}}}}} -& -\sphinxAtStartPar -Authentication paths for non\sphinxhyphen{}hierarchical cross\sphinxhyphen{}realm -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:appdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}appdefaults{]}}}}} -& -\sphinxAtStartPar -Settings used by some Kerberos V5 applications -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:plugins}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}plugins{]}}}}} -& -\sphinxAtStartPar -Controls plugin module registration -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxAtStartPar -Additionally, krb5.conf may include any of the relations described in -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, but it is not a recommended practice. - - -\paragraph{{[}libdefaults{]}} -\label{\detokenize{admin/conf_files/krb5_conf:libdefaults}}\label{\detokenize{admin/conf_files/krb5_conf:id1}} -\sphinxAtStartPar -The libdefaults section may contain any of the following relations: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{allow\_des3}} -\sphinxAtStartPar -Permit the KDC to issue tickets with des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 session keys. -In future releases, this flag will allow des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 to be used -at all. The default value for this tag is false. (Added in -release 1.21.) - -\sphinxlineitem{\sphinxstylestrong{allow\_rc4}} -\sphinxAtStartPar -Permit the KDC to issue tickets with arcfour\sphinxhyphen{}hmac session keys. -In future releases, this flag will allow arcfour\sphinxhyphen{}hmac to be used -at all. The default value for this tag is false. (Added in -release 1.21.) - -\sphinxlineitem{\sphinxstylestrong{allow\_weak\_crypto}} -\sphinxAtStartPar -If this flag is set to false, then weak encryption types (as noted -in {\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}) will be filtered -out of the lists \sphinxstylestrong{default\_tgs\_enctypes}, -\sphinxstylestrong{default\_tkt\_enctypes}, and \sphinxstylestrong{permitted\_enctypes}. The default -value for this tag is false. - -\sphinxlineitem{\sphinxstylestrong{canonicalize}} -\sphinxAtStartPar -If this flag is set to true, initial ticket requests to the KDC -will request canonicalization of the client principal name, and -answers with different client principals than the requested -principal will be accepted. The default value is false. - -\sphinxlineitem{\sphinxstylestrong{ccache\_type}} -\sphinxAtStartPar -This parameter determines the format of credential cache types -created by \DUrole{xref,std,std-ref}{kinit(1)} or other programs. The default value -is 4, which represents the most current format. Smaller values -can be used for compatibility with very old implementations of -Kerberos which interact with credential caches on the same host. - -\sphinxlineitem{\sphinxstylestrong{clockskew}} -\sphinxAtStartPar -Sets the maximum allowable amount of clockskew in seconds that the -library will tolerate before assuming that a Kerberos message is -invalid. The default value is 300 seconds, or five minutes. - -\sphinxAtStartPar -The clockskew setting is also used when evaluating ticket start -and expiration times. For example, tickets that have reached -their expiration time can still be used (and renewed if they are -renewable tickets) if they have been expired for a shorter -duration than the \sphinxstylestrong{clockskew} setting. - -\sphinxlineitem{\sphinxstylestrong{default\_ccache\_name}} -\sphinxAtStartPar -This relation specifies the name of the default credential cache. -The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFCCNAME}}}}. This relation is subject to parameter -expansion (see below). New in release 1.11. - -\sphinxlineitem{\sphinxstylestrong{default\_client\_keytab\_name}} -\sphinxAtStartPar -This relation specifies the name of the default keytab for -obtaining client credentials. The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFCKTNAME}}}}. This -relation is subject to parameter expansion (see below). -New in release 1.11. - -\sphinxlineitem{\sphinxstylestrong{default\_keytab\_name}} -\sphinxAtStartPar -This relation specifies the default keytab name to be used by -application servers such as sshd. The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}. This -relation is subject to parameter expansion (see below). - -\sphinxlineitem{\sphinxstylestrong{default\_rcache\_name}} -\sphinxAtStartPar -This relation specifies the name of the default replay cache. -The default is \sphinxcode{\sphinxupquote{dfl:}}. This relation is subject to parameter -expansion (see below). New in release 1.18. - -\sphinxlineitem{\sphinxstylestrong{default\_realm}} -\sphinxAtStartPar -Identifies the default Kerberos realm for the client. Set its -value to your Kerberos realm. If this value is not set, then a -realm must be specified with every Kerberos principal when -invoking programs such as \DUrole{xref,std,std-ref}{kinit(1)}. - -\sphinxlineitem{\sphinxstylestrong{default\_tgs\_enctypes}} -\sphinxAtStartPar -Identifies the supported list of session key encryption types that -the client should request when making a TGS\sphinxhyphen{}REQ, in order of -preference from highest to lowest. The list may be delimited with -commas or whitespace. See {\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} in -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of the accepted values for this tag. -Starting in release 1.18, the default value is the value of -\sphinxstylestrong{permitted\_enctypes}. For previous releases or if -\sphinxstylestrong{permitted\_enctypes} is not set, the default value is -\sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac}}. - -\sphinxAtStartPar -Do not set this unless required for specific backward -compatibility purposes; stale values of this setting can prevent -clients from taking advantage of new stronger enctypes when the -libraries are upgraded. - -\sphinxlineitem{\sphinxstylestrong{default\_tkt\_enctypes}} -\sphinxAtStartPar -Identifies the supported list of session key encryption types that -the client should request when making an AS\sphinxhyphen{}REQ, in order of -preference from highest to lowest. The format is the same as for -default\_tgs\_enctypes. Starting in release 1.18, the default -value is the value of \sphinxstylestrong{permitted\_enctypes}. For previous -releases or if \sphinxstylestrong{permitted\_enctypes} is not set, the default -value is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac}}. - -\sphinxAtStartPar -Do not set this unless required for specific backward -compatibility purposes; stale values of this setting can prevent -clients from taking advantage of new stronger enctypes when the -libraries are upgraded. - -\sphinxlineitem{\sphinxstylestrong{dns\_canonicalize\_hostname}} -\sphinxAtStartPar -Indicate whether name lookups will be used to canonicalize -hostnames for use in service principal names. Setting this flag -to false can improve security by reducing reliance on DNS, but -means that short hostnames will not be canonicalized to -fully\sphinxhyphen{}qualified hostnames. If this option is set to \sphinxcode{\sphinxupquote{fallback}} (new -in release 1.18), DNS canonicalization will only be performed the -server hostname is not found with the original name when -requesting credentials. The default value is true. - -\sphinxlineitem{\sphinxstylestrong{dns\_lookup\_kdc}} -\sphinxAtStartPar -Indicate whether DNS SRV records should be used to locate the KDCs -and other servers for a realm, if they are not listed in the -krb5.conf information for the realm. (Note that the admin\_server -entry must be in the krb5.conf realm information in order to -contact kadmind, because the DNS implementation for kadmin is -incomplete.) - -\sphinxAtStartPar -Enabling this option does open up a type of denial\sphinxhyphen{}of\sphinxhyphen{}service -attack, if someone spoofs the DNS records and redirects you to -another server. However, it’s no worse than a denial of service, -because that fake KDC will be unable to decode anything you send -it (besides the initial ticket request, which has no encrypted -data), and anything the fake KDC sends will not be trusted without -verification using some secret that it won’t know. - -\sphinxlineitem{\sphinxstylestrong{dns\_lookup\_realm}} -\sphinxAtStartPar -Indicate whether DNS TXT records should be used to map hostnames -to realm names for hostnames not listed in the {[}domain\_realm{]} -section, and to determine the default realm if \sphinxstylestrong{default\_realm} -is not set. The default value is false. - -\sphinxlineitem{\sphinxstylestrong{dns\_uri\_lookup}} -\sphinxAtStartPar -Indicate whether DNS URI records should be used to locate the KDCs -and other servers for a realm, if they are not listed in the -krb5.conf information for the realm. SRV records are used as a -fallback if no URI records were found. The default value is true. -New in release 1.15. - -\sphinxlineitem{\sphinxstylestrong{enforce\_ok\_as\_delegate}} -\sphinxAtStartPar -If this flag to true, GSSAPI credential delegation will be -disabled when the \sphinxcode{\sphinxupquote{ok\sphinxhyphen{}as\sphinxhyphen{}delegate}} flag is not set in the -service ticket. If this flag is false, the \sphinxcode{\sphinxupquote{ok\sphinxhyphen{}as\sphinxhyphen{}delegate}} -ticket flag is only enforced when an application specifically -requests enforcement. The default value is false. - -\sphinxlineitem{\sphinxstylestrong{err\_fmt}} -\sphinxAtStartPar -This relation allows for custom error message formatting. If a -value is set, error messages will be formatted by substituting a -normal error message for \%M and an error code for \%C in the value. - -\sphinxlineitem{\sphinxstylestrong{extra\_addresses}} -\sphinxAtStartPar -This allows a computer to use multiple local addresses, in order -to allow Kerberos to work in a network that uses NATs while still -using address\sphinxhyphen{}restricted tickets. The addresses should be in a -comma\sphinxhyphen{}separated list. This option has no effect if -\sphinxstylestrong{noaddresses} is true. - -\sphinxlineitem{\sphinxstylestrong{forwardable}} -\sphinxAtStartPar -If this flag is true, initial tickets will be forwardable by -default, if allowed by the KDC. The default value is false. - -\sphinxlineitem{\sphinxstylestrong{ignore\_acceptor\_hostname}} -\sphinxAtStartPar -When accepting GSSAPI or krb5 security contexts for host\sphinxhyphen{}based -service principals, ignore any hostname passed by the calling -application, and allow clients to authenticate to any service -principal in the keytab matching the service name and realm name -(if given). This option can improve the administrative -flexibility of server applications on multihomed hosts, but could -compromise the security of virtual hosting environments. The -default value is false. New in release 1.10. - -\sphinxlineitem{\sphinxstylestrong{k5login\_authoritative}} -\sphinxAtStartPar -If this flag is true, principals must be listed in a local user’s -k5login file to be granted login access, if a \DUrole{xref,std,std-ref}{.k5login(5)} -file exists. If this flag is false, a principal may still be -granted login access through other mechanisms even if a k5login -file exists but does not list the principal. The default value is -true. - -\sphinxlineitem{\sphinxstylestrong{k5login\_directory}} -\sphinxAtStartPar -If set, the library will look for a local user’s k5login file -within the named directory, with a filename corresponding to the -local username. If not set, the library will look for k5login -files in the user’s home directory, with the filename .k5login. -For security reasons, .k5login files must be owned by -the local user or by root. - -\sphinxlineitem{\sphinxstylestrong{kcm\_mach\_service}} -\sphinxAtStartPar -On macOS only, determines the name of the bootstrap service used to -contact the KCM daemon for the KCM credential cache type. If the -value is \sphinxcode{\sphinxupquote{\sphinxhyphen{}}}, Mach RPC will not be used to contact the KCM -daemon. The default value is \sphinxcode{\sphinxupquote{org.h5l.kcm}}. - -\sphinxlineitem{\sphinxstylestrong{kcm\_socket}} -\sphinxAtStartPar -Determines the path to the Unix domain socket used to access the -KCM daemon for the KCM credential cache type. If the value is -\sphinxcode{\sphinxupquote{\sphinxhyphen{}}}, Unix domain sockets will not be used to contact the KCM -daemon. The default value is -\sphinxcode{\sphinxupquote{/var/run/.heim\_org.h5l.kcm\sphinxhyphen{}socket}}. - -\sphinxlineitem{\sphinxstylestrong{kdc\_default\_options}} -\sphinxAtStartPar -Default KDC options (Xored for multiple values) when requesting -initial tickets. By default it is set to 0x00000010 -(KDC\_OPT\_RENEWABLE\_OK). - -\sphinxlineitem{\sphinxstylestrong{kdc\_timesync}} -\sphinxAtStartPar -Accepted values for this relation are 1 or 0. If it is nonzero, -client machines will compute the difference between their time and -the time returned by the KDC in the timestamps in the tickets and -use this value to correct for an inaccurate system clock when -requesting service tickets or authenticating to services. This -corrective factor is only used by the Kerberos library; it is not -used to change the system clock. The default value is 1. - -\sphinxlineitem{\sphinxstylestrong{noaddresses}} -\sphinxAtStartPar -If this flag is true, requests for initial tickets will not be -made with address restrictions set, allowing the tickets to be -used across NATs. The default value is true. - -\sphinxlineitem{\sphinxstylestrong{permitted\_enctypes}} -\sphinxAtStartPar -Identifies the encryption types that servers will permit for -session keys and for ticket and authenticator encryption, ordered -by preference from highest to lowest. Starting in release 1.18, -this tag also acts as the default value for -\sphinxstylestrong{default\_tgs\_enctypes} and \sphinxstylestrong{default\_tkt\_enctypes}. The -default value for this tag is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac}}. - -\sphinxlineitem{\sphinxstylestrong{plugin\_base\_dir}} -\sphinxAtStartPar -If set, determines the base directory where krb5 plugins are -located. The default value is the \sphinxcode{\sphinxupquote{krb5/plugins}} subdirectory -of the krb5 library directory. This relation is subject to -parameter expansion (see below) in release 1.17 and later. - -\sphinxlineitem{\sphinxstylestrong{preferred\_preauth\_types}} -\sphinxAtStartPar -This allows you to set the preferred preauthentication types which -the client will attempt before others which may be advertised by a -KDC. The default value for this setting is “17, 16, 15, 14”, -which forces libkrb5 to attempt to use PKINIT if it is supported. - -\sphinxlineitem{\sphinxstylestrong{proxiable}} -\sphinxAtStartPar -If this flag is true, initial tickets will be proxiable by -default, if allowed by the KDC. The default value is false. - -\sphinxlineitem{\sphinxstylestrong{qualify\_shortname}} -\sphinxAtStartPar -If this string is set, it determines the domain suffix for -single\sphinxhyphen{}component hostnames when DNS canonicalization is not used -(either because \sphinxstylestrong{dns\_canonicalize\_hostname} is false or because -forward canonicalization failed). The default value is the first -search domain of the system’s DNS configuration. To disable -qualification of shortnames, set this relation to the empty string -with \sphinxcode{\sphinxupquote{qualify\_shortname = ""}}. (New in release 1.18.) - -\sphinxlineitem{\sphinxstylestrong{rdns}} -\sphinxAtStartPar -If this flag is true, reverse name lookup will be used in addition -to forward name lookup to canonicalizing hostnames for use in -service principal names. If \sphinxstylestrong{dns\_canonicalize\_hostname} is set -to false, this flag has no effect. The default value is true. - -\sphinxlineitem{\sphinxstylestrong{realm\_try\_domains}} -\sphinxAtStartPar -Indicate whether a host’s domain components should be used to -determine the Kerberos realm of the host. The value of this -variable is an integer: \sphinxhyphen{}1 means not to search, 0 means to try the -host’s domain itself, 1 means to also try the domain’s immediate -parent, and so forth. The library’s usual mechanism for locating -Kerberos realms is used to determine whether a domain is a valid -realm, which may involve consulting DNS if \sphinxstylestrong{dns\_lookup\_kdc} is -set. The default is not to search domain components. - -\sphinxlineitem{\sphinxstylestrong{renew\_lifetime}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Sets the default renewable lifetime -for initial ticket requests. The default value is 0. - -\sphinxlineitem{\sphinxstylestrong{request\_timeout}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Sets the maximum total time for KDC and -password change requests. This timeout does not affect the -intervals between requests, so setting a low timeout may result in -fewer requests being attempted and/or some servers not being -contacted. A value of 0 indicates no specific maximum, in which -case requests will time out if no server responds after several -tries. The default value is 0. (New in release 1.22.) - -\sphinxlineitem{\sphinxstylestrong{spake\_preauth\_groups}} -\sphinxAtStartPar -A whitespace or comma\sphinxhyphen{}separated list of words which specifies the -groups allowed for SPAKE preauthentication. The possible values -are: - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -edwards25519 -& -\sphinxAtStartPar -Edwards25519 curve (\index{RFC@\spxentry{RFC}!RFC 7748@\spxentry{RFC 7748}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc7748.html}{\sphinxstylestrong{RFC 7748}}) -\\ -\sphinxhline -\sphinxAtStartPar -P\sphinxhyphen{}256 -& -\sphinxAtStartPar -NIST P\sphinxhyphen{}256 curve (\index{RFC@\spxentry{RFC}!RFC 5480@\spxentry{RFC 5480}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc5480.html}{\sphinxstylestrong{RFC 5480}}) -\\ -\sphinxhline -\sphinxAtStartPar -P\sphinxhyphen{}384 -& -\sphinxAtStartPar -NIST P\sphinxhyphen{}384 curve (\index{RFC@\spxentry{RFC}!RFC 5480@\spxentry{RFC 5480}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc5480.html}{\sphinxstylestrong{RFC 5480}}) -\\ -\sphinxhline -\sphinxAtStartPar -P\sphinxhyphen{}521 -& -\sphinxAtStartPar -NIST P\sphinxhyphen{}521 curve (\index{RFC@\spxentry{RFC}!RFC 5480@\spxentry{RFC 5480}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc5480.html}{\sphinxstylestrong{RFC 5480}}) -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxAtStartPar -The default value for the client is \sphinxcode{\sphinxupquote{edwards25519}}. The default -value for the KDC is empty. New in release 1.17. - -\sphinxlineitem{\sphinxstylestrong{ticket\_lifetime}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Sets the default lifetime for initial -ticket requests. The default value is 1 day. - -\sphinxlineitem{\sphinxstylestrong{udp\_preference\_limit}} -\sphinxAtStartPar -When sending a message to the KDC, the library will try using TCP -before UDP if the size of the message is above -\sphinxstylestrong{udp\_preference\_limit}. If the message is smaller than -\sphinxstylestrong{udp\_preference\_limit}, then UDP will be tried before TCP. -Regardless of the size, both protocols will be tried if the first -attempt fails. - -\sphinxlineitem{\sphinxstylestrong{verify\_ap\_req\_nofail}} -\sphinxAtStartPar -If this flag is true, then an attempt to verify initial -credentials will fail if the client machine does not have a -keytab. The default value is false. - -\sphinxlineitem{\sphinxstylestrong{client\_aware\_channel\_bindings}} -\sphinxAtStartPar -If this flag is true, then all application protocol authentication -requests will be flagged to indicate that the application supports -channel bindings when operating over a secure channel. The -default value is false. - -\end{description} - - -\paragraph{{[}realms{]}} -\label{\detokenize{admin/conf_files/krb5_conf:realms}}\label{\detokenize{admin/conf_files/krb5_conf:id2}} -\sphinxAtStartPar -Each tag in the {[}realms{]} section of the file is the name of a Kerberos -realm. The value of the tag is a subsection with relations that -define the properties of that particular realm. For each realm, the -following tags may be specified in the realm’s subsection: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{admin\_server}} -\sphinxAtStartPar -Identifies the host where the administration server is running. -Typically, this is the primary Kerberos server. This tag must be -given a value in order to communicate with the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} -server for the realm. - -\sphinxlineitem{\sphinxstylestrong{auth\_to\_local}} -\sphinxAtStartPar -This tag allows you to set a general rule for mapping principal -names to local user names. It will be used if there is not an -explicit mapping for the principal name that is being -translated. The possible values are: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{RULE:}\sphinxstyleemphasis{exp}} -\sphinxAtStartPar -The local name will be formulated from \sphinxstyleemphasis{exp}. - -\sphinxAtStartPar -The format for \sphinxstyleemphasis{exp} is \sphinxstylestrong{{[}}\sphinxstyleemphasis{n}\sphinxstylestrong{:}\sphinxstyleemphasis{string}\sphinxstylestrong{{]}(}\sphinxstyleemphasis{regexp}\sphinxstylestrong{)s/}\sphinxstyleemphasis{pattern}\sphinxstylestrong{/}\sphinxstyleemphasis{replacement}\sphinxstylestrong{/g}. -The integer \sphinxstyleemphasis{n} indicates how many components the target -principal should have. If this matches, then a string will be -formed from \sphinxstyleemphasis{string}, substituting the realm of the principal -for \sphinxcode{\sphinxupquote{\$0}} and the \sphinxstyleemphasis{n}’th component of the principal for -\sphinxcode{\sphinxupquote{\$n}} (e.g., if the principal was \sphinxcode{\sphinxupquote{johndoe/admin}} then -\sphinxcode{\sphinxupquote{{[}2:\$2\$1foo{]}}} would result in the string -\sphinxcode{\sphinxupquote{adminjohndoefoo}}). If this string matches \sphinxstyleemphasis{regexp}, then -the \sphinxcode{\sphinxupquote{s//{[}g{]}}} substitution command will be run over the -string. The optional \sphinxstylestrong{g} will cause the substitution to be -global over the \sphinxstyleemphasis{string}, instead of replacing only the first -match in the \sphinxstyleemphasis{string}. - -\sphinxlineitem{\sphinxstylestrong{DEFAULT}} -\sphinxAtStartPar -The principal name will be used as the local user name. If -the principal has more than one component or is not in the -default realm, this rule is not applicable and the conversion -will fail. - -\end{description} - -\sphinxAtStartPar -For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -[realms] - ATHENA.MIT.EDU = \PYGZob{} - auth\PYGZus{}to\PYGZus{}local = RULE:[2:\PYGZdl{}1](johndoe)s/\PYGZca{}.*\PYGZdl{}/guest/ - auth\PYGZus{}to\PYGZus{}local = RULE:[2:\PYGZdl{}1;\PYGZdl{}2](\PYGZca{}.*;admin\PYGZdl{})s/;admin\PYGZdl{}// - auth\PYGZus{}to\PYGZus{}local = RULE:[2:\PYGZdl{}2](\PYGZca{}.*;root)s/\PYGZca{}.*\PYGZdl{}/root/ - auth\PYGZus{}to\PYGZus{}local = DEFAULT - \PYGZcb{} -\end{sphinxVerbatim} - -\sphinxAtStartPar -would result in any principal without \sphinxcode{\sphinxupquote{root}} or \sphinxcode{\sphinxupquote{admin}} as the -second component to be translated with the default rule. A -principal with a second component of \sphinxcode{\sphinxupquote{admin}} will become its -first component. \sphinxcode{\sphinxupquote{root}} will be used as the local name for any -principal with a second component of \sphinxcode{\sphinxupquote{root}}. The exception to -these two rules are any principals \sphinxcode{\sphinxupquote{johndoe/*}}, which will -always get the local name \sphinxcode{\sphinxupquote{guest}}. - -\sphinxlineitem{\sphinxstylestrong{auth\_to\_local\_names}} -\sphinxAtStartPar -This subsection allows you to set explicit mappings from principal -names to local user names. The tag is the mapping name, and the -value is the corresponding local user name. - -\sphinxlineitem{\sphinxstylestrong{default\_domain}} -\sphinxAtStartPar -This tag specifies the domain used to expand hostnames when -translating Kerberos 4 service principals to Kerberos 5 principals -(for example, when converting \sphinxcode{\sphinxupquote{rcmd.hostname}} to -\sphinxcode{\sphinxupquote{host/hostname.domain}}). - -\sphinxlineitem{\sphinxstylestrong{disable\_encrypted\_timestamp}} -\sphinxAtStartPar -If this flag is true, the client will not perform encrypted -timestamp preauthentication if requested by the KDC. Setting this -flag can help to prevent dictionary attacks by active attackers, -if the realm’s KDCs support SPAKE preauthentication or if initial -authentication always uses another mechanism or always uses FAST. -This flag persists across client referrals during initial -authentication. This flag does not prevent the KDC from offering -encrypted timestamp. New in release 1.17. - -\sphinxlineitem{\sphinxstylestrong{http\_anchors}} -\sphinxAtStartPar -When KDCs and kpasswd servers are accessed through HTTPS proxies, this tag -can be used to specify the location of the CA certificate which should be -trusted to issue the certificate for a proxy server. If left unspecified, -the system\sphinxhyphen{}wide default set of CA certificates is used. - -\sphinxAtStartPar -The syntax for values is similar to that of values for the -\sphinxstylestrong{pkinit\_anchors} tag: - -\sphinxAtStartPar -\sphinxstylestrong{FILE:} \sphinxstyleemphasis{filename} - -\sphinxAtStartPar -\sphinxstyleemphasis{filename} is assumed to be the name of an OpenSSL\sphinxhyphen{}style ca\sphinxhyphen{}bundle file. - -\sphinxAtStartPar -\sphinxstylestrong{DIR:} \sphinxstyleemphasis{dirname} - -\sphinxAtStartPar -\sphinxstyleemphasis{dirname} is assumed to be an directory which contains CA certificates. -All files in the directory will be examined; if they contain certificates -(in PEM format), they will be used. - -\sphinxAtStartPar -\sphinxstylestrong{ENV:} \sphinxstyleemphasis{envvar} - -\sphinxAtStartPar -\sphinxstyleemphasis{envvar} specifies the name of an environment variable which has been set -to a value conforming to one of the previous values. For example, -\sphinxcode{\sphinxupquote{ENV:X509\_PROXY\_CA}}, where environment variable \sphinxcode{\sphinxupquote{X509\_PROXY\_CA}} has -been set to \sphinxcode{\sphinxupquote{FILE:/tmp/my\_proxy.pem}}. - -\sphinxlineitem{\sphinxstylestrong{kdc}} -\sphinxAtStartPar -The name or address of a host running a KDC for the realm, or a -UNIX domain socket path of a locally running KDC. An optional -port number, separated from the hostname by a colon, may be -included. If the name or address contains colons (for example, if -it is an IPv6 address), enclose it in square brackets to -distinguish the colon from a port separator. For your computer to -be able to communicate with the KDC for each realm, this tag must -be given a value in each realm subsection in the configuration -file, or there must be DNS SRV records specifying the KDCs. - -\sphinxlineitem{\sphinxstylestrong{kpasswd\_server}} -\sphinxAtStartPar -The location of the password change server for the realm, using -the same syntax as \sphinxstylestrong{kdc}. If there is no such entry, DNS will -be queried (unless forbidden by \sphinxstylestrong{dns\_lookup\_kdc}). Finally, -port 464 on the \sphinxstylestrong{admin\_server} host will be tried. - -\sphinxlineitem{\sphinxstylestrong{master\_kdc}} -\sphinxAtStartPar -The name for \sphinxstylestrong{primary\_kdc} prior to release 1.19. Its value is -used as a fallback if \sphinxstylestrong{primary\_kdc} is not specified. - -\sphinxlineitem{\sphinxstylestrong{primary\_kdc}} -\sphinxAtStartPar -Identifies the primary KDC(s). Currently, this tag is used in only -one case: If an attempt to get credentials fails because of an -invalid password, the client software will attempt to contact the -primary KDC, in case the user’s password has just been changed, and -the updated database has not been propagated to the replica -servers yet. New in release 1.19. - -\sphinxlineitem{\sphinxstylestrong{sitename}} -\sphinxAtStartPar -Specifies the name of the host’s site for the purpose of DNS\sphinxhyphen{}based -KDC discovery for this realm. New in release 1.22. - -\sphinxlineitem{\sphinxstylestrong{v4\_instance\_convert}} -\sphinxAtStartPar -This subsection allows the administrator to configure exceptions -to the \sphinxstylestrong{default\_domain} mapping rule. It contains V4 instances -(the tag name) which should be translated to some specific -hostname (the tag value) as the second component in a Kerberos V5 -principal name. - -\sphinxlineitem{\sphinxstylestrong{v4\_realm}} -\sphinxAtStartPar -This relation is used by the krb524 library routines when -converting a V5 principal name to a V4 principal name. It is used -when the V4 realm name and the V5 realm name are not the same, but -still share the same principal names and passwords. The tag value -is the Kerberos V4 realm name. - -\end{description} - - -\paragraph{{[}domain\_realm{]}} -\label{\detokenize{admin/conf_files/krb5_conf:domain-realm}}\label{\detokenize{admin/conf_files/krb5_conf:id3}} -\sphinxAtStartPar -The {[}domain\_realm{]} section provides a translation from hostnames to -Kerberos realms. Each tag is a domain name, providing the mapping for -that domain and all subdomains. If the tag begins with a period -(\sphinxcode{\sphinxupquote{.}}) then it applies only to subdomains. The Kerberos realm may be -identified either in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{realms}}} section or using DNS SRV records. -Tag names should be in lower case. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{domain\PYGZus{}realm}\PYG{p}{]} - \PYG{n}{crash}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{=} \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - \PYG{o}{.}\PYG{n}{dev}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{=} \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - \PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - -\sphinxAtStartPar -maps the host with the name \sphinxcode{\sphinxupquote{crash.mit.edu}} into the -\sphinxcode{\sphinxupquote{TEST.ATHENA.MIT.EDU}} realm. The second entry maps all hosts under the -domain \sphinxcode{\sphinxupquote{dev.mit.edu}} into the \sphinxcode{\sphinxupquote{TEST.ATHENA.MIT.EDU}} realm, but not -the host with the name \sphinxcode{\sphinxupquote{dev.mit.edu}}. That host is matched -by the third entry, which maps the host \sphinxcode{\sphinxupquote{mit.edu}} and all hosts -under the domain \sphinxcode{\sphinxupquote{mit.edu}} that do not match a preceding rule -into the realm \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}}. - -\sphinxAtStartPar -If no translation entry applies to a hostname used for a service -principal for a service ticket request, the library will try to get a -referral to the appropriate realm from the client realm’s KDC. If -that does not succeed, the host’s realm is considered to be the -hostname’s domain portion converted to uppercase, unless the -\sphinxstylestrong{realm\_try\_domains} setting in {[}libdefaults{]} causes a different -parent domain to be used. - - -\paragraph{{[}capaths{]}} -\label{\detokenize{admin/conf_files/krb5_conf:capaths}}\label{\detokenize{admin/conf_files/krb5_conf:id4}} -\sphinxAtStartPar -In order to perform direct (non\sphinxhyphen{}hierarchical) cross\sphinxhyphen{}realm -authentication, configuration is needed to determine the -authentication paths between realms. - -\sphinxAtStartPar -A client will use this section to find the authentication path between -its realm and the realm of the server. The server will use this -section to verify the authentication path used by the client, by -checking the transited field of the received ticket. - -\sphinxAtStartPar -There is a tag for each participating client realm, and each tag has -subtags for each of the server realms. The value of the subtags is an -intermediate realm which may participate in the cross\sphinxhyphen{}realm -authentication. The subtags may be repeated if there is more then one -intermediate realm. A value of “.” means that the two realms share -keys directly, and no intermediate realms should be allowed to -participate. - -\sphinxAtStartPar -Only those entries which will be needed on the client or the server -need to be present. A client needs a tag for its local realm with -subtags for all the realms of servers it will need to authenticate to. -A server needs a tag for each realm of the clients it will serve, with -a subtag of the server realm. - -\sphinxAtStartPar -For example, \sphinxcode{\sphinxupquote{ANL.GOV}}, \sphinxcode{\sphinxupquote{PNL.GOV}}, and \sphinxcode{\sphinxupquote{NERSC.GOV}} all wish to -use the \sphinxcode{\sphinxupquote{ES.NET}} realm as an intermediate realm. ANL has a sub -realm of \sphinxcode{\sphinxupquote{TEST.ANL.GOV}} which will authenticate with \sphinxcode{\sphinxupquote{NERSC.GOV}} -but not \sphinxcode{\sphinxupquote{PNL.GOV}}. The {[}capaths{]} section for \sphinxcode{\sphinxupquote{ANL.GOV}} systems -would look like this: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{capaths}\PYG{p}{]} - \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{o}{.} - \PYG{n}{PNL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} \PYG{o}{=} \PYG{o}{.} - \PYG{p}{\PYGZcb{}} - \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{o}{.} - \PYG{p}{\PYGZcb{}} - \PYG{n}{PNL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{p}{\PYGZcb{}} - \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{p}{\PYGZcb{}} - \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{o}{.} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The {[}capaths{]} section of the configuration file used on \sphinxcode{\sphinxupquote{NERSC.GOV}} -systems would look like this: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{capaths}\PYG{p}{]} - \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} - \PYG{n}{PNL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} \PYG{o}{=} \PYG{o}{.} - \PYG{p}{\PYGZcb{}} - \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{p}{\PYGZcb{}} - \PYG{n}{PNL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{p}{\PYGZcb{}} - \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{o}{.} - \PYG{p}{\PYGZcb{}} - \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} - \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -When a subtag is used more than once within a tag, clients will use -the order of values to determine the path. The order of values is not -important to servers. - - -\paragraph{{[}appdefaults{]}} -\label{\detokenize{admin/conf_files/krb5_conf:appdefaults}}\label{\detokenize{admin/conf_files/krb5_conf:id5}} -\sphinxAtStartPar -Each tag in the {[}appdefaults{]} section names a Kerberos V5 application -or an option that is used by some Kerberos V5 application{[}s{]}. The -value of the tag defines the default behaviors for that application. - -\sphinxAtStartPar -For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{appdefaults}\PYG{p}{]} - \PYG{n}{telnet} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{option1} \PYG{o}{=} \PYG{n}{false} - \PYG{p}{\PYGZcb{}} - \PYG{p}{\PYGZcb{}} - \PYG{n}{telnet} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{option1} \PYG{o}{=} \PYG{n}{true} - \PYG{n}{option2} \PYG{o}{=} \PYG{n}{true} - \PYG{p}{\PYGZcb{}} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{option2} \PYG{o}{=} \PYG{n}{false} - \PYG{p}{\PYGZcb{}} - \PYG{n}{option2} \PYG{o}{=} \PYG{n}{true} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The above four ways of specifying the value of an option are shown in -order of decreasing precedence. In this example, if telnet is running -in the realm EXAMPLE.COM, it should, by default, have option1 and -option2 set to true. However, a telnet program in the realm -\sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} should have \sphinxcode{\sphinxupquote{option1}} set to false and -\sphinxcode{\sphinxupquote{option2}} set to true. Any other programs in ATHENA.MIT.EDU should -have \sphinxcode{\sphinxupquote{option2}} set to false by default. Any programs running in -other realms should have \sphinxcode{\sphinxupquote{option2}} set to true. - -\sphinxAtStartPar -The list of specifiable options for each application may be found in -that application’s man pages. The application defaults specified here -are overridden by those specified in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{realms}}} section. - - -\paragraph{{[}plugins{]}} -\label{\detokenize{admin/conf_files/krb5_conf:plugins}}\label{\detokenize{admin/conf_files/krb5_conf:id6}}\begin{itemize} -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:pwqual}]{\sphinxcrossref{pwqual}}} interface - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:kadm5-hook}]{\sphinxcrossref{kadm5\_hook}}} interface - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:clpreauth}]{\sphinxcrossref{clpreauth}}} and {\hyperref[\detokenize{admin/conf_files/krb5_conf:kdcpreauth}]{\sphinxcrossref{kdcpreauth}}} interfaces - -\end{itemize} - -\sphinxAtStartPar -Tags in the {[}plugins{]} section can be used to register dynamic plugin -modules and to turn modules on and off. Not every krb5 pluggable -interface uses the {[}plugins{]} section; the ones that do are documented -here. - -\sphinxAtStartPar -New in release 1.9. - -\sphinxAtStartPar -Each pluggable interface corresponds to a subsection of {[}plugins{]}. -All subsections support the same tags: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{disable}} -\sphinxAtStartPar -This tag may have multiple values. If there are values for this -tag, then the named modules will be disabled for the pluggable -interface. - -\sphinxlineitem{\sphinxstylestrong{enable\_only}} -\sphinxAtStartPar -This tag may have multiple values. If there are values for this -tag, then only the named modules will be enabled for the pluggable -interface. - -\sphinxlineitem{\sphinxstylestrong{module}} -\sphinxAtStartPar -This tag may have multiple values. Each value is a string of the -form \sphinxcode{\sphinxupquote{modulename:pathname}}, which causes the shared object -located at \sphinxstyleemphasis{pathname} to be registered as a dynamic module named -\sphinxstyleemphasis{modulename} for the pluggable interface. If \sphinxstyleemphasis{pathname} is not an -absolute path, it will be treated as relative to the -\sphinxstylestrong{plugin\_base\_dir} value from {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}. - -\end{description} - -\sphinxAtStartPar -For pluggable interfaces where module order matters, modules -registered with a \sphinxstylestrong{module} tag normally come first, in the order -they are registered, followed by built\sphinxhyphen{}in modules in the order they -are documented below. If \sphinxstylestrong{enable\_only} tags are used, then the -order of those tags overrides the normal module order. - -\sphinxAtStartPar -The following subsections are currently supported within the {[}plugins{]} -section: - - -\subparagraph{ccselect interface} -\label{\detokenize{admin/conf_files/krb5_conf:ccselect-interface}}\label{\detokenize{admin/conf_files/krb5_conf:ccselect}} -\sphinxAtStartPar -The ccselect subsection controls modules for credential cache -selection within a cache collection. In addition to any registered -dynamic modules, the following built\sphinxhyphen{}in modules exist (and may be -disabled with the disable tag): -\begin{description} -\sphinxlineitem{\sphinxstylestrong{k5identity}} -\sphinxAtStartPar -Uses a .k5identity file in the user’s home directory to select a -client principal - -\sphinxlineitem{\sphinxstylestrong{realm}} -\sphinxAtStartPar -Uses the service realm to guess an appropriate cache from the -collection - -\sphinxlineitem{\sphinxstylestrong{hostname}} -\sphinxAtStartPar -If the service principal is host\sphinxhyphen{}based, uses the service hostname -to guess an appropriate cache from the collection - -\end{description} - - -\subparagraph{pwqual interface} -\label{\detokenize{admin/conf_files/krb5_conf:pwqual-interface}}\label{\detokenize{admin/conf_files/krb5_conf:pwqual}} -\sphinxAtStartPar -The pwqual subsection controls modules for the password quality -interface, which is used to reject weak passwords when passwords are -changed. The following built\sphinxhyphen{}in modules exist for this interface: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{dict}} -\sphinxAtStartPar -Checks against the realm dictionary file - -\sphinxlineitem{\sphinxstylestrong{empty}} -\sphinxAtStartPar -Rejects empty passwords - -\sphinxlineitem{\sphinxstylestrong{hesiod}} -\sphinxAtStartPar -Checks against user information stored in Hesiod (only if Kerberos -was built with Hesiod support) - -\sphinxlineitem{\sphinxstylestrong{princ}} -\sphinxAtStartPar -Checks against components of the principal name - -\end{description} - - -\subparagraph{kadm5\_hook interface} -\label{\detokenize{admin/conf_files/krb5_conf:kadm5-hook-interface}}\label{\detokenize{admin/conf_files/krb5_conf:kadm5-hook}} -\sphinxAtStartPar -The kadm5\_hook interface provides plugins with information on -principal creation, modification, password changes and deletion. This -interface can be used to write a plugin to synchronize MIT Kerberos -with another database such as Active Directory. No plugins are built -in for this interface. - - -\subparagraph{kadm5\_auth interface} -\label{\detokenize{admin/conf_files/krb5_conf:kadm5-auth-interface}}\label{\detokenize{admin/conf_files/krb5_conf:kadm5-auth}} -\sphinxAtStartPar -The kadm5\_auth section (introduced in release 1.16) controls modules -for the kadmin authorization interface, which determines whether a -client principal is allowed to perform a kadmin operation. The -following built\sphinxhyphen{}in modules exist for this interface: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{acl}} -\sphinxAtStartPar -This module reads the {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} file, and authorizes -operations which are allowed according to the rules in the file. - -\sphinxlineitem{\sphinxstylestrong{self}} -\sphinxAtStartPar -This module authorizes self\sphinxhyphen{}service operations including password -changes, creation of new random keys, fetching the client’s -principal record or string attributes, and fetching the policy -record associated with the client principal. - -\end{description} - - -\subparagraph{clpreauth and kdcpreauth interfaces} -\label{\detokenize{admin/conf_files/krb5_conf:clpreauth-and-kdcpreauth-interfaces}}\label{\detokenize{admin/conf_files/krb5_conf:kdcpreauth}}\label{\detokenize{admin/conf_files/krb5_conf:clpreauth}} -\sphinxAtStartPar -The clpreauth and kdcpreauth interfaces allow plugin modules to -provide client and KDC preauthentication mechanisms. The following -built\sphinxhyphen{}in modules exist for these interfaces: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{pkinit}} -\sphinxAtStartPar -This module implements the PKINIT preauthentication mechanism. - -\sphinxlineitem{\sphinxstylestrong{encrypted\_challenge}} -\sphinxAtStartPar -This module implements the encrypted challenge FAST factor. - -\sphinxlineitem{\sphinxstylestrong{encrypted\_timestamp}} -\sphinxAtStartPar -This module implements the encrypted timestamp mechanism. - -\end{description} - - -\subparagraph{hostrealm interface} -\label{\detokenize{admin/conf_files/krb5_conf:hostrealm-interface}}\label{\detokenize{admin/conf_files/krb5_conf:hostrealm}} -\sphinxAtStartPar -The hostrealm section (introduced in release 1.12) controls modules -for the host\sphinxhyphen{}to\sphinxhyphen{}realm interface, which affects the local mapping of -hostnames to realm names and the choice of default realm. The following -built\sphinxhyphen{}in modules exist for this interface: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{profile}} -\sphinxAtStartPar -This module consults the {[}domain\_realm{]} section of the profile for -authoritative host\sphinxhyphen{}to\sphinxhyphen{}realm mappings, and the \sphinxstylestrong{default\_realm} -variable for the default realm. - -\sphinxlineitem{\sphinxstylestrong{dns}} -\sphinxAtStartPar -This module looks for DNS records for fallback host\sphinxhyphen{}to\sphinxhyphen{}realm -mappings and the default realm. It only operates if the -\sphinxstylestrong{dns\_lookup\_realm} variable is set to true. - -\sphinxlineitem{\sphinxstylestrong{domain}} -\sphinxAtStartPar -This module applies heuristics for fallback host\sphinxhyphen{}to\sphinxhyphen{}realm -mappings. It implements the \sphinxstylestrong{realm\_try\_domains} variable, and -uses the uppercased parent domain of the hostname if that does not -produce a result. - -\end{description} - - -\subparagraph{localauth interface} -\label{\detokenize{admin/conf_files/krb5_conf:localauth-interface}}\label{\detokenize{admin/conf_files/krb5_conf:localauth}} -\sphinxAtStartPar -The localauth section (introduced in release 1.12) controls modules -for the local authorization interface, which affects the relationship -between Kerberos principals and local system accounts. The following -built\sphinxhyphen{}in modules exist for this interface: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{default}} -\sphinxAtStartPar -This module implements the \sphinxstylestrong{DEFAULT} type for \sphinxstylestrong{auth\_to\_local} -values. - -\sphinxlineitem{\sphinxstylestrong{rule}} -\sphinxAtStartPar -This module implements the \sphinxstylestrong{RULE} type for \sphinxstylestrong{auth\_to\_local} -values. - -\sphinxlineitem{\sphinxstylestrong{names}} -\sphinxAtStartPar -This module looks for an \sphinxstylestrong{auth\_to\_local\_names} mapping for the -principal name. - -\sphinxlineitem{\sphinxstylestrong{auth\_to\_local}} -\sphinxAtStartPar -This module processes \sphinxstylestrong{auth\_to\_local} values in the default -realm’s section, and applies the default method if no -\sphinxstylestrong{auth\_to\_local} values exist. - -\sphinxlineitem{\sphinxstylestrong{k5login}} -\sphinxAtStartPar -This module authorizes a principal to a local account according to -the account’s \DUrole{xref,std,std-ref}{.k5login(5)} file. - -\sphinxlineitem{\sphinxstylestrong{an2ln}} -\sphinxAtStartPar -This module authorizes a principal to a local account if the -principal name maps to the local account name. - -\end{description} - - -\subparagraph{certauth interface} -\label{\detokenize{admin/conf_files/krb5_conf:certauth-interface}}\label{\detokenize{admin/conf_files/krb5_conf:certauth}} -\sphinxAtStartPar -The certauth section (introduced in release 1.16) controls modules for -the certificate authorization interface, which determines whether a -certificate is allowed to preauthenticate a user via PKINIT. The -following built\sphinxhyphen{}in modules exist for this interface: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{pkinit\_san}} -\sphinxAtStartPar -This module authorizes the certificate if it contains a PKINIT -Subject Alternative Name for the requested client principal, or a -Microsoft UPN SAN matching the principal if \sphinxstylestrong{pkinit\_allow\_upn} -is set to true for the realm. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_eku}} -\sphinxAtStartPar -This module rejects the certificate if it does not contain an -Extended Key Usage attribute consistent with the -\sphinxstylestrong{pkinit\_eku\_checking} value for the realm. - -\sphinxlineitem{\sphinxstylestrong{dbmatch}} -\sphinxAtStartPar -This module authorizes or rejects the certificate according to -whether it matches the \sphinxstylestrong{pkinit\_cert\_match} string attribute on -the client principal, if that attribute is present. - -\end{description} - - -\subsubsection{PKINIT options} -\label{\detokenize{admin/conf_files/krb5_conf:pkinit-options}} -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The following are PKINIT\sphinxhyphen{}specific options. These values may -be specified in {[}libdefaults{]} as global defaults, or within -a realm\sphinxhyphen{}specific subsection of {[}libdefaults{]}, or may be -specified as realm\sphinxhyphen{}specific values in the {[}realms{]} section. -A realm\sphinxhyphen{}specific value overrides, not adds to, a generic -{[}libdefaults{]} specification. The search order is: -\end{sphinxadmonition} -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -realm\sphinxhyphen{}specific subsection of {[}libdefaults{]}: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} - \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com}\PYG{o}{.}\PYG{n}{crt} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\item {} -\sphinxAtStartPar -realm\sphinxhyphen{}specific value in the {[}realms{]} section: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{OTHERREALM}\PYG{o}{.}\PYG{n}{ORG} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{otherrealm}\PYG{o}{.}\PYG{n}{org}\PYG{o}{.}\PYG{n}{crt} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\item {} -\sphinxAtStartPar -generic value in the {[}libdefaults{]} section: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} - \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{DIR}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{generic\PYGZus{}trusted\PYGZus{}cas}\PYG{o}{/} -\end{sphinxVerbatim} - -\end{enumerate} - - -\paragraph{Specifying PKINIT identity information} -\label{\detokenize{admin/conf_files/krb5_conf:specifying-pkinit-identity-information}}\label{\detokenize{admin/conf_files/krb5_conf:pkinit-identity}} -\sphinxAtStartPar -The syntax for specifying Public Key identity, trust, and revocation -information for PKINIT is as follows: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{FILE:}\sphinxstyleemphasis{filename}{[}\sphinxstylestrong{,}\sphinxstyleemphasis{keyfilename}{]}} -\sphinxAtStartPar -This option has context\sphinxhyphen{}specific behavior. - -\sphinxAtStartPar -In \sphinxstylestrong{pkinit\_identity} or \sphinxstylestrong{pkinit\_identities}, \sphinxstyleemphasis{filename} -specifies the name of a PEM\sphinxhyphen{}format file containing the user’s -certificate. If \sphinxstyleemphasis{keyfilename} is not specified, the user’s -private key is expected to be in \sphinxstyleemphasis{filename} as well. Otherwise, -\sphinxstyleemphasis{keyfilename} is the name of the file containing the private key. - -\sphinxAtStartPar -In \sphinxstylestrong{pkinit\_anchors} or \sphinxstylestrong{pkinit\_pool}, \sphinxstyleemphasis{filename} is assumed to -be the name of an OpenSSL\sphinxhyphen{}style ca\sphinxhyphen{}bundle file. - -\sphinxlineitem{\sphinxstylestrong{DIR:}\sphinxstyleemphasis{dirname}} -\sphinxAtStartPar -This option has context\sphinxhyphen{}specific behavior. - -\sphinxAtStartPar -In \sphinxstylestrong{pkinit\_identity} or \sphinxstylestrong{pkinit\_identities}, \sphinxstyleemphasis{dirname} -specifies a directory with files named \sphinxcode{\sphinxupquote{*.crt}} and \sphinxcode{\sphinxupquote{*.key}} -where the first part of the file name is the same for matching -pairs of certificate and private key files. When a file with a -name ending with \sphinxcode{\sphinxupquote{.crt}} is found, a matching file ending with -\sphinxcode{\sphinxupquote{.key}} is assumed to contain the private key. If no such file -is found, then the certificate in the \sphinxcode{\sphinxupquote{.crt}} is not used. - -\sphinxAtStartPar -In \sphinxstylestrong{pkinit\_anchors} or \sphinxstylestrong{pkinit\_pool}, \sphinxstyleemphasis{dirname} is assumed to -be an OpenSSL\sphinxhyphen{}style hashed CA directory where each CA cert is -stored in a file named \sphinxcode{\sphinxupquote{hash\sphinxhyphen{}of\sphinxhyphen{}ca\sphinxhyphen{}cert.\#}}. This infrastructure -is encouraged, but all files in the directory will be examined and -if they contain certificates (in PEM format), they will be used. - -\sphinxAtStartPar -In \sphinxstylestrong{pkinit\_revoke}, \sphinxstyleemphasis{dirname} is assumed to be an OpenSSL\sphinxhyphen{}style -hashed CA directory where each revocation list is stored in a file -named \sphinxcode{\sphinxupquote{hash\sphinxhyphen{}of\sphinxhyphen{}ca\sphinxhyphen{}cert.r\#}}. This infrastructure is encouraged, -but all files in the directory will be examined and if they -contain a revocation list (in PEM format), they will be used. - -\sphinxlineitem{\sphinxstylestrong{PKCS12:}\sphinxstyleemphasis{filename}} -\sphinxAtStartPar -\sphinxstyleemphasis{filename} is the name of a PKCS \#12 format file, containing the -user’s certificate and private key. - -\sphinxlineitem{\sphinxstylestrong{PKCS11:}{[}\sphinxstylestrong{module\_name=}{]}\sphinxstyleemphasis{modname}{[}\sphinxstylestrong{:slotid=}\sphinxstyleemphasis{slot\sphinxhyphen{}id}{]}{[}\sphinxstylestrong{:token=}\sphinxstyleemphasis{token\sphinxhyphen{}label}{]}{[}\sphinxstylestrong{:certid=}\sphinxstyleemphasis{cert\sphinxhyphen{}id}{]}{[}\sphinxstylestrong{:certlabel=}\sphinxstyleemphasis{cert\sphinxhyphen{}label}{]}} -\sphinxAtStartPar -All keyword/values are optional. \sphinxstyleemphasis{modname} specifies the location -of a library implementing PKCS \#11. If a value is encountered -with no keyword, it is assumed to be the \sphinxstyleemphasis{modname}. If no -module\sphinxhyphen{}name is specified, the default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{PKCS11\_MODNAME}}}}. -\sphinxcode{\sphinxupquote{slotid=}} and/or \sphinxcode{\sphinxupquote{token=}} may be specified to force the use of -a particular smard card reader or token if there is more than one -available. \sphinxcode{\sphinxupquote{certid=}} and/or \sphinxcode{\sphinxupquote{certlabel=}} may be specified to -force the selection of a particular certificate on the device. -Specifier values must not contain colon characters, as colons are -always treated as separators. See the \sphinxstylestrong{pkinit\_cert\_match} -configuration option for more ways to select a particular -certificate to use for PKINIT. - -\sphinxlineitem{\sphinxstylestrong{ENV:}\sphinxstyleemphasis{envvar}} -\sphinxAtStartPar -\sphinxstyleemphasis{envvar} specifies the name of an environment variable which has -been set to a value conforming to one of the previous values. For -example, \sphinxcode{\sphinxupquote{ENV:X509\_PROXY}}, where environment variable -\sphinxcode{\sphinxupquote{X509\_PROXY}} has been set to \sphinxcode{\sphinxupquote{FILE:/tmp/my\_proxy.pem}}. - -\end{description} - - -\paragraph{PKINIT krb5.conf options} -\label{\detokenize{admin/conf_files/krb5_conf:pkinit-krb5-conf-options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{pkinit\_anchors}} -\sphinxAtStartPar -Specifies the location of trusted anchor (root) certificates which -the client trusts to sign KDC certificates. This option may be -specified multiple times. These values from the config file are -not used if the user specifies X509\_anchors on the command line. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_cert\_match}} -\sphinxAtStartPar -Specifies matching rules that the client certificate must match -before it is used to attempt PKINIT authentication. If a user has -multiple certificates available (on a smart card, or via other -media), there must be exactly one certificate chosen before -attempting PKINIT authentication. This option may be specified -multiple times. All the available certificates are checked -against each rule in order until there is a match of exactly one -certificate. - -\sphinxAtStartPar -The Subject and Issuer comparison strings are the \index{RFC@\spxentry{RFC}!RFC 2253@\spxentry{RFC 2253}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc2253.html}{\sphinxstylestrong{RFC 2253}} -string representations from the certificate Subject DN and Issuer -DN values. - -\sphinxAtStartPar -The syntax of the matching rules is: -\begin{quote} - -\sphinxAtStartPar -{[}\sphinxstyleemphasis{relation\sphinxhyphen{}operator}{]}\sphinxstyleemphasis{component\sphinxhyphen{}rule} … -\end{quote} - -\sphinxAtStartPar -where: -\begin{description} -\sphinxlineitem{\sphinxstyleemphasis{relation\sphinxhyphen{}operator}} -\sphinxAtStartPar -can be either \sphinxcode{\sphinxupquote{\&\&}}, meaning all component rules must match, -or \sphinxcode{\sphinxupquote{||}}, meaning only one component rule must match. The -default is \sphinxcode{\sphinxupquote{\&\&}}. - -\sphinxlineitem{\sphinxstyleemphasis{component\sphinxhyphen{}rule}} -\sphinxAtStartPar -can be one of the following. Note that there is no -punctuation or whitespace between component rules. -\begin{quote} - -\begin{DUlineblock}{0em} -\item[] \sphinxstylestrong{\textless{}SUBJECT\textgreater{}}\sphinxstyleemphasis{regular\sphinxhyphen{}expression} -\item[] \sphinxstylestrong{\textless{}ISSUER\textgreater{}}\sphinxstyleemphasis{regular\sphinxhyphen{}expression} -\item[] \sphinxstylestrong{\textless{}SAN\textgreater{}}\sphinxstyleemphasis{regular\sphinxhyphen{}expression} -\item[] \sphinxstylestrong{\textless{}EKU\textgreater{}}\sphinxstyleemphasis{extended\sphinxhyphen{}key\sphinxhyphen{}usage\sphinxhyphen{}list} -\item[] \sphinxstylestrong{\textless{}KU\textgreater{}}\sphinxstyleemphasis{key\sphinxhyphen{}usage\sphinxhyphen{}list} -\end{DUlineblock} -\end{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{extended\sphinxhyphen{}key\sphinxhyphen{}usage\sphinxhyphen{}list} is a comma\sphinxhyphen{}separated list of -required Extended Key Usage values. All values in the list -must be present in the certificate. Extended Key Usage values -can be: -\begin{itemize} -\item {} -\sphinxAtStartPar -pkinit - -\item {} -\sphinxAtStartPar -msScLogin - -\item {} -\sphinxAtStartPar -clientAuth - -\item {} -\sphinxAtStartPar -emailProtection - -\end{itemize} - -\sphinxAtStartPar -\sphinxstyleemphasis{key\sphinxhyphen{}usage\sphinxhyphen{}list} is a comma\sphinxhyphen{}separated list of required Key -Usage values. All values in the list must be present in the -certificate. Key Usage values can be: -\begin{itemize} -\item {} -\sphinxAtStartPar -digitalSignature - -\item {} -\sphinxAtStartPar -keyEncipherment - -\end{itemize} - -\end{description} - -\sphinxAtStartPar -Examples: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{pkinit\PYGZus{}cert\PYGZus{}match} \PYG{o}{=} \PYG{o}{|}\PYG{o}{|}\PYG{o}{\PYGZlt{}}\PYG{n}{SUBJECT}\PYG{o}{\PYGZgt{}}\PYG{o}{.}\PYG{o}{*}\PYG{n}{DoE}\PYG{o}{.}\PYG{o}{*}\PYG{o}{\PYGZlt{}}\PYG{n}{SAN}\PYG{o}{\PYGZgt{}}\PYG{o}{.}\PYG{o}{*}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{pkinit\PYGZus{}cert\PYGZus{}match} \PYG{o}{=} \PYG{o}{\PYGZam{}}\PYG{o}{\PYGZam{}}\PYG{o}{\PYGZlt{}}\PYG{n}{EKU}\PYG{o}{\PYGZgt{}}\PYG{n}{msScLogin}\PYG{p}{,}\PYG{n}{clientAuth}\PYG{o}{\PYGZlt{}}\PYG{n}{ISSUER}\PYG{o}{\PYGZgt{}}\PYG{o}{.}\PYG{o}{*}\PYG{n}{DoE}\PYG{o}{.}\PYG{o}{*} -\PYG{n}{pkinit\PYGZus{}cert\PYGZus{}match} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{EKU}\PYG{o}{\PYGZgt{}}\PYG{n}{msScLogin}\PYG{p}{,}\PYG{n}{clientAuth}\PYG{o}{\PYGZlt{}}\PYG{n}{KU}\PYG{o}{\PYGZgt{}}\PYG{n}{digitalSignature} -\end{sphinxVerbatim} - -\sphinxlineitem{\sphinxstylestrong{pkinit\_eku\_checking}} -\sphinxAtStartPar -This option specifies what Extended Key Usage value the KDC -certificate presented to the client must contain. (Note that if -the KDC certificate has the pkinit SubjectAlternativeName encoded -as the Kerberos TGS name, EKU checking is not necessary since the -issuing CA has certified this as a KDC certificate.) The values -recognized in the krb5.conf file are: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{kpKDC}} -\sphinxAtStartPar -This is the default value and specifies that the KDC must have -the id\sphinxhyphen{}pkinit\sphinxhyphen{}KPKdc EKU as defined in \index{RFC@\spxentry{RFC}!RFC 4556@\spxentry{RFC 4556}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc4556.html}{\sphinxstylestrong{RFC 4556}}. - -\sphinxlineitem{\sphinxstylestrong{kpServerAuth}} -\sphinxAtStartPar -If \sphinxstylestrong{kpServerAuth} is specified, a KDC certificate with the -id\sphinxhyphen{}kp\sphinxhyphen{}serverAuth EKU will be accepted. This key usage value -is used in most commercially issued server certificates. - -\sphinxlineitem{\sphinxstylestrong{none}} -\sphinxAtStartPar -If \sphinxstylestrong{none} is specified, then the KDC certificate will not be -checked to verify it has an acceptable EKU. The use of this -option is not recommended. - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{pkinit\_dh\_min\_bits}} -\sphinxAtStartPar -Specifies the group of the Diffie\sphinxhyphen{}Hellman key the client will -attempt to use. The acceptable values are 1024, 2048, P\sphinxhyphen{}256, -4096, P\sphinxhyphen{}384, and P\sphinxhyphen{}521. The default is 2048. (P\sphinxhyphen{}256, P\sphinxhyphen{}384, and -P\sphinxhyphen{}521 are new in release 1.22.) - -\sphinxlineitem{\sphinxstylestrong{pkinit\_identities}} -\sphinxAtStartPar -Specifies the location(s) to be used to find the user’s X.509 -identity information. If this option is specified multiple times, -each value is attempted in order until certificates are found. -Note that these values are not used if the user specifies -\sphinxstylestrong{X509\_user\_identity} on the command line. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_kdc\_hostname}} -\sphinxAtStartPar -The presence of this option indicates that the client is willing -to accept a KDC certificate with a dNSName SAN (Subject -Alternative Name) rather than requiring the id\sphinxhyphen{}pkinit\sphinxhyphen{}san as -defined in \index{RFC@\spxentry{RFC}!RFC 4556@\spxentry{RFC 4556}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc4556.html}{\sphinxstylestrong{RFC 4556}}. This option may be specified multiple -times. Its value should contain the acceptable hostname for the -KDC (as contained in its certificate). - -\sphinxlineitem{\sphinxstylestrong{pkinit\_pool}} -\sphinxAtStartPar -Specifies the location of intermediate certificates which may be -used by the client to complete the trust chain between a KDC -certificate and a trusted anchor. This option may be specified -multiple times. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_require\_crl\_checking}} -\sphinxAtStartPar -The default certificate verification process will always check the -available revocation information to see if a certificate has been -revoked. If a match is found for the certificate in a CRL, -verification fails. If the certificate being verified is not -listed in a CRL, or there is no CRL present for its issuing CA, -and \sphinxstylestrong{pkinit\_require\_crl\_checking} is false, then verification -succeeds. - -\sphinxAtStartPar -However, if \sphinxstylestrong{pkinit\_require\_crl\_checking} is true and there is -no CRL information available for the issuing CA, then verification -fails. - -\sphinxAtStartPar -\sphinxstylestrong{pkinit\_require\_crl\_checking} should be set to true if the -policy is such that up\sphinxhyphen{}to\sphinxhyphen{}date CRLs must be present for every CA. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_revoke}} -\sphinxAtStartPar -Specifies the location of Certificate Revocation List (CRL) -information to be used by the client when verifying the validity -of the KDC certificate presented. This option may be specified -multiple times. - -\end{description} - - -\subsubsection{Parameter expansion} -\label{\detokenize{admin/conf_files/krb5_conf:parameter-expansion}}\label{\detokenize{admin/conf_files/krb5_conf:id7}} -\sphinxAtStartPar -Starting with release 1.11, several variables, such as -\sphinxstylestrong{default\_keytab\_name}, allow parameters to be expanded. -Valid parameters are: -\begin{quote} - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\%\{TEMP\} -& -\sphinxAtStartPar -Temporary directory -\\ -\sphinxhline -\sphinxAtStartPar -\%\{uid\} -& -\sphinxAtStartPar -Unix real UID or Windows SID -\\ -\sphinxhline -\sphinxAtStartPar -\%\{euid\} -& -\sphinxAtStartPar -Unix effective user ID or Windows SID -\\ -\sphinxhline -\sphinxAtStartPar -\%\{USERID\} -& -\sphinxAtStartPar -Same as \%\{uid\} -\\ -\sphinxhline -\sphinxAtStartPar -\%\{null\} -& -\sphinxAtStartPar -Empty string -\\ -\sphinxhline -\sphinxAtStartPar -\%\{LIBDIR\} -& -\sphinxAtStartPar -Installation library directory -\\ -\sphinxhline -\sphinxAtStartPar -\%\{BINDIR\} -& -\sphinxAtStartPar -Installation binary directory -\\ -\sphinxhline -\sphinxAtStartPar -\%\{SBINDIR\} -& -\sphinxAtStartPar -Installation admin binary directory -\\ -\sphinxhline -\sphinxAtStartPar -\%\{username\} -& -\sphinxAtStartPar -(Unix) Username of effective user ID -\\ -\sphinxhline -\sphinxAtStartPar -\%\{APPDATA\} -& -\sphinxAtStartPar -(Windows) Roaming application data for current user -\\ -\sphinxhline -\sphinxAtStartPar -\%\{COMMON\_APPDATA\} -& -\sphinxAtStartPar -(Windows) Application data for all users -\\ -\sphinxhline -\sphinxAtStartPar -\%\{LOCAL\_APPDATA\} -& -\sphinxAtStartPar -(Windows) Local application data for current user -\\ -\sphinxhline -\sphinxAtStartPar -\%\{SYSTEM\} -& -\sphinxAtStartPar -(Windows) Windows system folder -\\ -\sphinxhline -\sphinxAtStartPar -\%\{WINDOWS\} -& -\sphinxAtStartPar -(Windows) Windows folder -\\ -\sphinxhline -\sphinxAtStartPar -\%\{USERCONFIG\} -& -\sphinxAtStartPar -(Windows) Per\sphinxhyphen{}user MIT krb5 config file directory -\\ -\sphinxhline -\sphinxAtStartPar -\%\{COMMONCONFIG\} -& -\sphinxAtStartPar -(Windows) Common MIT krb5 config file directory -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} -\end{quote} - - -\subsubsection{Sample krb5.conf file} -\label{\detokenize{admin/conf_files/krb5_conf:sample-krb5-conf-file}} -\sphinxAtStartPar -Here is an example of a generic krb5.conf file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} - \PYG{n}{default\PYGZus{}realm} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - \PYG{n}{dns\PYGZus{}lookup\PYGZus{}kdc} \PYG{o}{=} \PYG{n}{true} - \PYG{n}{dns\PYGZus{}lookup\PYGZus{}realm} \PYG{o}{=} \PYG{n}{false} - -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{2.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{n}{primary\PYGZus{}kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{p}{\PYGZcb{}} - \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} - \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} - \PYG{p}{\PYGZcb{}} - -\PYG{p}{[}\PYG{n}{domain\PYGZus{}realm}\PYG{p}{]} - \PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - -\PYG{p}{[}\PYG{n}{capaths}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{o}{.} - \PYG{p}{\PYGZcb{}} - \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{o}{.} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - - -\subsubsection{FILES} -\label{\detokenize{admin/conf_files/krb5_conf:files}} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/etc/krb5.conf}} - - -\subsubsection{SEE ALSO} -\label{\detokenize{admin/conf_files/krb5_conf:see-also}} -\sphinxAtStartPar -syslog(3) - -\sphinxstepscope - - -\subsection{kdc.conf} -\label{\detokenize{admin/conf_files/kdc_conf:kdc-conf}}\label{\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}}\label{\detokenize{admin/conf_files/kdc_conf::doc}} -\sphinxAtStartPar -The kdc.conf file supplements {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} for programs which -are typically only used on a KDC, such as the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} and -{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemons and the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} program. -Relations documented here may also be specified in krb5.conf; for the -KDC programs mentioned, krb5.conf and kdc.conf will be merged into a -single configuration profile. - -\sphinxAtStartPar -Normally, the kdc.conf file is found in the KDC state directory, -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}. You can override the default location by setting the -environment variable \sphinxstylestrong{KRB5\_KDC\_PROFILE}. - -\sphinxAtStartPar -Please note that you need to restart the KDC daemon for any configuration -changes to take effect. - - -\subsubsection{Structure} -\label{\detokenize{admin/conf_files/kdc_conf:structure}} -\sphinxAtStartPar -The kdc.conf file is set up in the same format as the -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file. - - -\subsubsection{Sections} -\label{\detokenize{admin/conf_files/kdc_conf:sections}} -\sphinxAtStartPar -The kdc.conf file may contain the following sections: - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdcdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}kdcdefaults{]}}}}} -& -\sphinxAtStartPar -Default values for KDC behavior -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} -& -\sphinxAtStartPar -Realm\sphinxhyphen{}specific database configuration and settings -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/kdc_conf:dbdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbdefaults{]}}}}} -& -\sphinxAtStartPar -Default database settings -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} -& -\sphinxAtStartPar -Per\sphinxhyphen{}database settings -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/kdc_conf:logging}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}logging{]}}}}} -& -\sphinxAtStartPar -Controls how Kerberos daemons perform logging -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - - -\paragraph{{[}kdcdefaults{]}} -\label{\detokenize{admin/conf_files/kdc_conf:kdcdefaults}}\label{\detokenize{admin/conf_files/kdc_conf:id1}} -\sphinxAtStartPar -Some relations in the {[}kdcdefaults{]} section specify default values for -realm variables, to be used if the {[}realms{]} subsection does not -contain a relation for the tag. See the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section for -the definitions of these relations. -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxstylestrong{host\_based\_services} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{kdc\_listen} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{kdc\_ports} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{kdc\_tcp\_listen} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{kdc\_tcp\_ports} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{no\_host\_referral} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{restrict\_anonymous\_to\_tgt} - -\end{itemize} - -\sphinxAtStartPar -The following {[}kdcdefaults{]} variables have no per\sphinxhyphen{}realm equivalent: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{kdc\_max\_dgram\_reply\_size}} -\sphinxAtStartPar -Specifies the maximum packet size that can be sent over UDP. The -default value is 4096 bytes. - -\sphinxlineitem{\sphinxstylestrong{kdc\_tcp\_listen\_backlog}} -\sphinxAtStartPar -(Integer.) Set the size of the listen queue length for the KDC -daemon. The value may be limited by OS settings. The default -value is 5. - -\sphinxlineitem{\sphinxstylestrong{spake\_preauth\_kdc\_challenge}} -\sphinxAtStartPar -(String.) Specifies the group for a SPAKE optimistic challenge. -See the \sphinxstylestrong{spake\_preauth\_groups} variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} -for possible values. The default is not to issue an optimistic -challenge. (New in release 1.17.) - -\end{description} - - -\paragraph{{[}realms{]}} -\label{\detokenize{admin/conf_files/kdc_conf:realms}}\label{\detokenize{admin/conf_files/kdc_conf:kdc-realms}} -\sphinxAtStartPar -Each tag in the {[}realms{]} section is the name of a Kerberos realm. The -value of the tag is a subsection where the relations define KDC -parameters for that particular realm. The following example shows how -to define one parameter for the ATHENA.MIT.EDU realm: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{max\PYGZus{}renewable\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{7}\PYG{n}{d} \PYG{l+m+mi}{0}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The following tags may be specified in a {[}realms{]} subsection: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{acl\_file}} -\sphinxAtStartPar -(String.) Location of the access control list file that -{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} uses to determine which principals are allowed -which permissions on the Kerberos database. To operate without an -ACL file, set this relation to the empty string with \sphinxcode{\sphinxupquote{acl\_file = -""}}. The default value is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}}. For more -information on Kerberos ACL file see {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}. - -\sphinxlineitem{\sphinxstylestrong{database\_module}} -\sphinxAtStartPar -(String.) This relation indicates the name of the configuration -section under {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} for database\sphinxhyphen{}specific parameters -used by the loadable database library. The default value is the -realm name. If this configuration section does not exist, default -values will be used for all database parameters. - -\sphinxlineitem{\sphinxstylestrong{database\_name}} -\sphinxAtStartPar -(String, deprecated.) This relation specifies the location of the -Kerberos database for this realm, if the DB2 module is being used -and the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} configuration section does not specify a -database name. The default value is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/principal}}. - -\sphinxlineitem{\sphinxstylestrong{default\_principal\_expiration}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{abstime} string.) Specifies the default expiration date of -principals created in this realm. The default value is 0, which -means no expiration date. - -\sphinxlineitem{\sphinxstylestrong{default\_principal\_flags}} -\sphinxAtStartPar -(Flag string.) Specifies the default attributes of principals -created in this realm. The format for this string is a -comma\sphinxhyphen{}separated list of flags, with ‘+’ before each flag that -should be enabled and ‘\sphinxhyphen{}’ before each flag that should be -disabled. The \sphinxstylestrong{postdateable}, \sphinxstylestrong{forwardable}, \sphinxstylestrong{tgt\sphinxhyphen{}based}, -\sphinxstylestrong{renewable}, \sphinxstylestrong{proxiable}, \sphinxstylestrong{dup\sphinxhyphen{}skey}, \sphinxstylestrong{allow\sphinxhyphen{}tickets}, and -\sphinxstylestrong{service} flags default to enabled. - -\sphinxAtStartPar -There are a number of possible flags: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{allow\sphinxhyphen{}tickets}} -\sphinxAtStartPar -Enabling this flag means that the KDC will issue tickets for -this principal. Disabling this flag essentially deactivates -the principal within this realm. - -\sphinxlineitem{\sphinxstylestrong{dup\sphinxhyphen{}skey}} -\sphinxAtStartPar -Enabling this flag allows the KDC to issue user\sphinxhyphen{}to\sphinxhyphen{}user -service tickets for this principal. - -\sphinxlineitem{\sphinxstylestrong{forwardable}} -\sphinxAtStartPar -Enabling this flag allows the principal to obtain forwardable -tickets. - -\sphinxlineitem{\sphinxstylestrong{hwauth}} -\sphinxAtStartPar -If this flag is enabled, then the principal is required to -preauthenticate using a hardware device before receiving any -tickets. - -\sphinxlineitem{\sphinxstylestrong{no\sphinxhyphen{}auth\sphinxhyphen{}data\sphinxhyphen{}required}} -\sphinxAtStartPar -Enabling this flag prevents PAC or AD\sphinxhyphen{}SIGNEDPATH data from -being added to service tickets for the principal. - -\sphinxlineitem{\sphinxstylestrong{ok\sphinxhyphen{}as\sphinxhyphen{}delegate}} -\sphinxAtStartPar -If this flag is enabled, it hints the client that credentials -can and should be delegated when authenticating to the -service. - -\sphinxlineitem{\sphinxstylestrong{ok\sphinxhyphen{}to\sphinxhyphen{}auth\sphinxhyphen{}as\sphinxhyphen{}delegate}} -\sphinxAtStartPar -Enabling this flag allows the principal to use S4USelf tickets. - -\sphinxlineitem{\sphinxstylestrong{postdateable}} -\sphinxAtStartPar -Enabling this flag allows the principal to obtain postdateable -tickets. - -\sphinxlineitem{\sphinxstylestrong{preauth}} -\sphinxAtStartPar -If this flag is enabled on a client principal, then that -principal is required to preauthenticate to the KDC before -receiving any tickets. On a service principal, enabling this -flag means that service tickets for this principal will only -be issued to clients with a TGT that has the preauthenticated -bit set. - -\sphinxlineitem{\sphinxstylestrong{proxiable}} -\sphinxAtStartPar -Enabling this flag allows the principal to obtain proxy -tickets. - -\sphinxlineitem{\sphinxstylestrong{pwchange}} -\sphinxAtStartPar -Enabling this flag forces a password change for this -principal. - -\sphinxlineitem{\sphinxstylestrong{pwservice}} -\sphinxAtStartPar -If this flag is enabled, it marks this principal as a password -change service. This should only be used in special cases, -for example, if a user’s password has expired, then the user -has to get tickets for that principal without going through -the normal password authentication in order to be able to -change the password. - -\sphinxlineitem{\sphinxstylestrong{renewable}} -\sphinxAtStartPar -Enabling this flag allows the principal to obtain renewable -tickets. - -\sphinxlineitem{\sphinxstylestrong{service}} -\sphinxAtStartPar -Enabling this flag allows the the KDC to issue service tickets -for this principal. In release 1.17 and later, user\sphinxhyphen{}to\sphinxhyphen{}user -service tickets are still allowed if the \sphinxstylestrong{dup\sphinxhyphen{}skey} flag is -set. - -\sphinxlineitem{\sphinxstylestrong{tgt\sphinxhyphen{}based}} -\sphinxAtStartPar -Enabling this flag allows a principal to obtain tickets based -on a ticket\sphinxhyphen{}granting\sphinxhyphen{}ticket, rather than repeating the -authentication process that was used to obtain the TGT. - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{dict\_file}} -\sphinxAtStartPar -(String.) Location of the dictionary file containing strings that -are not allowed as passwords. The file should contain one string -per line, with no additional whitespace. If none is specified or -if there is no policy assigned to the principal, no dictionary -checks of passwords will be performed. - -\sphinxlineitem{\sphinxstylestrong{disable\_pac}} -\sphinxAtStartPar -(Boolean value.) If true, the KDC will not issue PACs for this -realm, and S4U2Self and S4U2Proxy operations will be disabled. -The default is false, which will permit the KDC to issue PACs. -New in release 1.20. - -\sphinxlineitem{\sphinxstylestrong{encrypted\_challenge\_indicator}} -\sphinxAtStartPar -(String.) Specifies the authentication indicator value that the KDC -asserts into tickets obtained using FAST encrypted challenge -pre\sphinxhyphen{}authentication. New in 1.16. - -\sphinxlineitem{\sphinxstylestrong{host\_based\_services}} -\sphinxAtStartPar -(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Lists services which will -get host\sphinxhyphen{}based referral processing even if the server principal is -not marked as host\sphinxhyphen{}based by the client. - -\sphinxlineitem{\sphinxstylestrong{iprop\_enable}} -\sphinxAtStartPar -(Boolean value.) Specifies whether incremental database -propagation is enabled. The default value is false. - -\sphinxlineitem{\sphinxstylestrong{iprop\_ulogsize}} -\sphinxAtStartPar -(Integer.) Specifies the maximum number of log entries to be -retained for incremental propagation. The default value is 1000. -Prior to release 1.11, the maximum value was 2500. New in release -1.19. - -\sphinxlineitem{\sphinxstylestrong{iprop\_master\_ulogsize}} -\sphinxAtStartPar -The name for \sphinxstylestrong{iprop\_ulogsize} prior to release 1.19. Its value is -used as a fallback if \sphinxstylestrong{iprop\_ulogsize} is not specified. - -\sphinxlineitem{\sphinxstylestrong{iprop\_replica\_poll}} -\sphinxAtStartPar -(Delta time string.) Specifies how often the replica KDC polls -for new updates from the primary. The default value is \sphinxcode{\sphinxupquote{2m}} -(that is, two minutes). New in release 1.17. - -\sphinxlineitem{\sphinxstylestrong{iprop\_slave\_poll}} -\sphinxAtStartPar -(Delta time string.) The name for \sphinxstylestrong{iprop\_replica\_poll} prior to -release 1.17. Its value is used as a fallback if -\sphinxstylestrong{iprop\_replica\_poll} is not specified. - -\sphinxlineitem{\sphinxstylestrong{iprop\_listen}} -\sphinxAtStartPar -(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Specifies the iprop RPC -listening addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon. -Each entry may be an interface address, a port number, or an -address and port number separated by a colon. If the address -contains colons, enclose it in square brackets. If no address is -specified, the wildcard address is used. If kadmind fails to bind -to any of the specified addresses, it will fail to start. The -default (when \sphinxstylestrong{iprop\_enable} is true) is to bind to the wildcard -address at the port specified in \sphinxstylestrong{iprop\_port}. New in release -1.15. - -\sphinxlineitem{\sphinxstylestrong{iprop\_port}} -\sphinxAtStartPar -(Port number.) Specifies the port number to be used for -incremental propagation. When \sphinxstylestrong{iprop\_enable} is true, this -relation is required in the replica KDC configuration file, and -this relation or \sphinxstylestrong{iprop\_listen} is required in the primary -configuration file, as there is no default port number. Port -numbers specified in \sphinxstylestrong{iprop\_listen} entries will override this -port number for the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon. - -\sphinxlineitem{\sphinxstylestrong{iprop\_resync\_timeout}} -\sphinxAtStartPar -(Delta time string.) Specifies the amount of time to wait for a -full propagation to complete. This is optional in configuration -files, and is used by replica KDCs only. The default value is 5 -minutes (\sphinxcode{\sphinxupquote{5m}}). New in release 1.11. - -\sphinxlineitem{\sphinxstylestrong{iprop\_logfile}} -\sphinxAtStartPar -(File name.) Specifies where the update log file for the realm -database is to be stored. The default is to use the -\sphinxstylestrong{database\_name} entry from the realms section of the krb5 config -file, with \sphinxcode{\sphinxupquote{.ulog}} appended. (NOTE: If \sphinxstylestrong{database\_name} isn’t -specified in the realms section, perhaps because the LDAP database -back end is being used, or the file name is specified in the -{[}dbmodules{]} section, then the hard\sphinxhyphen{}coded default for -\sphinxstylestrong{database\_name} is used. Determination of the \sphinxstylestrong{iprop\_logfile} -default value will not use values from the {[}dbmodules{]} section.) - -\sphinxlineitem{\sphinxstylestrong{kadmind\_listen}} -\sphinxAtStartPar -(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Specifies the kadmin RPC -listening addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon. -Each entry may be an interface address, a port number, an address -and port number separated by a colon, or a UNIX domain socket -pathname. If the address contains colons, enclose it in square -brackets. If no address is specified, the wildcard address is -used. To disable listening for kadmin RPC connections, set this -relation to the empty string with \sphinxcode{\sphinxupquote{kadmind\_listen = ""}}. If -kadmind fails to bind to any of the specified addresses, it will -fail to start. The default is to bind to the wildcard address at -the port specified in \sphinxstylestrong{kadmind\_port}, or the standard kadmin -port (749). New in release 1.15. - -\sphinxlineitem{\sphinxstylestrong{kadmind\_port}} -\sphinxAtStartPar -(Port number.) Specifies the port on which the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} -daemon is to listen for this realm. Port numbers specified in -\sphinxstylestrong{kadmind\_listen} entries will override this port number. The -assigned port for kadmind is 749, which is used by default. - -\sphinxlineitem{\sphinxstylestrong{key\_stash\_file}} -\sphinxAtStartPar -(String.) Specifies the location where the master key has been -stored (via kdb5\_util stash). The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/.k5.REALM}}, where \sphinxstyleemphasis{REALM} is the Kerberos realm. - -\sphinxlineitem{\sphinxstylestrong{kdc\_listen}} -\sphinxAtStartPar -(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Specifies the listening -addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon. Each -entry may be an interface address, a port number, an address and -port number separated by a colon, or a UNIX domain socket -pathname. If the address contains colons, enclose it in square -brackets. If no address is specified, the wildcard address is -used. If no port is specified, the standard port (88) is used. -To disable listening on UDP, set this relation to the empty string -with \sphinxcode{\sphinxupquote{kdc\_listen = ""}}. If the KDC daemon fails to bind to any -of the specified addresses, it will fail to start. The default is -to bind to the wildcard address on the standard port. New in -release 1.15. - -\sphinxlineitem{\sphinxstylestrong{kdc\_ports}} -\sphinxAtStartPar -(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list, deprecated.) Prior to -release 1.15, this relation lists the ports for the -{\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon to listen on for UDP requests. In -release 1.15 and later, it has the same meaning as \sphinxstylestrong{kdc\_listen} -if that relation is not defined. - -\sphinxlineitem{\sphinxstylestrong{kdc\_tcp\_listen}} -\sphinxAtStartPar -(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Specifies the TCP -listening addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon. -The syntax is identical to that of \sphinxstylestrong{kdc\_listen}. To disable -listening on TCP, set this relation to the empty string with -\sphinxcode{\sphinxupquote{kdc\_tcp\_listen = ""}}. The default is to bind to the same -addresses and ports as for UDP. New in release 1.15. - -\sphinxlineitem{\sphinxstylestrong{kdc\_tcp\_ports}} -\sphinxAtStartPar -(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list, deprecated.) Prior to -release 1.15, this relation lists the ports for the -{\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon to listen on for UDP requests. In -release 1.15 and later, it has the same meaning as -\sphinxstylestrong{kdc\_tcp\_listen} if that relation is not defined. - -\sphinxlineitem{\sphinxstylestrong{kpasswd\_listen}} -\sphinxAtStartPar -(Comma\sphinxhyphen{}separated list.) Specifies the kpasswd listening -addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon. Each -entry may be an interface address, a port number, an address and -port number separated by a colon, or a UNIX domain socket -pathname. If the address contains colons, enclose it in square -brackets. If no address is specified, the wildcard address is -used. To disable listening for kpasswd requests, set this -relation to the empty string with \sphinxcode{\sphinxupquote{kpasswd\_listen = ""}}. If -kadmind fails to bind to any of the specified addresses, it will -fail to start. The default is to bind to the wildcard address at -the port specified in \sphinxstylestrong{kpasswd\_port}, or the standard kpasswd -port (464). New in release 1.15. - -\sphinxlineitem{\sphinxstylestrong{kpasswd\_port}} -\sphinxAtStartPar -(Port number.) Specifies the port on which the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} -daemon is to listen for password change requests for this realm. -Port numbers specified in \sphinxstylestrong{kpasswd\_listen} entries will override -this port number. The assigned port for password change requests -is 464, which is used by default. - -\sphinxlineitem{\sphinxstylestrong{master\_key\_name}} -\sphinxAtStartPar -(String.) Specifies the name of the principal associated with the -master key. The default is \sphinxcode{\sphinxupquote{K/M}}. - -\sphinxlineitem{\sphinxstylestrong{master\_key\_type}} -\sphinxAtStartPar -(Key type string.) Specifies the master key’s key type. The -default value for this is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96}}. For a list of all possible -values, see {\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}}. - -\sphinxlineitem{\sphinxstylestrong{max\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Specifies the maximum time period for -which a ticket may be valid in this realm. The default value is -24 hours. - -\sphinxlineitem{\sphinxstylestrong{max\_renewable\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Specifies the maximum time period -during which a valid ticket may be renewed in this realm. -The default value is 0. - -\sphinxlineitem{\sphinxstylestrong{no\_host\_referral}} -\sphinxAtStartPar -(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Lists services to block -from getting host\sphinxhyphen{}based referral processing, even if the client -marks the server principal as host\sphinxhyphen{}based or the service is also -listed in \sphinxstylestrong{host\_based\_services}. \sphinxcode{\sphinxupquote{no\_host\_referral = *}} will -disable referral processing altogether. - -\sphinxlineitem{\sphinxstylestrong{reject\_bad\_transit}} -\sphinxAtStartPar -(Boolean value.) If set to true, the KDC will check the list of -transited realms for cross\sphinxhyphen{}realm tickets against the transit path -computed from the realm names and the capaths section of its -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file; if the path in the ticket to be issued -contains any realms not in the computed path, the ticket will not -be issued, and an error will be returned to the client instead. -If this value is set to false, such tickets will be issued -anyways, and it will be left up to the application server to -validate the realm transit path. - -\sphinxAtStartPar -If the disable\sphinxhyphen{}transited\sphinxhyphen{}check flag is set in the incoming -request, this check is not performed at all. Having the -\sphinxstylestrong{reject\_bad\_transit} option will cause such ticket requests to -be rejected always. - -\sphinxAtStartPar -This transit path checking and config file option currently apply -only to TGS requests. - -\sphinxAtStartPar -The default value is true. - -\sphinxlineitem{\sphinxstylestrong{restrict\_anonymous\_to\_tgt}} -\sphinxAtStartPar -(Boolean value.) If set to true, the KDC will reject ticket -requests from anonymous principals to service principals other -than the realm’s ticket\sphinxhyphen{}granting service. This option allows -anonymous PKINIT to be enabled for use as FAST armor tickets -without allowing anonymous authentication to services. The -default value is false. New in release 1.9. - -\sphinxlineitem{\sphinxstylestrong{spake\_preauth\_indicator}} -\sphinxAtStartPar -(String.) Specifies an authentication indicator value that the -KDC asserts into tickets obtained using SPAKE pre\sphinxhyphen{}authentication. -The default is not to add any indicators. This option may be -specified multiple times. New in release 1.17. - -\sphinxlineitem{\sphinxstylestrong{supported\_enctypes}} -\sphinxAtStartPar -(List of \sphinxstyleemphasis{key}:\sphinxstyleemphasis{salt} strings.) Specifies the default key/salt -combinations of principals for this realm. Any principals created -through {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} will have keys of these types. The -default value for this tag is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96:normal aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96:normal}}. For lists of -possible values, see {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}}. - -\end{description} - - -\paragraph{{[}dbdefaults{]}} -\label{\detokenize{admin/conf_files/kdc_conf:dbdefaults}}\label{\detokenize{admin/conf_files/kdc_conf:id2}} -\sphinxAtStartPar -The {[}dbdefaults{]} section specifies default values for some database -parameters, to be used if the {[}dbmodules{]} subsection does not contain -a relation for the tag. See the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} section for the -definitions of these relations. -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kerberos\_container\_dn} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kdc\_dn} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kdc\_sasl\_authcid} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kdc\_sasl\_authzid} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kdc\_sasl\_mech} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kdc\_sasl\_realm} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kadmind\_dn} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kadmind\_sasl\_authcid} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kadmind\_sasl\_authzid} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kadmind\_sasl\_mech} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_kadmind\_sasl\_realm} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_service\_password\_file} - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ldap\_conns\_per\_server} - -\end{itemize} - - -\paragraph{{[}dbmodules{]}} -\label{\detokenize{admin/conf_files/kdc_conf:dbmodules}}\label{\detokenize{admin/conf_files/kdc_conf:id3}} -\sphinxAtStartPar -The {[}dbmodules{]} section contains parameters used by the KDC database -library and database modules. Each tag in the {[}dbmodules{]} section is -the name of a Kerberos realm or a section name specified by a realm’s -\sphinxstylestrong{database\_module} parameter. The following example shows how to -define one database parameter for the ATHENA.MIT.EDU realm: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{disable\PYGZus{}last\PYGZus{}success} \PYG{o}{=} \PYG{n}{true} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The following tags may be specified in a {[}dbmodules{]} subsection: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{database\_name}} -\sphinxAtStartPar -This DB2\sphinxhyphen{}specific tag indicates the location of the database in -the filesystem. The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/principal}}. - -\sphinxlineitem{\sphinxstylestrong{db\_library}} -\sphinxAtStartPar -This tag indicates the name of the loadable database module. The -value should be \sphinxcode{\sphinxupquote{db2}} for the DB2 module, \sphinxcode{\sphinxupquote{klmdb}} for the LMDB -module, or \sphinxcode{\sphinxupquote{kldap}} for the LDAP module. - -\sphinxlineitem{\sphinxstylestrong{disable\_last\_success}} -\sphinxAtStartPar -If set to \sphinxcode{\sphinxupquote{true}}, suppresses KDC updates to the “Last successful -authentication” field of principal entries requiring -preauthentication. Setting this flag may improve performance. -(Principal entries which do not require preauthentication never -update the “Last successful authentication” field.). First -introduced in release 1.9. - -\sphinxlineitem{\sphinxstylestrong{disable\_lockout}} -\sphinxAtStartPar -If set to \sphinxcode{\sphinxupquote{true}}, suppresses KDC updates to the “Last failed -authentication” and “Failed password attempts” fields of principal -entries requiring preauthentication. Setting this flag may -improve performance, but also disables account lockout. First -introduced in release 1.9. - -\sphinxlineitem{\sphinxstylestrong{ldap\_conns\_per\_server}} -\sphinxAtStartPar -This LDAP\sphinxhyphen{}specific tag indicates the number of connections to be -maintained per LDAP server. - -\sphinxlineitem{\sphinxstylestrong{ldap\_kdc\_dn} and \sphinxstylestrong{ldap\_kadmind\_dn}} -\sphinxAtStartPar -These LDAP\sphinxhyphen{}specific tags indicate the default DN for binding to -the LDAP server. The {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon uses -\sphinxstylestrong{ldap\_kdc\_dn}, while the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon and other -administrative programs use \sphinxstylestrong{ldap\_kadmind\_dn}. The kadmind DN -must have the rights to read and write the Kerberos data in the -LDAP database. The KDC DN must have the same rights, unless -\sphinxstylestrong{disable\_lockout} and \sphinxstylestrong{disable\_last\_success} are true, in -which case it only needs to have rights to read the Kerberos data. -These tags are ignored if a SASL mechanism is set with -\sphinxstylestrong{ldap\_kdc\_sasl\_mech} or \sphinxstylestrong{ldap\_kadmind\_sasl\_mech}. - -\sphinxlineitem{\sphinxstylestrong{ldap\_kdc\_sasl\_mech} and \sphinxstylestrong{ldap\_kadmind\_sasl\_mech}} -\sphinxAtStartPar -These LDAP\sphinxhyphen{}specific tags specify the SASL mechanism (such as -\sphinxcode{\sphinxupquote{EXTERNAL}}) to use when binding to the LDAP server. New in -release 1.13. - -\sphinxlineitem{\sphinxstylestrong{ldap\_kdc\_sasl\_authcid} and \sphinxstylestrong{ldap\_kadmind\_sasl\_authcid}} -\sphinxAtStartPar -These LDAP\sphinxhyphen{}specific tags specify the SASL authentication identity -to use when binding to the LDAP server. Not all SASL mechanisms -require an authentication identity. If the SASL mechanism -requires a secret (such as the password for \sphinxcode{\sphinxupquote{DIGEST\sphinxhyphen{}MD5}}), these -tags also determine the name within the -\sphinxstylestrong{ldap\_service\_password\_file} where the secret is stashed. New -in release 1.13. - -\sphinxlineitem{\sphinxstylestrong{ldap\_kdc\_sasl\_authzid} and \sphinxstylestrong{ldap\_kadmind\_sasl\_authzid}} -\sphinxAtStartPar -These LDAP\sphinxhyphen{}specific tags specify the SASL authorization identity -to use when binding to the LDAP server. In most circumstances -they do not need to be specified. New in release 1.13. - -\sphinxlineitem{\sphinxstylestrong{ldap\_kdc\_sasl\_realm} and \sphinxstylestrong{ldap\_kadmind\_sasl\_realm}} -\sphinxAtStartPar -These LDAP\sphinxhyphen{}specific tags specify the SASL realm to use when -binding to the LDAP server. In most circumstances they do not -need to be set. New in release 1.13. - -\sphinxlineitem{\sphinxstylestrong{ldap\_kerberos\_container\_dn}} -\sphinxAtStartPar -This LDAP\sphinxhyphen{}specific tag indicates the DN of the container object -where the realm objects will be located. - -\sphinxlineitem{\sphinxstylestrong{ldap\_servers}} -\sphinxAtStartPar -This LDAP\sphinxhyphen{}specific tag indicates the list of LDAP servers that the -Kerberos servers can connect to. The list of LDAP servers is -whitespace\sphinxhyphen{}separated. The LDAP server is specified by a LDAP URI. -It is recommended to use \sphinxcode{\sphinxupquote{ldapi:}} or \sphinxcode{\sphinxupquote{ldaps:}} URLs to connect -to the LDAP server. - -\sphinxlineitem{\sphinxstylestrong{ldap\_service\_password\_file}} -\sphinxAtStartPar -This LDAP\sphinxhyphen{}specific tag indicates the file containing the stashed -passwords (created by \sphinxcode{\sphinxupquote{kdb5\_ldap\_util stashsrvpw}}) for the -\sphinxstylestrong{ldap\_kdc\_dn} and \sphinxstylestrong{ldap\_kadmind\_dn} objects, or for the -\sphinxstylestrong{ldap\_kdc\_sasl\_authcid} or \sphinxstylestrong{ldap\_kadmind\_sasl\_authcid} names -for SASL authentication. This file must be kept secure. - -\sphinxlineitem{\sphinxstylestrong{mapsize}} -\sphinxAtStartPar -This LMDB\sphinxhyphen{}specific tag indicates the maximum size of the two -database environments in megabytes. The default value is 128. -Increase this value to address “Environment mapsize limit reached” -errors. New in release 1.17. - -\sphinxlineitem{\sphinxstylestrong{max\_readers}} -\sphinxAtStartPar -This LMDB\sphinxhyphen{}specific tag indicates the maximum number of concurrent -reading processes for the databases. The default value is 128. -New in release 1.17. - -\sphinxlineitem{\sphinxstylestrong{nosync}} -\sphinxAtStartPar -This LMDB\sphinxhyphen{}specific tag can be set to improve the throughput of -kadmind and other administrative agents, at the expense of -durability (recent database changes may not survive a power outage -or other sudden reboot). It does not affect the throughput of the -KDC. The default value is false. New in release 1.17. - -\sphinxlineitem{\sphinxstylestrong{unlockiter}} -\sphinxAtStartPar -If set to \sphinxcode{\sphinxupquote{true}}, this DB2\sphinxhyphen{}specific tag causes iteration -operations to release the database lock while processing each -principal. Setting this flag to \sphinxcode{\sphinxupquote{true}} can prevent extended -blocking of KDC or kadmin operations when dumps of large databases -are in progress. First introduced in release 1.13. - -\end{description} - -\sphinxAtStartPar -The following tag may be specified directly in the {[}dbmodules{]} -section to control where database modules are loaded from: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{db\_module\_dir}} -\sphinxAtStartPar -This tag controls where the plugin system looks for database -modules. The value should be an absolute path. - -\end{description} - - -\paragraph{{[}logging{]}} -\label{\detokenize{admin/conf_files/kdc_conf:logging}}\label{\detokenize{admin/conf_files/kdc_conf:id4}} -\sphinxAtStartPar -The {[}logging{]} section indicates how {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} and -{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} perform logging. It may contain the following -relations: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{admin\_server}} -\sphinxAtStartPar -Specifies how {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} performs logging. - -\sphinxlineitem{\sphinxstylestrong{kdc}} -\sphinxAtStartPar -Specifies how {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} performs logging. - -\sphinxlineitem{\sphinxstylestrong{default}} -\sphinxAtStartPar -Specifies how either daemon performs logging in the absence of -relations specific to the daemon. - -\sphinxlineitem{\sphinxstylestrong{debug}} -\sphinxAtStartPar -(Boolean value.) Specifies whether debugging messages are -included in log outputs other than SYSLOG. Debugging messages are -always included in the system log output because syslog performs -its own priority filtering. The default value is false. New in -release 1.15. - -\end{description} - -\sphinxAtStartPar -Logging specifications may have the following forms: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{FILE=}\sphinxstyleemphasis{filename} or \sphinxstylestrong{FILE:}\sphinxstyleemphasis{filename}} -\sphinxAtStartPar -This value causes the daemon’s logging messages to go to the -\sphinxstyleemphasis{filename}. If the \sphinxcode{\sphinxupquote{=}} form is used, the file is overwritten. -If the \sphinxcode{\sphinxupquote{:}} form is used, the file is appended to. - -\sphinxlineitem{\sphinxstylestrong{STDERR}} -\sphinxAtStartPar -This value causes the daemon’s logging messages to go to its -standard error stream. - -\sphinxlineitem{\sphinxstylestrong{CONSOLE}} -\sphinxAtStartPar -This value causes the daemon’s logging messages to go to the -console, if the system supports it. - -\sphinxlineitem{\sphinxstylestrong{DEVICE=}\sphinxstyleemphasis{\textless{}devicename\textgreater{}}} -\sphinxAtStartPar -This causes the daemon’s logging messages to go to the specified -device. - -\sphinxlineitem{\sphinxstylestrong{SYSLOG}{[}\sphinxstylestrong{:}\sphinxstyleemphasis{severity}{[}\sphinxstylestrong{:}\sphinxstyleemphasis{facility}{]}{]}} -\sphinxAtStartPar -This causes the daemon’s logging messages to go to the system log. - -\sphinxAtStartPar -For backward compatibility, a severity argument may be specified, -and must be specified in order to specify a facility. This -argument will be ignored. - -\sphinxAtStartPar -The facility argument specifies the facility under which the -messages are logged. This may be any of the following facilities -supported by the syslog(3) call minus the LOG\_ prefix: \sphinxstylestrong{KERN}, -\sphinxstylestrong{USER}, \sphinxstylestrong{MAIL}, \sphinxstylestrong{DAEMON}, \sphinxstylestrong{AUTH}, \sphinxstylestrong{LPR}, \sphinxstylestrong{NEWS}, -\sphinxstylestrong{UUCP}, \sphinxstylestrong{CRON}, and \sphinxstylestrong{LOCAL0} through \sphinxstylestrong{LOCAL7}. If no -facility is specified, the default is \sphinxstylestrong{AUTH}. - -\end{description} - -\sphinxAtStartPar -In the following example, the logging messages from the KDC will go to -the console and to the system log under the facility LOG\_DAEMON, and -the logging messages from the administrative server will be appended -to the file \sphinxcode{\sphinxupquote{/var/adm/kadmin.log}} and sent to the device -\sphinxcode{\sphinxupquote{/dev/tty04}}. - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{logging}\PYG{p}{]} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{CONSOLE} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{SYSLOG}\PYG{p}{:}\PYG{n}{INFO}\PYG{p}{:}\PYG{n}{DAEMON} - \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{adm}\PYG{o}{/}\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{log} - \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{DEVICE}\PYG{o}{=}\PYG{o}{/}\PYG{n}{dev}\PYG{o}{/}\PYG{n}{tty04} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If no logging specification is given, the default is to use syslog. -To disable logging entirely, specify \sphinxcode{\sphinxupquote{default = DEVICE=/dev/null}}. - - -\paragraph{{[}otp{]}} -\label{\detokenize{admin/conf_files/kdc_conf:otp}}\label{\detokenize{admin/conf_files/kdc_conf:id5}} -\sphinxAtStartPar -Each subsection of {[}otp{]} is the name of an OTP token type. The tags -within the subsection define the configuration required to forward a -One Time Password request to a RADIUS server. - -\sphinxAtStartPar -For each token type, the following tags may be specified: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{server}} -\sphinxAtStartPar -This is the server to send the RADIUS request to. It can be a -hostname with optional port, an ip address with optional port, or -a Unix domain socket address. The default is -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/\textless{}name\textgreater{}.socket}}. - -\sphinxlineitem{\sphinxstylestrong{secret}} -\sphinxAtStartPar -This tag indicates a filename (which may be relative to {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}) -containing the secret used to encrypt the RADIUS packets. The -secret should appear in the first line of the file by itself; -leading and trailing whitespace on the line will be removed. If -the value of \sphinxstylestrong{server} is a Unix domain socket address, this tag -is optional, and an empty secret will be used if it is not -specified. Otherwise, this tag is required. - -\sphinxlineitem{\sphinxstylestrong{timeout}} -\sphinxAtStartPar -An integer which specifies the time in seconds during which the -KDC should attempt to contact the RADIUS server. This tag is the -total time across all retries and should be less than the time -which an OTP value remains valid for. The default is 5 seconds. - -\sphinxlineitem{\sphinxstylestrong{retries}} -\sphinxAtStartPar -This tag specifies the number of retries to make to the RADIUS -server. The default is 3 retries (4 tries). - -\sphinxlineitem{\sphinxstylestrong{strip\_realm}} -\sphinxAtStartPar -If this tag is \sphinxcode{\sphinxupquote{true}}, the principal without the realm will be -passed to the RADIUS server. Otherwise, the realm will be -included. The default value is \sphinxcode{\sphinxupquote{true}}. - -\sphinxlineitem{\sphinxstylestrong{indicator}} -\sphinxAtStartPar -This tag specifies an authentication indicator to be included in -the ticket if this token type is used to authenticate. This -option may be specified multiple times. (New in release 1.14.) - -\end{description} - -\sphinxAtStartPar -In the following example, requests are sent to a remote server via UDP: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -[otp] - MyRemoteTokenType = \PYGZob{} - server = radius.mydomain.com:1812 - secret = SEmfiajf42\PYGZdl{} - timeout = 15 - retries = 5 - strip\PYGZus{}realm = true - \PYGZcb{} -\end{sphinxVerbatim} - -\sphinxAtStartPar -An implicit default token type named \sphinxcode{\sphinxupquote{DEFAULT}} is defined for when -the per\sphinxhyphen{}principal configuration does not specify a token type. Its -configuration is shown below. You may override this token type to -something applicable for your situation: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{otp}\PYG{p}{]} - \PYG{n}{DEFAULT} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{strip\PYGZus{}realm} \PYG{o}{=} \PYG{n}{false} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - - -\subsubsection{PKINIT options} -\label{\detokenize{admin/conf_files/kdc_conf:pkinit-options}} -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The following are pkinit\sphinxhyphen{}specific options. These values may -be specified in {[}kdcdefaults{]} as global defaults, or within -a realm\sphinxhyphen{}specific subsection of {[}realms{]}. Also note that a -realm\sphinxhyphen{}specific value over\sphinxhyphen{}rides, does not add to, a generic -{[}kdcdefaults{]} specification. The search order is: -\end{sphinxadmonition} -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -realm\sphinxhyphen{}specific subsection of {[}realms{]}: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com}\PYG{o}{.}\PYG{n}{crt} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\item {} -\sphinxAtStartPar -generic value in the {[}kdcdefaults{]} section: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} - \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{DIR}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{generic\PYGZus{}trusted\PYGZus{}cas}\PYG{o}{/} -\end{sphinxVerbatim} - -\end{enumerate} - -\sphinxAtStartPar -For information about the syntax of some of these options, see -{\hyperref[\detokenize{admin/conf_files/krb5_conf:pkinit-identity}]{\sphinxcrossref{\DUrole{std,std-ref}{Specifying PKINIT identity information}}}} in -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. -\begin{description} -\sphinxlineitem{\sphinxstylestrong{pkinit\_anchors}} -\sphinxAtStartPar -Specifies the location of trusted anchor (root) certificates which -the KDC trusts to sign client certificates. This option is -required if pkinit is to be supported by the KDC. This option may -be specified multiple times. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_dh\_min\_bits}} -\sphinxAtStartPar -Specifies the minimum strength of Diffie\sphinxhyphen{}Hellman group the KDC is -willing to accept for key exchange. Valid values in order of -increasing strength are 1024, 2048, P\sphinxhyphen{}256, 4096, P\sphinxhyphen{}384, and P\sphinxhyphen{}521. -The default is 2048. (P\sphinxhyphen{}256, P\sphinxhyphen{}384, and P\sphinxhyphen{}521 are new in release -1.22.) - -\sphinxlineitem{\sphinxstylestrong{pkinit\_allow\_upn}} -\sphinxAtStartPar -Specifies that the KDC is willing to accept client certificates -with the Microsoft UserPrincipalName (UPN) Subject Alternative -Name (SAN). This means the KDC accepts the binding of the UPN in -the certificate to the Kerberos principal name. The default value -is false. - -\sphinxAtStartPar -Without this option, the KDC will only accept certificates with -the id\sphinxhyphen{}pkinit\sphinxhyphen{}san as defined in \index{RFC@\spxentry{RFC}!RFC 4556@\spxentry{RFC 4556}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc4556.html}{\sphinxstylestrong{RFC 4556}}. There is currently -no option to disable SAN checking in the KDC. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_eku\_checking}} -\sphinxAtStartPar -This option specifies what Extended Key Usage (EKU) values the KDC -is willing to accept in client certificates. The values -recognized in the kdc.conf file are: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{kpClientAuth}} -\sphinxAtStartPar -This is the default value and specifies that client -certificates must have the id\sphinxhyphen{}pkinit\sphinxhyphen{}KPClientAuth EKU as -defined in \index{RFC@\spxentry{RFC}!RFC 4556@\spxentry{RFC 4556}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc4556.html}{\sphinxstylestrong{RFC 4556}}. - -\sphinxlineitem{\sphinxstylestrong{scLogin}} -\sphinxAtStartPar -If scLogin is specified, client certificates with the -Microsoft Smart Card Login EKU (id\sphinxhyphen{}ms\sphinxhyphen{}kp\sphinxhyphen{}sc\sphinxhyphen{}logon) will be -accepted. - -\sphinxlineitem{\sphinxstylestrong{none}} -\sphinxAtStartPar -If none is specified, then client certificates will not be -checked to verify they have an acceptable EKU. The use of -this option is not recommended. - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{pkinit\_identity}} -\sphinxAtStartPar -Specifies the location of the KDC’s X.509 identity information. -This option is required if pkinit is to be supported by the KDC. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_indicator}} -\sphinxAtStartPar -Specifies an authentication indicator to include in the ticket if -pkinit is used to authenticate. This option may be specified -multiple times. (New in release 1.14.) - -\sphinxlineitem{\sphinxstylestrong{pkinit\_pool}} -\sphinxAtStartPar -Specifies the location of intermediate certificates which may be -used by the KDC to complete the trust chain between a client’s -certificate and a trusted anchor. This option may be specified -multiple times. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_revoke}} -\sphinxAtStartPar -Specifies the location of Certificate Revocation List (CRL) -information to be used by the KDC when verifying the validity of -client certificates. This option may be specified multiple times. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_require\_crl\_checking}} -\sphinxAtStartPar -The default certificate verification process will always check the -available revocation information to see if a certificate has been -revoked. If a match is found for the certificate in a CRL, -verification fails. If the certificate being verified is not -listed in a CRL, or there is no CRL present for its issuing CA, -and \sphinxstylestrong{pkinit\_require\_crl\_checking} is false, then verification -succeeds. - -\sphinxAtStartPar -However, if \sphinxstylestrong{pkinit\_require\_crl\_checking} is true and there is -no CRL information available for the issuing CA, then verification -fails. - -\sphinxAtStartPar -\sphinxstylestrong{pkinit\_require\_crl\_checking} should be set to true if the -policy is such that up\sphinxhyphen{}to\sphinxhyphen{}date CRLs must be present for every CA. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_require\_freshness}} -\sphinxAtStartPar -Specifies whether to require clients to include a freshness token -in PKINIT requests. The default value is false. (New in release -1.17.) - -\end{description} - - -\subsubsection{Encryption types} -\label{\detokenize{admin/conf_files/kdc_conf:encryption-types}}\label{\detokenize{admin/conf_files/kdc_conf:id6}} -\sphinxAtStartPar -Any tag in the configuration files which requires a list of encryption -types can be set to some combination of the following strings. -Encryption types marked as “weak” and “deprecated” are available for -compatibility but not recommended for use. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -des3\sphinxhyphen{}cbc\sphinxhyphen{}raw -& -\sphinxAtStartPar -Triple DES cbc mode raw (weak) -\\ -\sphinxhline -\sphinxAtStartPar -des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 des3\sphinxhyphen{}hmac\sphinxhyphen{}sha1 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1\sphinxhyphen{}kd -& -\sphinxAtStartPar -Triple DES cbc mode with HMAC/sha1 (deprecated) -\\ -\sphinxhline -\sphinxAtStartPar -aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts aes256\sphinxhyphen{}sha1 -& -\sphinxAtStartPar -AES\sphinxhyphen{}256 CTS mode with 96\sphinxhyphen{}bit SHA\sphinxhyphen{}1 HMAC -\\ -\sphinxhline -\sphinxAtStartPar -aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts aes128\sphinxhyphen{}sha1 -& -\sphinxAtStartPar -AES\sphinxhyphen{}128 CTS mode with 96\sphinxhyphen{}bit SHA\sphinxhyphen{}1 HMAC -\\ -\sphinxhline -\sphinxAtStartPar -aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes256\sphinxhyphen{}sha2 -& -\sphinxAtStartPar -AES\sphinxhyphen{}256 CTS mode with 192\sphinxhyphen{}bit SHA\sphinxhyphen{}384 HMAC -\\ -\sphinxhline -\sphinxAtStartPar -aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 aes128\sphinxhyphen{}sha2 -& -\sphinxAtStartPar -AES\sphinxhyphen{}128 CTS mode with 128\sphinxhyphen{}bit SHA\sphinxhyphen{}256 HMAC -\\ -\sphinxhline -\sphinxAtStartPar -arcfour\sphinxhyphen{}hmac rc4\sphinxhyphen{}hmac arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 -& -\sphinxAtStartPar -RC4 with HMAC/MD5 (deprecated) -\\ -\sphinxhline -\sphinxAtStartPar -arcfour\sphinxhyphen{}hmac\sphinxhyphen{}exp rc4\sphinxhyphen{}hmac\sphinxhyphen{}exp arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5\sphinxhyphen{}exp -& -\sphinxAtStartPar -Exportable RC4 with HMAC/MD5 (weak) -\\ -\sphinxhline -\sphinxAtStartPar -camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia256\sphinxhyphen{}cts -& -\sphinxAtStartPar -Camellia\sphinxhyphen{}256 CTS mode with CMAC -\\ -\sphinxhline -\sphinxAtStartPar -camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts -& -\sphinxAtStartPar -Camellia\sphinxhyphen{}128 CTS mode with CMAC -\\ -\sphinxhline -\sphinxAtStartPar -des3 -& -\sphinxAtStartPar -The triple DES family: des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 -\\ -\sphinxhline -\sphinxAtStartPar -aes -& -\sphinxAtStartPar -The AES family: aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96, aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96, aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192, and aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 -\\ -\sphinxhline -\sphinxAtStartPar -rc4 -& -\sphinxAtStartPar -The RC4 family: arcfour\sphinxhyphen{}hmac -\\ -\sphinxhline -\sphinxAtStartPar -camellia -& -\sphinxAtStartPar -The Camellia family: camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac and camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxAtStartPar -The string \sphinxstylestrong{DEFAULT} can be used to refer to the default set of -types for the variable in question. Types or families can be removed -from the current list by prefixing them with a minus sign (“\sphinxhyphen{}“). -Types or families can be prefixed with a plus sign (“+”) for symmetry; -it has the same meaning as just listing the type or family. For -example, “\sphinxcode{\sphinxupquote{DEFAULT \sphinxhyphen{}rc4}}” would be the default set of encryption -types with RC4 types removed, and “\sphinxcode{\sphinxupquote{des3 DEFAULT}}” would be the -default set of encryption types with triple DES types moved to the -front. - -\sphinxAtStartPar -While \sphinxstylestrong{aes128\sphinxhyphen{}cts} and \sphinxstylestrong{aes256\sphinxhyphen{}cts} are supported for all Kerberos -operations, they are not supported by very old versions of our GSSAPI -implementation (krb5\sphinxhyphen{}1.3.1 and earlier). Services running versions of -krb5 without AES support must not be given keys of these encryption -types in the KDC database. - -\sphinxAtStartPar -The \sphinxstylestrong{aes128\sphinxhyphen{}sha2} and \sphinxstylestrong{aes256\sphinxhyphen{}sha2} encryption types are new in -release 1.15. Services running versions of krb5 without support for -these newer encryption types must not be given keys of these -encryption types in the KDC database. - - -\subsubsection{Keysalt lists} -\label{\detokenize{admin/conf_files/kdc_conf:keysalt-lists}}\label{\detokenize{admin/conf_files/kdc_conf:id7}} -\sphinxAtStartPar -Kerberos keys for users are usually derived from passwords. Kerberos -commands and configuration parameters that affect generation of keys -take lists of enctype\sphinxhyphen{}salttype (“keysalt”) pairs, known as \sphinxstyleemphasis{keysalt -lists}. Each keysalt pair is an enctype name followed by a salttype -name, in the format \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt}. Individual keysalt list members are -separated by comma (“,”) characters or space characters. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{e} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{p}{:}\PYG{n}{normal} -\end{sphinxVerbatim} - -\sphinxAtStartPar -would start up kadmin so that by default it would generate -password\sphinxhyphen{}derived keys for the \sphinxstylestrong{aes256\sphinxhyphen{}cts} and \sphinxstylestrong{aes128\sphinxhyphen{}cts} -encryption types, using a \sphinxstylestrong{normal} salt. - -\sphinxAtStartPar -To ensure that people who happen to pick the same password do not have -the same key, Kerberos 5 incorporates more information into the key -using something called a salt. The supported salt types are as -follows: - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -normal -& -\sphinxAtStartPar -default for Kerberos Version 5 -\\ -\sphinxhline -\sphinxAtStartPar -norealm -& -\sphinxAtStartPar -same as the default, without using realm information -\\ -\sphinxhline -\sphinxAtStartPar -onlyrealm -& -\sphinxAtStartPar -uses only realm information as the salt -\\ -\sphinxhline -\sphinxAtStartPar -special -& -\sphinxAtStartPar -generate a random salt -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - - -\subsubsection{Sample kdc.conf File} -\label{\detokenize{admin/conf_files/kdc_conf:sample-kdc-conf-file}} -\sphinxAtStartPar -Here’s an example of a kdc.conf file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} - \PYG{n}{kdc\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} - \PYG{n}{kdc\PYGZus{}tcp\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{kadmind\PYGZus{}port} \PYG{o}{=} \PYG{l+m+mi}{749} - \PYG{n}{max\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{12}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} - \PYG{n}{max\PYGZus{}renewable\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{7}\PYG{n}{d} \PYG{l+m+mi}{0}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} - \PYG{n}{master\PYGZus{}key\PYGZus{}type} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} - \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} - \PYG{n}{database\PYGZus{}module} \PYG{o}{=} \PYG{n}{openldap\PYGZus{}ldapconf} - \PYG{p}{\PYGZcb{}} - -\PYG{p}{[}\PYG{n}{logging}\PYG{p}{]} - \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{kdc}\PYG{o}{.}\PYG{n}{log} - \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{log} - -\PYG{p}{[}\PYG{n}{dbdefaults}\PYG{p}{]} - \PYG{n}{ldap\PYGZus{}kerberos\PYGZus{}container\PYGZus{}dn} \PYG{o}{=} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{krbcontainer}\PYG{p}{,}\PYG{n}{dc}\PYG{o}{=}\PYG{n}{mit}\PYG{p}{,}\PYG{n}{dc}\PYG{o}{=}\PYG{n}{edu} - -\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} - \PYG{n}{openldap\PYGZus{}ldapconf} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{db\PYGZus{}library} \PYG{o}{=} \PYG{n}{kldap} - \PYG{n}{disable\PYGZus{}last\PYGZus{}success} \PYG{o}{=} \PYG{n}{true} - \PYG{n}{ldap\PYGZus{}kdc\PYGZus{}dn} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=krbadmin,dc=mit,dc=edu}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{c+c1}{\PYGZsh{} this object needs to have read rights on} - \PYG{c+c1}{\PYGZsh{} the realm container and principal subtrees} - \PYG{n}{ldap\PYGZus{}kadmind\PYGZus{}dn} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=krbadmin,dc=mit,dc=edu}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{c+c1}{\PYGZsh{} this object needs to have read and write rights on} - \PYG{c+c1}{\PYGZsh{} the realm container and principal subtrees} - \PYG{n}{ldap\PYGZus{}service\PYGZus{}password\PYGZus{}file} \PYG{o}{=} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{/}\PYG{n}{service}\PYG{o}{.}\PYG{n}{keyfile} - \PYG{n}{ldap\PYGZus{}servers} \PYG{o}{=} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{n}{ldap\PYGZus{}conns\PYGZus{}per\PYGZus{}server} \PYG{o}{=} \PYG{l+m+mi}{5} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - - -\subsubsection{FILES} -\label{\detokenize{admin/conf_files/kdc_conf:files}} -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kdc.conf}} - - -\subsubsection{SEE ALSO} -\label{\detokenize{admin/conf_files/kdc_conf:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}, {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}, {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} - -\sphinxstepscope - - -\subsection{kadm5.acl} -\label{\detokenize{admin/conf_files/kadm5_acl:kadm5-acl}}\label{\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}}\label{\detokenize{admin/conf_files/kadm5_acl::doc}} - -\subsubsection{DESCRIPTION} -\label{\detokenize{admin/conf_files/kadm5_acl:description}} -\sphinxAtStartPar -The Kerberos {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon uses an Access Control List -(ACL) file to manage access rights to the Kerberos database. -For operations that affect principals, the ACL file also controls -which principals can operate on which other principals. - -\sphinxAtStartPar -The default location of the Kerberos ACL file is -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}} unless this is overridden by the \sphinxstyleemphasis{acl\_file} -variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - - -\subsubsection{SYNTAX} -\label{\detokenize{admin/conf_files/kadm5_acl:syntax}} -\sphinxAtStartPar -Empty lines and lines starting with the sharp sign (\sphinxcode{\sphinxupquote{\#}}) are -ignored. Lines containing ACL entries have the format: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{principal} \PYG{n}{permissions} \PYG{p}{[}\PYG{n}{target\PYGZus{}principal} \PYG{p}{[}\PYG{n}{restrictions}\PYG{p}{]} \PYG{p}{]} -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Line order in the ACL file is important. The first matching entry -will control access for an actor principal on a target principal. -\end{sphinxadmonition} -\begin{description} -\sphinxlineitem{\sphinxstyleemphasis{principal}} -\sphinxAtStartPar -(Partially or fully qualified Kerberos principal name.) Specifies -the principal whose permissions are to be set. - -\sphinxAtStartPar -Each component of the name may be wildcarded using the \sphinxcode{\sphinxupquote{*}} -character. - -\sphinxlineitem{\sphinxstyleemphasis{permissions}} -\sphinxAtStartPar -Specifies what operations may or may not be performed by a -\sphinxstyleemphasis{principal} matching a particular entry. This is a string of one or -more of the following list of characters or their upper\sphinxhyphen{}case -counterparts. If the character is \sphinxstyleemphasis{upper\sphinxhyphen{}case}, then the operation -is disallowed. If the character is \sphinxstyleemphasis{lower\sphinxhyphen{}case}, then the operation -is permitted. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -a -& -\sphinxAtStartPar -{[}Dis{]}allows the addition of principals or policies -\\ -\sphinxhline -\sphinxAtStartPar -c -& -\sphinxAtStartPar -{[}Dis{]}allows the changing of passwords for principals -\\ -\sphinxhline -\sphinxAtStartPar -d -& -\sphinxAtStartPar -{[}Dis{]}allows the deletion of principals or policies -\\ -\sphinxhline -\sphinxAtStartPar -e -& -\sphinxAtStartPar -{[}Dis{]}allows the extraction of principal keys -\\ -\sphinxhline -\sphinxAtStartPar -i -& -\sphinxAtStartPar -{[}Dis{]}allows inquiries about principals or policies -\\ -\sphinxhline -\sphinxAtStartPar -l -& -\sphinxAtStartPar -{[}Dis{]}allows the listing of all principals or policies -\\ -\sphinxhline -\sphinxAtStartPar -m -& -\sphinxAtStartPar -{[}Dis{]}allows the modification of principals or policies -\\ -\sphinxhline -\sphinxAtStartPar -p -& -\sphinxAtStartPar -{[}Dis{]}allows the propagation of the principal database (used in {\hyperref[\detokenize{admin/database:incr-db-prop}]{\sphinxcrossref{\DUrole{std,std-ref}{Incremental database propagation}}}}) -\\ -\sphinxhline -\sphinxAtStartPar -s -& -\sphinxAtStartPar -{[}Dis{]}allows the explicit setting of the key for a principal -\\ -\sphinxhline -\sphinxAtStartPar -x -& -\sphinxAtStartPar -Short for admcilsp. All privileges (except \sphinxcode{\sphinxupquote{e}}) -\\ -\sphinxhline -\sphinxAtStartPar -* -& -\sphinxAtStartPar -Same as x. -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\end{description} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The \sphinxcode{\sphinxupquote{extract}} privilege is not included in the wildcard -privilege; it must be explicitly assigned. This privilege -allows the user to extract keys from the database, and must be -handled with great care to avoid disclosure of important keys -like those of the kadmin/* or krbtgt/* principals. The -\sphinxstylestrong{lockdown\_keys} principal attribute can be used to prevent -key extraction from specific principals regardless of the -granted privilege. -\end{sphinxadmonition} -\begin{description} -\sphinxlineitem{\sphinxstyleemphasis{target\_principal}} -\sphinxAtStartPar -(Optional. Partially or fully qualified Kerberos principal name.) -Specifies the principal on which \sphinxstyleemphasis{permissions} may be applied. -Each component of the name may be wildcarded using the \sphinxcode{\sphinxupquote{*}} -character. - -\sphinxAtStartPar -\sphinxstyleemphasis{target\_principal} can also include back\sphinxhyphen{}references to \sphinxstyleemphasis{principal}, -in which \sphinxcode{\sphinxupquote{*number}} matches the corresponding wildcard in -\sphinxstyleemphasis{principal}. - -\sphinxlineitem{\sphinxstyleemphasis{restrictions}} -\sphinxAtStartPar -(Optional) A string of flags. Allowed restrictions are: -\begin{quote} -\begin{description} -\sphinxlineitem{\{+|\sphinxhyphen{}\}\sphinxstyleemphasis{flagname}} -\sphinxAtStartPar -flag is forced to the indicated value. The permissible flags -are the same as those for the \sphinxstylestrong{default\_principal\_flags} -variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - -\sphinxlineitem{\sphinxstyleemphasis{\sphinxhyphen{}clearpolicy}} -\sphinxAtStartPar -policy is forced to be empty. - -\sphinxlineitem{\sphinxstyleemphasis{\sphinxhyphen{}policy pol}} -\sphinxAtStartPar -policy is forced to be \sphinxstyleemphasis{pol}. - -\sphinxlineitem{\sphinxhyphen{}\{\sphinxstyleemphasis{expire, pwexpire, maxlife, maxrenewlife}\} \sphinxstyleemphasis{time}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) associated value will be forced to -MIN(\sphinxstyleemphasis{time}, requested value). - -\end{description} -\end{quote} - -\sphinxAtStartPar -The above flags act as restrictions on any add or modify operation -which is allowed due to that ACL line. - -\end{description} - -\begin{sphinxadmonition}{warning}{Warning:} -\sphinxAtStartPar -If the kadmind ACL file is modified, the kadmind daemon needs to be -restarted for changes to take effect. -\end{sphinxadmonition} - - -\subsubsection{EXAMPLE} -\label{\detokenize{admin/conf_files/kadm5_acl:example}} -\sphinxAtStartPar -Here is an example of a kadm5.acl file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{o}{*}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{*} \PYG{c+c1}{\PYGZsh{} line 1} -\PYG{n}{joeadmin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{ADMCIL} \PYG{c+c1}{\PYGZsh{} line 2} -\PYG{n}{joeadmin}\PYG{o}{/}\PYG{o}{*}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{i} \PYG{o}{*}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{c+c1}{\PYGZsh{} line 3} -\PYG{o}{*}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{ci} \PYG{o}{*}\PYG{l+m+mi}{1}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{c+c1}{\PYGZsh{} line 4} -\PYG{o}{*}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{l} \PYG{o}{*} \PYG{c+c1}{\PYGZsh{} line 5} -\PYG{n}{sms}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{x} \PYG{o}{*} \PYG{o}{\PYGZhy{}}\PYG{n}{maxlife} \PYG{l+m+mi}{9}\PYG{n}{h} \PYG{o}{\PYGZhy{}}\PYG{n}{postdateable} \PYG{c+c1}{\PYGZsh{} line 6} -\end{sphinxVerbatim} - -\sphinxAtStartPar -(line 1) Any principal in the \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} realm with an -\sphinxcode{\sphinxupquote{admin}} instance has all administrative privileges except extracting -keys. - -\sphinxAtStartPar -(lines 1\sphinxhyphen{}3) The user \sphinxcode{\sphinxupquote{joeadmin}} has all permissions except -extracting keys with his \sphinxcode{\sphinxupquote{admin}} instance, -\sphinxcode{\sphinxupquote{joeadmin/admin@ATHENA.MIT.EDU}} (matches line 1). He has no -permissions at all with his null instance, \sphinxcode{\sphinxupquote{joeadmin@ATHENA.MIT.EDU}} -(matches line 2). His \sphinxcode{\sphinxupquote{root}} and other non\sphinxhyphen{}\sphinxcode{\sphinxupquote{admin}}, non\sphinxhyphen{}null -instances (e.g., \sphinxcode{\sphinxupquote{extra}} or \sphinxcode{\sphinxupquote{dbadmin}}) have inquire permissions -with any principal that has the instance \sphinxcode{\sphinxupquote{root}} (matches line 3). - -\sphinxAtStartPar -(line 4) Any \sphinxcode{\sphinxupquote{root}} principal in \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} can inquire -or change the password of their null instance, but not any other -null instance. (Here, \sphinxcode{\sphinxupquote{*1}} denotes a back\sphinxhyphen{}reference to the -component matching the first wildcard in the actor principal.) - -\sphinxAtStartPar -(line 5) Any \sphinxcode{\sphinxupquote{root}} principal in \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} can generate -the list of principals in the database, and the list of policies -in the database. This line is separate from line 4, because list -permission can only be granted globally, not to specific target -principals. - -\sphinxAtStartPar -(line 6) Finally, the Service Management System principal -\sphinxcode{\sphinxupquote{sms@ATHENA.MIT.EDU}} has all permissions except extracting keys, but -any principal that it creates or modifies will not be able to get -postdateable tickets or tickets with a life of longer than 9 hours. - - -\subsubsection{MODULE BEHAVIOR} -\label{\detokenize{admin/conf_files/kadm5_acl:module-behavior}} -\sphinxAtStartPar -The ACL file can coexist with other authorization modules in release -1.16 and later, as configured in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:kadm5-auth}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5\_auth interface}}}} section of -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. The ACL file will positively authorize -operations according to the rules above, but will never -authoritatively deny an operation, so other modules can authorize -operations in addition to those authorized by the ACL file. - -\sphinxAtStartPar -To operate without an ACL file, set the \sphinxstyleemphasis{acl\_file} variable in -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} to the empty string with \sphinxcode{\sphinxupquote{acl\_file = ""}}. - - -\subsubsection{SEE ALSO} -\label{\detokenize{admin/conf_files/kadm5_acl:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} - -\sphinxstepscope - - -\chapter{Realm configuration decisions} -\label{\detokenize{admin/realm_config:realm-configuration-decisions}}\label{\detokenize{admin/realm_config::doc}} -\sphinxAtStartPar -Before installing Kerberos V5, it is necessary to consider the -following issues: -\begin{itemize} -\item {} -\sphinxAtStartPar -The name of your Kerberos realm (or the name of each realm, if you -need more than one). - -\item {} -\sphinxAtStartPar -How you will assign your hostnames to Kerberos realms. - -\item {} -\sphinxAtStartPar -Which ports your KDC and and kadmind services will use, if they will -not be using the default ports. - -\item {} -\sphinxAtStartPar -How many replica KDCs you need and where they should be located. - -\item {} -\sphinxAtStartPar -The hostnames of your primary and replica KDCs. - -\item {} -\sphinxAtStartPar -How frequently you will propagate the database from the primary KDC -to the replica KDCs. - -\end{itemize} - - -\section{Realm name} -\label{\detokenize{admin/realm_config:realm-name}} -\sphinxAtStartPar -Although your Kerberos realm can be any ASCII string, convention is to -make it the same as your domain name, in upper\sphinxhyphen{}case letters. - -\sphinxAtStartPar -For example, hosts in the domain \sphinxcode{\sphinxupquote{example.com}} would be in the -Kerberos realm: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If you need multiple Kerberos realms, MIT recommends that you use -descriptive names which end with your domain name, such as: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{BOSTON}\PYG{o}{.}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{HOUSTON}\PYG{o}{.}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\end{sphinxVerbatim} - - -\section{Mapping hostnames onto Kerberos realms} -\label{\detokenize{admin/realm_config:mapping-hostnames-onto-kerberos-realms}}\label{\detokenize{admin/realm_config:mapping-hostnames}} -\sphinxAtStartPar -Mapping hostnames onto Kerberos realms is done in one of three ways. - -\sphinxAtStartPar -The first mechanism works through a set of rules in the -{\hyperref[\detokenize{admin/conf_files/krb5_conf:domain-realm}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}domain\_realm{]}}}}} section of {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. You can specify -mappings for an entire domain or on a per\sphinxhyphen{}hostname basis. Typically -you would do this by specifying the mappings for a given domain or -subdomain and listing the exceptions. - -\sphinxAtStartPar -The second mechanism is to use KDC host\sphinxhyphen{}based service referrals. With -this method, the KDC’s krb5.conf has a full {[}domain\_realm{]} mapping for -hosts, but the clients do not, or have mappings for only a subset of -the hosts they might contact. When a client needs to contact a server -host for which it has no mapping, it will ask the client realm’s KDC -for the service ticket, and will receive a referral to the appropriate -service realm. - -\sphinxAtStartPar -To use referrals, clients must be running MIT krb5 1.6 or later, and -the KDC must be running MIT krb5 1.7 or later. The -\sphinxstylestrong{host\_based\_services} and \sphinxstylestrong{no\_host\_referral} variables in the -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section of {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} can be used to -fine\sphinxhyphen{}tune referral behavior on the KDC. - -\sphinxAtStartPar -It is also possible for clients to use DNS TXT records, if -\sphinxstylestrong{dns\_lookup\_realm} is enabled in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. Such lookups -are disabled by default because DNS is an insecure protocol and security -holes could result if DNS records are spoofed. If enabled, the client -will try to look up a TXT record formed by prepending the prefix -\sphinxcode{\sphinxupquote{\_kerberos}} to the hostname in question. If that record is not -found, the client will attempt a lookup by prepending \sphinxcode{\sphinxupquote{\_kerberos}} to the -host’s domain name, then its parent domain, up to the top\sphinxhyphen{}level domain. -For the hostname \sphinxcode{\sphinxupquote{boston.engineering.example.com}}, the names looked up -would be: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{boston}\PYG{o}{.}\PYG{n}{engineering}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} -\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{engineering}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} -\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} -\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{com} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The value of the first TXT record found is taken as the realm name. - -\sphinxAtStartPar -Even if you do not choose to use this mechanism within your site, -you may wish to set it up anyway, for use when interacting with other sites. - - -\section{Ports for the KDC and admin services} -\label{\detokenize{admin/realm_config:ports-for-the-kdc-and-admin-services}} -\sphinxAtStartPar -The default ports used by Kerberos are port 88 for the KDC and port -749 for the admin server. You can, however, choose to run on other -ports, as long as they are specified in each host’s -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} files or in DNS SRV records, and the -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file on each KDC. For a more thorough treatment of -port numbers used by the Kerberos V5 programs, refer to the -{\hyperref[\detokenize{admin/appl_servers:conf-firewall}]{\sphinxcrossref{\DUrole{std,std-ref}{Configuring your firewall to work with Kerberos V5}}}}. - - -\section{Replica KDCs} -\label{\detokenize{admin/realm_config:replica-kdcs}} -\sphinxAtStartPar -Replica KDCs provide an additional source of Kerberos ticket\sphinxhyphen{}granting -services in the event of inaccessibility of the primary KDC. The -number of replica KDCs you need and the decision of where to place them, -both physically and logically, depends on the specifics of your -network. - -\sphinxAtStartPar -Kerberos authentication requires that each client be able to contact a -KDC. Therefore, you need to anticipate any likely reason a KDC might -be unavailable and have a replica KDC to take up the slack. - -\sphinxAtStartPar -Some considerations include: -\begin{itemize} -\item {} -\sphinxAtStartPar -Have at least one replica KDC as a backup, for when the primary KDC -is down, is being upgraded, or is otherwise unavailable. - -\item {} -\sphinxAtStartPar -If your network is split such that a network outage is likely to -cause a network partition (some segment or segments of the network -to become cut off or isolated from other segments), have a replica -KDC accessible to each segment. - -\item {} -\sphinxAtStartPar -If possible, have at least one replica KDC in a different building -from the primary, in case of power outages, fires, or other -localized disasters. - -\end{itemize} - - -\section{Hostnames for KDCs} -\label{\detokenize{admin/realm_config:hostnames-for-kdcs}}\label{\detokenize{admin/realm_config:kdc-hostnames}} -\sphinxAtStartPar -MIT recommends that your KDCs have a predefined set of CNAME records -(DNS hostname aliases), such as \sphinxcode{\sphinxupquote{kerberos}} for the primary KDC and -\sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1}}, \sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}2}}, … for the replica KDCs. This way, -if you need to swap a machine, you only need to change a DNS entry, -rather than having to change hostnames. - -\sphinxAtStartPar -As of MIT krb5 1.4, clients can locate a realm’s KDCs through DNS -using SRV records (\index{RFC@\spxentry{RFC}!RFC 2782@\spxentry{RFC 2782}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc2782.html}{\sphinxstylestrong{RFC 2782}}), assuming the Kerberos realm name is -also a DNS domain name. These records indicate the hostname and port -number to contact for that service, optionally with weighting and -prioritization. The domain name used in the SRV record name is the -realm name. Several different Kerberos\sphinxhyphen{}related service names are -used: -\begin{description} -\sphinxlineitem{\_kerberos.\_udp} -\sphinxAtStartPar -This is for contacting any KDC by UDP. This entry will be used -the most often. Normally you should list port 88 on each of your -KDCs. - -\sphinxlineitem{\_kerberos.\_tcp} -\sphinxAtStartPar -This is for contacting any KDC by TCP. Normally you should use -port 88. This entry should be omitted if the KDC does not listen -on TCP ports, as was the default prior to release 1.13. - -\sphinxlineitem{\_kerberos\sphinxhyphen{}master.\_udp} -\sphinxAtStartPar -This entry should refer to those KDCs, if any, that will -immediately see password changes to the Kerberos database. If a -user is logging in and the password appears to be incorrect, the -client will retry with the primary KDC before failing with an -“incorrect password” error given. - -\sphinxAtStartPar -If you have only one KDC, or for whatever reason there is no -accessible KDC that would get database changes faster than the -others, you do not need to define this entry. - -\sphinxlineitem{\_kerberos\sphinxhyphen{}adm.\_tcp} -\sphinxAtStartPar -This should list port 749 on your primary KDC. Support for it is -not complete at this time, but it will eventually be used by the -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} program and related utilities. For now, you will -also need the \sphinxstylestrong{admin\_server} variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. - -\sphinxlineitem{\_kerberos\sphinxhyphen{}master.\_tcp} -\sphinxAtStartPar -The corresponding TCP port for \_kerberos\sphinxhyphen{}master.\_udp, assuming the -primary KDC listens on a TCP port. - -\sphinxlineitem{\_kpasswd.\_udp} -\sphinxAtStartPar -This entry should list port 464 on your primary KDC. It is used -when a user changes her password. If this entry is not defined -but a \_kerberos\sphinxhyphen{}adm.\_tcp entry is defined, the client will use the -\_kerberos\sphinxhyphen{}adm.\_tcp entry with the port number changed to 464. - -\sphinxlineitem{\_kpasswd.\_tcp} -\sphinxAtStartPar -The corresponding TCP port for \_kpasswd.\_udp. - -\end{description} - -\sphinxAtStartPar -The DNS SRV specification requires that the hostnames listed be the -canonical names, not aliases. So, for example, you might include the -following records in your (BIND\sphinxhyphen{}style) zone file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{}ORIGIN foobar.com. -\PYGZus{}kerberos TXT \PYGZdq{}FOOBAR.COM\PYGZdq{} -kerberos CNAME daisy -kerberos\PYGZhy{}1 CNAME use\PYGZhy{}the\PYGZhy{}force\PYGZhy{}luke -kerberos\PYGZhy{}2 CNAME bunny\PYGZhy{}rabbit -\PYGZus{}kerberos.\PYGZus{}udp SRV 0 0 88 daisy - SRV 0 0 88 use\PYGZhy{}the\PYGZhy{}force\PYGZhy{}luke - SRV 0 0 88 bunny\PYGZhy{}rabbit -\PYGZus{}kerberos\PYGZhy{}master.\PYGZus{}udp SRV 0 0 88 daisy -\PYGZus{}kerberos\PYGZhy{}adm.\PYGZus{}tcp SRV 0 0 749 daisy -\PYGZus{}kpasswd.\PYGZus{}udp SRV 0 0 464 daisy -\end{sphinxVerbatim} - -\sphinxAtStartPar -Clients can also be configured with the explicit location of services -using the \sphinxstylestrong{kdc}, \sphinxstylestrong{master\_kdc}, \sphinxstylestrong{admin\_server}, and -\sphinxstylestrong{kpasswd\_server} variables in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section of -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. Even if some clients will be configured with -explicit server locations, providing SRV records will still benefit -unconfigured clients, and be useful for other sites. - -\sphinxAtStartPar -Clients can be configured with the \sphinxstylestrong{sitename} realm variable (new in -release 1.22). If a site name is set, the client first attempts SRV -record lookups with “.*sitename*.\_sites” inserted after the service -and protocol name and before the Kerberos realm. Site\sphinxhyphen{}specific -records may indicate servers more proximal to the client, allowing for -faster access. - - -\section{KDC Discovery} -\label{\detokenize{admin/realm_config:kdc-discovery}}\label{\detokenize{admin/realm_config:id1}} -\sphinxAtStartPar -As of MIT krb5 1.15, clients can also locate KDCs in DNS through URI -records (\index{RFC@\spxentry{RFC}!RFC 7553@\spxentry{RFC 7553}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc7553.html}{\sphinxstylestrong{RFC 7553}}). Limitations with the SRV record format may -result in extra DNS queries in situations where a client must failover -to other transport types, or find a primary server. The URI record -can convey more information about a realm’s KDCs with a single query. - -\sphinxAtStartPar -The client performs a query for the following URI records: -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\_kerberos.REALM}} for finding KDCs. - -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\_kerberos\sphinxhyphen{}adm.REALM}} for finding kadmin services. - -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\_kpasswd.REALM}} for finding password services. - -\end{itemize} - -\sphinxAtStartPar -The URI record includes a priority, weight, and a URI string that -consists of case\sphinxhyphen{}insensitive colon separated fields, in the form -\sphinxcode{\sphinxupquote{scheme:{[}flags{]}:transport:residual}}. -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxstyleemphasis{scheme} defines the registered URI type. It should always be -\sphinxcode{\sphinxupquote{krb5srv}}. - -\item {} -\sphinxAtStartPar -\sphinxstyleemphasis{flags} contains zero or more flag characters. Currently the only -valid flag is \sphinxcode{\sphinxupquote{m}}, which indicates that the record is for a -primary server. - -\item {} -\sphinxAtStartPar -\sphinxstyleemphasis{transport} defines the transport type of the residual URL or -address. Accepted values are \sphinxcode{\sphinxupquote{tcp}}, \sphinxcode{\sphinxupquote{udp}}, or \sphinxcode{\sphinxupquote{kkdcp}} for the -MS\sphinxhyphen{}KKDCP type. - -\item {} -\sphinxAtStartPar -\sphinxstyleemphasis{residual} contains the hostname, IP address, or URL to be -contacted using the specified transport, with an optional port -extension. The MS\sphinxhyphen{}KKDCP transport type uses a HTTPS URL, and can -include a port and/or path extension. - -\end{itemize} - -\sphinxAtStartPar -An example of URI records in a zone file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{URI} \PYG{l+m+mi}{10} \PYG{l+m+mi}{1} \PYG{n}{krb5srv}\PYG{p}{:}\PYG{n}{m}\PYG{p}{:}\PYG{n}{tcp}\PYG{p}{:}\PYG{n}{kdc1}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} - \PYG{n}{URI} \PYG{l+m+mi}{20} \PYG{l+m+mi}{1} \PYG{n}{krb5srv}\PYG{p}{:}\PYG{n}{m}\PYG{p}{:}\PYG{n}{udp}\PYG{p}{:}\PYG{n}{kdc2}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com}\PYG{p}{:}\PYG{l+m+mi}{89} - \PYG{n}{URI} \PYG{l+m+mi}{40} \PYG{l+m+mi}{1} \PYG{n}{krb5srv}\PYG{p}{:}\PYG{p}{:}\PYG{n}{udp}\PYG{p}{:}\PYG{l+m+mf}{10.10}\PYG{l+m+mf}{.0}\PYG{l+m+mf}{.23} - \PYG{n}{URI} \PYG{l+m+mi}{30} \PYG{l+m+mi}{1} \PYG{n}{krb5srv}\PYG{p}{:}\PYG{p}{:}\PYG{n}{kkdcp}\PYG{p}{:}\PYG{n}{https}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{proxy}\PYG{p}{:}\PYG{l+m+mi}{89}\PYG{o}{/}\PYG{n}{auth} -\end{sphinxVerbatim} - -\sphinxAtStartPar -URI lookups are enabled by default, and can be disabled by setting -\sphinxstylestrong{dns\_uri\_lookup} in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} section of -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} to False. When enabled, URI lookups take -precedence over SRV lookups, falling back to SRV lookups if no URI -records are found. - -\sphinxAtStartPar -The \sphinxstylestrong{sitename} variable in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section of -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} applies to URI lookups as well as SRV lookups. - - -\section{Database propagation} -\label{\detokenize{admin/realm_config:database-propagation}}\label{\detokenize{admin/realm_config:db-prop}} -\sphinxAtStartPar -The Kerberos database resides on the primary KDC, and must be -propagated regularly (usually by a cron job) to the replica KDCs. In -deciding how frequently the propagation should happen, you will need -to balance the amount of time the propagation takes against the -maximum reasonable amount of time a user should have to wait for a -password change to take effect. - -\sphinxAtStartPar -If the propagation time is longer than this maximum reasonable time -(e.g., you have a particularly large database, you have a lot of -replicas, or you experience frequent network delays), you may wish to -cut down on your propagation delay by performing the propagation in -parallel. To do this, have the primary KDC propagate the database to -one set of replicas, and then have each of these replicas propagate -the database to additional replicas. - -\sphinxAtStartPar -See also {\hyperref[\detokenize{admin/database:incr-db-prop}]{\sphinxcrossref{\DUrole{std,std-ref}{Incremental database propagation}}}} - -\sphinxstepscope - - -\chapter{Database administration} -\label{\detokenize{admin/database:database-administration}}\label{\detokenize{admin/database::doc}} -\sphinxAtStartPar -A Kerberos database contains all of a realm’s Kerberos principals, -their passwords, and other administrative information about each -principal. For the most part, you will use the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} -program to manipulate the Kerberos database as a whole, and the -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} program to make changes to the entries in the -database. (One notable exception is that users will use the -\DUrole{xref,std,std-ref}{kpasswd(1)} program to change their own passwords.) The kadmin -program has its own command\sphinxhyphen{}line interface, to which you type the -database administrating commands. - -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} provides a means to create, delete, load, or dump -a Kerberos database. It also contains commands to roll over the -database master key, and to stash a copy of the key so that the -{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} and {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemons can use the database -without manual input. - -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} provides for the maintenance of Kerberos principals, -password policies, and service key tables (keytabs). Normally it -operates as a network client using Kerberos authentication to -communicate with {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}}, but there is also a variant, named -kadmin.local, which directly accesses the Kerberos database on the -local filesystem (or through LDAP). kadmin.local is necessary to set -up enough of the database to be able to use the remote version. - -\sphinxAtStartPar -kadmin can authenticate to the admin server using the service -principal \sphinxcode{\sphinxupquote{kadmin/admin}} or \sphinxcode{\sphinxupquote{kadmin/HOST}} (where \sphinxstyleemphasis{HOST} is the -hostname of the admin server). If the credentials cache contains a -ticket for either service principal and the \sphinxstylestrong{\sphinxhyphen{}c} ccache option is -specified, that ticket is used to authenticate to KADM5. Otherwise, -the \sphinxstylestrong{\sphinxhyphen{}p} and \sphinxstylestrong{\sphinxhyphen{}k} options are used to specify the client Kerberos -principal name used to authenticate. Once kadmin has determined the -principal name, it requests a \sphinxcode{\sphinxupquote{kadmin/admin}} Kerberos service ticket -from the KDC, and uses that service ticket to authenticate to KADM5. - -\sphinxAtStartPar -See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for the available kadmin and kadmin.local -commands and options. - - -\section{Principals} -\label{\detokenize{admin/database:principals}}\label{\detokenize{admin/database:id1}} -\sphinxAtStartPar -Each entry in the Kerberos database contains a Kerberos principal and -the attributes and policies associated with that principal. - -\sphinxAtStartPar -To add a principal to the database, use the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} -\sphinxstylestrong{add\_principal} command. User principals should usually be created -with the \sphinxcode{\sphinxupquote{+requires\_preauth \sphinxhyphen{}allow\_svr}} options to help mitigate -dictionary attacks (see {\hyperref[\detokenize{admin/dictionary:dictionary}]{\sphinxcrossref{\DUrole{std,std-ref}{Addressing dictionary attack risks}}}}): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}svr} \PYG{n}{alice} -\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{alice@KRBTEST.COM}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{alice@KRBTEST.COM}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\end{sphinxVerbatim} - -\sphinxAtStartPar -User principals which will authenticate with {\hyperref[\detokenize{admin/pkinit:pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{PKINIT configuration}}}} should -instead by created with the \sphinxcode{\sphinxupquote{\sphinxhyphen{}nokey}} option: -\begin{quote} - -\sphinxAtStartPar -kadmin: addprinc \sphinxhyphen{}nokey alice -\end{quote} - -\sphinxAtStartPar -Service principals can be created with the \sphinxcode{\sphinxupquote{\sphinxhyphen{}nokey}} option; -long\sphinxhyphen{}term keys will be added when a keytab is generated: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{nokey} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{n}{foo}\PYG{o}{.}\PYG{n}{keytab} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -To modify attributes of an existing principal, use the kadmin -\sphinxstylestrong{modify\_principal} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{expire} \PYG{n}{tomorrow} \PYG{n}{alice} -\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{alice@KRBTEST.COM}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{modified}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -To delete a principal, use the kadmin \sphinxstylestrong{delete\_principal} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -kadmin: delprinc alice -Are you sure you want to delete the principal \PYGZdq{}alice@KRBTEST.COM\PYGZdq{}? (yes/no): yes -Principal \PYGZdq{}alice@KRBTEST.COM\PYGZdq{} deleted. -Make sure that you have removed this principal from all ACLs before reusing. -\end{sphinxVerbatim} - -\sphinxAtStartPar -To change a principal’s password, use the kadmin \sphinxstylestrong{change\_password} -command. Password changes made through kadmin are subject to the same -password policies as would apply to password changes made through -\DUrole{xref,std,std-ref}{kpasswd(1)}. - -\sphinxAtStartPar -To view the attributes of a principal, use the kadmin\textasciigrave{} -\sphinxstylestrong{get\_principal} command. - -\sphinxAtStartPar -To generate a listing of principals, use the kadmin -\sphinxstylestrong{list\_principals} command. - -\sphinxAtStartPar -To give a principal additional names, use the kadmin \sphinxstylestrong{add\_alias} -command to create aliases to the principal (new in release 1.22). -Aliases can be removed with the \sphinxstylestrong{delete\_principal} command. - - -\section{Policies} -\label{\detokenize{admin/database:policies}}\label{\detokenize{admin/database:id2}} -\sphinxAtStartPar -A policy is a set of rules governing passwords. Policies can dictate -minimum and maximum password lifetimes, minimum number of characters -and character classes a password must contain, and the number of old -passwords kept in the database. - -\sphinxAtStartPar -To add a new policy, use the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{add\_policy} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addpol} \PYG{o}{\PYGZhy{}}\PYG{n}{maxlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{1 year}\PYG{l+s+s2}{\PYGZdq{}} \PYG{o}{\PYGZhy{}}\PYG{n}{history} \PYG{l+m+mi}{3} \PYG{n}{stduser} -\end{sphinxVerbatim} - -\sphinxAtStartPar -To modify attributes of a principal, use the kadmin \sphinxstylestrong{modify\_policy} -command. To delete a policy, use the kadmin \sphinxstylestrong{delete\_policy} -command. - -\sphinxAtStartPar -To associate a policy with a principal, use the kadmin -\sphinxstylestrong{modify\_principal} command with the \sphinxstylestrong{\sphinxhyphen{}policy} option: -\begin{quote} - -\sphinxAtStartPar -kadmin: modprinc \sphinxhyphen{}policy stduser alice -Principal “\sphinxhref{mailto:alice@KRBTEST.COM}{alice@KRBTEST.COM}” modified. -\end{quote} - -\sphinxAtStartPar -A principal entry may be associated with a nonexistent policy, either -because the policy did not exist at the time of associated or was -deleted afterwards. kadmin will warn when associated a principal with -a nonexistent policy, and will annotate the policy name with “{[}does -not exist{]}” in the \sphinxstylestrong{get\_principal} output. - - -\subsection{Updating the history key} -\label{\detokenize{admin/database:updating-the-history-key}}\label{\detokenize{admin/database:updating-history-key}} -\sphinxAtStartPar -If a policy specifies a number of old keys kept of two or more, the -stored old keys are encrypted in a history key, which is found in the -key data of the \sphinxcode{\sphinxupquote{kadmin/history}} principal. - -\sphinxAtStartPar -Currently there is no support for proper rollover of the history key, -but you can change the history key (for example, to use a better -encryption type) at the cost of invalidating currently stored old -keys. To change the history key, run: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{change\PYGZus{}password} \PYG{o}{\PYGZhy{}}\PYG{n}{randkey} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{history} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This command will fail if you specify the \sphinxstylestrong{\sphinxhyphen{}keepold} flag. Only one -new history key will be created, even if you specify multiple key/salt -combinations. - -\sphinxAtStartPar -In the future, we plan to migrate towards encrypting old keys in the -master key instead of the history key, and implementing proper -rollover support for stored old keys. - - -\section{Privileges} -\label{\detokenize{admin/database:privileges}}\label{\detokenize{admin/database:id3}} -\sphinxAtStartPar -Administrative privileges for the Kerberos database are stored in the -file {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -A common use of an admin instance is so you can grant -separate permissions (such as administrator access to the -Kerberos database) to a separate Kerberos principal. For -example, the user \sphinxcode{\sphinxupquote{joeadmin}} might have a principal for -his administrative use, called \sphinxcode{\sphinxupquote{joeadmin/admin}}. This -way, \sphinxcode{\sphinxupquote{joeadmin}} would obtain \sphinxcode{\sphinxupquote{joeadmin/admin}} tickets -only when he actually needs to use those permissions. -\end{sphinxadmonition} - - -\section{Operations on the Kerberos database} -\label{\detokenize{admin/database:operations-on-the-kerberos-database}}\label{\detokenize{admin/database:db-operations}} -\sphinxAtStartPar -The {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} command is the primary tool for administrating -the Kerberos database when using the DB2 or LMDB modules (see -{\hyperref[\detokenize{admin/dbtypes:dbtypes}]{\sphinxcrossref{\DUrole{std,std-ref}{Database types}}}}). Creating a database is described in -{\hyperref[\detokenize{admin/install_kdc:create-db}]{\sphinxcrossref{\DUrole{std,std-ref}{Create the KDC database}}}}. - -\sphinxAtStartPar -To create a stash file using the master password (because the database -was not created with one using the \sphinxcode{\sphinxupquote{create \sphinxhyphen{}s}} flag, or after -restoring from a backup which did not contain the stash file), use the -kdb5\_util \sphinxstylestrong{stash} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}util stash -kdb5\PYGZus{}util: Cannot find/read stored master key while reading master key -kdb5\PYGZus{}util: Warning: proceeding without master key -Enter KDC database master key: \PYGZlt{}= Type the KDC database master password. -\end{sphinxVerbatim} - -\sphinxAtStartPar -To destroy a database, use the kdb5\_util destroy command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}util destroy -Deleting KDC database stored in \PYGZsq{}/var/krb5kdc/principal\PYGZsq{}, are you sure? -(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes -OK, deleting database \PYGZsq{}/var/krb5kdc/principal\PYGZsq{}... -** Database \PYGZsq{}/var/krb5kdc/principal\PYGZsq{} destroyed. -\end{sphinxVerbatim} - - -\subsection{Dumping and loading a Kerberos database} -\label{\detokenize{admin/database:dumping-and-loading-a-kerberos-database}}\label{\detokenize{admin/database:restore-from-dump}} -\sphinxAtStartPar -To dump a Kerberos database into a text file for backup or transfer -purposes, use the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} \sphinxstylestrong{dump} command on one of the -KDCs: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}util dump dumpfile - -\PYGZdl{} kbd5\PYGZus{}util dump \PYGZhy{}verbose dumpfile -kadmin/admin@ATHENA.MIT.EDU -krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU -kadmin/history@ATHENA.MIT.EDU -K/M@ATHENA.MIT.EDU -kadmin/changepw@ATHENA.MIT.EDU -\end{sphinxVerbatim} - -\sphinxAtStartPar -You may specify which principals to dump, using full principal names -including realm: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}util dump \PYGZhy{}verbose someprincs K/M@ATHENA.MIT.EDU kadmin/admin@ATHENA.MIT.EDU -kadmin/admin@ATHENA.MIT.EDU -K/M@ATHENA.MIT.EDU -\end{sphinxVerbatim} - -\sphinxAtStartPar -To restore a Kerberos database dump from a file, use the -{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} \sphinxstylestrong{load} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}util load dumpfile -\end{sphinxVerbatim} - -\sphinxAtStartPar -To update an existing database with a partial dump file containing -only some principals, use the \sphinxcode{\sphinxupquote{\sphinxhyphen{}update}} flag: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}util load \PYGZhy{}update someprincs -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If the database file exists, and the \sphinxstyleemphasis{\sphinxhyphen{}update} flag was not -given, \sphinxstyleemphasis{kdb5\_util} will overwrite the existing database. -\end{sphinxadmonition} - - -\subsection{Updating the master key} -\label{\detokenize{admin/database:updating-the-master-key}}\label{\detokenize{admin/database:updating-master-key}} -\sphinxAtStartPar -Starting with release 1.7, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} allows the master key -to be changed using a rollover process, with minimal loss of -availability. To roll over the master key, follow these steps: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util list\_mkeys}} to view the -current master key version number (KVNO). If you have never rolled -over the master key before, this will likely be version 1: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}util list\PYGZus{}mkeys -Master keys for Principal: K/M@KRBTEST.COM -KVNO: 1, Enctype: aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha384\PYGZhy{}192, Active on: Thu Jan 01 00:00:00 UTC 1970 * -\end{sphinxVerbatim} - -\item {} -\sphinxAtStartPar -On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util use\_mkey 1}} to ensure that a -master key activation list is present in the database. This step -is unnecessary in release 1.11.4 or later, or if the database was -initially created with release 1.7 or later. - -\item {} -\sphinxAtStartPar -On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util add\_mkey \sphinxhyphen{}s}} to create a new -master key and write it to the stash file. Enter a secure password -when prompted. If this is the first time you are changing the -master key, the new key will have version 2. The new master key -will not be used until you make it active. - -\item {} -\sphinxAtStartPar -Propagate the database to all replica KDCs, either manually or by -waiting until the next scheduled propagation. If you do not have -any replica KDCs, you can skip this and the next step. - -\item {} -\sphinxAtStartPar -On each replica KDC, run \sphinxcode{\sphinxupquote{kdb5\_util list\_mkeys}} to verify that -the new master key is present, and then \sphinxcode{\sphinxupquote{kdb5\_util stash}} to -write the new master key to the replica KDC’s stash file. - -\item {} -\sphinxAtStartPar -On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util use\_mkey 2}} to begin using the -new master key. Replace \sphinxcode{\sphinxupquote{2}} with the version of the new master -key, as appropriate. You can optionally specify a date for the new -master key to become active; by default, it will become active -immediately. Prior to release 1.12, {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} must be -restarted for this change to take full effect. - -\item {} -\sphinxAtStartPar -On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util update\_princ\_encryption}}. -This command will iterate over the database and re\sphinxhyphen{}encrypt all keys -in the new master key. If the database is large and uses DB2, the -primary KDC will become unavailable while this command runs, but -clients should fail over to replica KDCs (if any are present) -during this time period. In release 1.13 and later, you can -instead run \sphinxcode{\sphinxupquote{kdb5\_util \sphinxhyphen{}x unlockiter update\_princ\_encryption}} to -use unlocked iteration; this variant will take longer, but will -keep the database available to the KDC and kadmind while it runs. - -\item {} -\sphinxAtStartPar -Wait until the above changes have propagated to all replica KDCs -and until all running KDC and kadmind processes have serviced -requests using updated principal entries. - -\item {} -\sphinxAtStartPar -On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util purge\_mkeys}} to clean up the -old master key. - -\end{enumerate} - - -\section{Operations on the LDAP database} -\label{\detokenize{admin/database:operations-on-the-ldap-database}}\label{\detokenize{admin/database:ops-on-ldap}} -\sphinxAtStartPar -The {\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}} command is the primary tool for -administrating the Kerberos database when using the LDAP module. -Creating an LDAP Kerberos database is describe in {\hyperref[\detokenize{admin/conf_ldap:conf-ldap}]{\sphinxcrossref{\DUrole{std,std-ref}{Configuring Kerberos with OpenLDAP back\sphinxhyphen{}end}}}}. - -\sphinxAtStartPar -To view a list of realms in the LDAP database, use the kdb5\_ldap\_util -\sphinxstylestrong{list} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util list -KRBTEST.COM -\end{sphinxVerbatim} - -\sphinxAtStartPar -To modify the attributes of a realm, use the kdb5\_ldap\_util \sphinxstylestrong{modify} -command. For example, to change the default realm’s maximum ticket -life: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util modify \PYGZhy{}maxtktlife \PYGZdq{}10 hours\PYGZdq{} -\end{sphinxVerbatim} - -\sphinxAtStartPar -To display the attributes of a realm, use the kdb5\_ldap\_util \sphinxstylestrong{view} -command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util view - Realm Name: KRBTEST.COM - Maximum Ticket Life: 0 days 00:10:00 -\end{sphinxVerbatim} - -\sphinxAtStartPar -To remove a realm from the LDAP database, destroying its contents, use -the kdb5\_ldap\_util \sphinxstylestrong{destroy} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util destroy -Deleting KDC database of \PYGZsq{}KRBTEST.COM\PYGZsq{}, are you sure? -(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes -OK, deleting database of \PYGZsq{}KRBTEST.COM\PYGZsq{}... -** Database of \PYGZsq{}KRBTEST.COM\PYGZsq{} destroyed. -\end{sphinxVerbatim} - - -\subsection{Ticket Policy operations} -\label{\detokenize{admin/database:ticket-policy-operations}} -\sphinxAtStartPar -Unlike the DB2 and LMDB modules, the LDAP module supports ticket -policy objects, which can be associated with principals to restrict -maximum ticket lifetimes and set mandatory principal flags. Ticket -policy objects are distinct from the password policies described -earlier on this page, and are chiefly managed through kdb5\_ldap\_util -rather than kadmin. To create a new ticket policy, use the -kdb5\_ldap\_util \sphinxstylestrong{create\_policy} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util create\PYGZus{}policy \PYGZhy{}maxrenewlife \PYGZdq{}2 days\PYGZdq{} users -\end{sphinxVerbatim} - -\sphinxAtStartPar -To associate a ticket policy with a principal, use the -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{modify\_principal} (or \sphinxstylestrong{add\_principal}) command -with the \sphinxstylestrong{\sphinxhyphen{}x tktpolicy=}\sphinxstyleemphasis{policy} option: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kadmin.local modprinc \PYGZhy{}x tktpolicy=users alice -\end{sphinxVerbatim} - -\sphinxAtStartPar -To remove a ticket policy reference from a principal, use the same -command with an empty \sphinxstyleemphasis{policy}: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kadmin.local modprinc \PYGZhy{}x tktpolicy= alice -\end{sphinxVerbatim} - -\sphinxAtStartPar -To list the existing ticket policy objects, use the kdb5\_ldap\_util -\sphinxstylestrong{list\_policy} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util list\PYGZus{}policy -users -\end{sphinxVerbatim} - -\sphinxAtStartPar -To modify the attributes of a ticket policy object, use the -kdb5\_ldap\_util \sphinxstylestrong{modify\_policy} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util modify\PYGZus{}policy \PYGZhy{}allow\PYGZus{}svr +requires\PYGZus{}preauth users -\end{sphinxVerbatim} - -\sphinxAtStartPar -To view the attributes of a ticket policy object, use the -kdb5\_ldap\_util \sphinxstylestrong{view\_policy} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util view\PYGZus{}policy users - Ticket policy: users - Maximum renewable life: 2 days 00:00:00 - Ticket flags: REQUIRES\PYGZus{}PRE\PYGZus{}AUTH DISALLOW\PYGZus{}SVR -\end{sphinxVerbatim} - -\sphinxAtStartPar -To destroy an ticket policy object, use the kdb5\_ldap\_util -\sphinxstylestrong{destroy\_policy} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util destroy\PYGZus{}policy users -This will delete the policy object \PYGZsq{}users\PYGZsq{}, are you sure? -(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes -** policy object \PYGZsq{}users\PYGZsq{} deleted. -\end{sphinxVerbatim} - - -\section{Cross\sphinxhyphen{}realm authentication} -\label{\detokenize{admin/database:cross-realm-authentication}}\label{\detokenize{admin/database:xrealm-authn}} -\sphinxAtStartPar -In order for a KDC in one realm to authenticate Kerberos users in a -different realm, it must share a key with the KDC in the other realm. -In both databases, there must be krbtgt service principals for both realms. -For example, if you need to do cross\sphinxhyphen{}realm authentication between the realms -\sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} and \sphinxcode{\sphinxupquote{EXAMPLE.COM}}, you would need to add the -principals \sphinxcode{\sphinxupquote{krbtgt/EXAMPLE.COM@ATHENA.MIT.EDU}} and -\sphinxcode{\sphinxupquote{krbtgt/ATHENA.MIT.EDU@EXAMPLE.COM}} to both databases. -These principals must all have the same passwords, key version -numbers, and encryption types; this may require explicitly setting -the key version number with the \sphinxstylestrong{\sphinxhyphen{}kvno} option. - -\sphinxAtStartPar -In the ATHENA.MIT.EDU and EXAMPLE.COM cross\sphinxhyphen{}realm case, the administrators -would run the following commands on the KDCs in both realms: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}}\PYG{p}{:} \PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{local} \PYG{o}{\PYGZhy{}}\PYG{n}{e} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{aes256\PYGZhy{}cts:normal}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{requires\PYGZus{}preauth} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} -\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{requires\PYGZus{}preauth} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} -\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Even if most principals in a realm are generally created -with the \sphinxstylestrong{requires\_preauth} flag enabled, this flag is not -desirable on cross\sphinxhyphen{}realm authentication keys because doing -so makes it impossible to disable preauthentication on a -service\sphinxhyphen{}by\sphinxhyphen{}service basis. Disabling it as in the example -above is recommended. -\end{sphinxadmonition} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -It is very important that these principals have good -passwords. MIT recommends that TGT principal passwords be -at least 26 characters of random ASCII text. -\end{sphinxadmonition} - - -\section{Changing the krbtgt key} -\label{\detokenize{admin/database:changing-the-krbtgt-key}}\label{\detokenize{admin/database:changing-krbtgt-key}} -\sphinxAtStartPar -A Kerberos Ticket Granting Ticket (TGT) is a service ticket for the -principal \sphinxcode{\sphinxupquote{krbtgt/REALM}}. The key for this principal is created -when the Kerberos database is initialized and need not be changed. -However, it will only have the encryption types supported by the KDC -at the time of the initial database creation. To allow use of newer -encryption types for the TGT, this key has to be changed. - -\sphinxAtStartPar -Changing this key using the normal {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} -\sphinxstylestrong{change\_password} command would invalidate any previously issued -TGTs. Therefore, when changing this key, normally one should use the -\sphinxstylestrong{\sphinxhyphen{}keepold} flag to change\_password to retain the previous key in the -database as well as the new key. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{change\PYGZus{}password} \PYG{o}{\PYGZhy{}}\PYG{n}{randkey} \PYG{o}{\PYGZhy{}}\PYG{n}{keepold} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{warning}{Warning:} -\sphinxAtStartPar -After issuing this command, the old key is still valid -and is still vulnerable to (for instance) brute force -attacks. To completely retire an old key or encryption -type, run the kadmin \sphinxstylestrong{purgekeys} command to delete keys -with older kvnos, ideally first making sure that all -tickets issued with the old keys have expired. -\end{sphinxadmonition} - -\sphinxAtStartPar -Only the first krbtgt key of the newest key version is used to encrypt -ticket\sphinxhyphen{}granting tickets. However, the set of encryption types present -in the krbtgt keys is used by default to determine the session key -types supported by the krbtgt service (see -{\hyperref[\detokenize{admin/enctypes:session-key-selection}]{\sphinxcrossref{\DUrole{std,std-ref}{Session key selection}}}}). Because non\sphinxhyphen{}MIT Kerberos clients -sometimes send a limited set of encryption types when making AS -requests, it can be important for the krbtgt service to support -multiple encryption types. This can be accomplished by giving the -krbtgt principal multiple keys, which is usually as simple as not -specifying any \sphinxstylestrong{\sphinxhyphen{}e} option when changing the krbtgt key, or by -setting the \sphinxstylestrong{session\_enctypes} string attribute on the krbtgt -principal (see {\hyperref[\detokenize{admin/admin_commands/kadmin_local:set-string}]{\sphinxcrossref{\DUrole{std,std-ref}{set\_string}}}}). - -\sphinxAtStartPar -Due to a bug in releases 1.8 through 1.13, renewed and forwarded -tickets may not work if the original ticket was obtained prior to a -krbtgt key change and the modified ticket is obtained afterwards. -Upgrading the KDC to release 1.14 or later will correct this bug. - - -\section{Incremental database propagation} -\label{\detokenize{admin/database:incremental-database-propagation}}\label{\detokenize{admin/database:incr-db-prop}} - -\subsection{Overview} -\label{\detokenize{admin/database:overview}} -\sphinxAtStartPar -At some very large sites, dumping and transmitting the database can -take more time than is desirable for changes to propagate from the -primary KDC to the replica KDCs. The incremental propagation support -added in the 1.7 release is intended to address this. - -\sphinxAtStartPar -With incremental propagation enabled, all programs on the primary KDC -that change the database also write information about the changes to -an “update log” file, maintained as a circular buffer of a certain -size. A process on each replica KDC connects to a service on the -primary KDC (currently implemented in the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} server) and -periodically requests the changes that have been made since the last -check. By default, this check is done every two minutes. - -\sphinxAtStartPar -Incremental propagation uses the following entries in the per\sphinxhyphen{}realm -data in the KDC config file (See {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}): - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TTT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -iprop\_enable -& -\sphinxAtStartPar -\sphinxstyleemphasis{boolean} -& -\sphinxAtStartPar -If \sphinxstyleemphasis{true}, then incremental propagation is enabled, and (as noted below) normal kprop propagation is disabled. The default is \sphinxstyleemphasis{false}. -\\ -\sphinxhline -\sphinxAtStartPar -iprop\_master\_ulogsize -& -\sphinxAtStartPar -\sphinxstyleemphasis{integer} -& -\sphinxAtStartPar -Indicates the number of entries that should be retained in the update log. The default is 1000; the maximum number is 2500. -\\ -\sphinxhline -\sphinxAtStartPar -iprop\_replica\_poll -& -\sphinxAtStartPar -\sphinxstyleemphasis{time interval} -& -\sphinxAtStartPar -Indicates how often the replica should poll the primary KDC for changes to the database. The default is two minutes. -\\ -\sphinxhline -\sphinxAtStartPar -iprop\_port -& -\sphinxAtStartPar -\sphinxstyleemphasis{integer} -& -\sphinxAtStartPar -Specifies the port number to be used for incremental propagation. This is required in both primary and replica configuration files. -\\ -\sphinxhline -\sphinxAtStartPar -iprop\_resync\_timeout -& -\sphinxAtStartPar -\sphinxstyleemphasis{integer} -& -\sphinxAtStartPar -Specifies the number of seconds to wait for a full propagation to complete. This is optional on replica configurations. Defaults to 300 seconds (5 minutes). -\\ -\sphinxhline -\sphinxAtStartPar -iprop\_logfile -& -\sphinxAtStartPar -\sphinxstyleemphasis{file name} -& -\sphinxAtStartPar -Specifies where the update log file for the realm database is to be stored. The default is to use the \sphinxstyleemphasis{database\_name} entry from the realms section of the config file {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, with \sphinxstyleemphasis{.ulog} appended. (NOTE: If database\_name isn’t specified in the realms section, perhaps because the LDAP database back end is being used, or the file name is specified in the \sphinxstyleemphasis{dbmodules} section, then the hard\sphinxhyphen{}coded default for \sphinxstyleemphasis{database\_name} is used. Determination of the \sphinxstyleemphasis{iprop\_logfile} default value will not use values from the \sphinxstyleemphasis{dbmodules} section.) -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxAtStartPar -Both primary and replica sides must have a principal named -\sphinxcode{\sphinxupquote{kiprop/hostname}} (where \sphinxstyleemphasis{hostname} is the lowercase, -fully\sphinxhyphen{}qualified, canonical name for the host) registered in the -Kerberos database, and have keys for that principal stored in the -default keytab file ({\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}). The \sphinxcode{\sphinxupquote{kiprop/hostname}} principal may -have been created automatically for the primary KDC, but it must -always be created for replica KDCs. - -\sphinxAtStartPar -On the primary KDC side, the \sphinxcode{\sphinxupquote{kiprop/hostname}} principal must be -listed in the kadmind ACL file {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}, and given the -\sphinxstylestrong{p} privilege (see {\hyperref[\detokenize{admin/database:privileges}]{\sphinxcrossref{\DUrole{std,std-ref}{Privileges}}}}). - -\sphinxAtStartPar -On the replica KDC side, {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} should be run. When -incremental propagation is enabled, it will connect to the kadmind on -the primary KDC and start requesting updates. - -\sphinxAtStartPar -The normal kprop mechanism is disabled by the incremental propagation -support. However, if the replica has been unable to fetch changes -from the primary KDC for too long (network problems, perhaps), the log -on the primary may wrap around and overwrite some of the updates that -the replica has not yet retrieved. In this case, the replica will -instruct the primary KDC to dump the current database out to a file -and invoke a one\sphinxhyphen{}time kprop propagation, with special options to also -convey the point in the update log at which the replica should resume -fetching incremental updates. Thus, all the keytab and ACL setup -previously described for kprop propagation is still needed. - -\sphinxAtStartPar -If an environment has a large number of replicas, it may be desirable -to arrange them in a hierarchy instead of having the primary serve -updates to every replica. To do this, run \sphinxcode{\sphinxupquote{kadmind \sphinxhyphen{}proponly}} on -each intermediate replica, and \sphinxcode{\sphinxupquote{kpropd \sphinxhyphen{}A upstreamhostname}} on -downstream replicas to direct each one to the appropriate upstream -replica. - -\sphinxAtStartPar -There are several known restrictions in the current implementation: -\begin{itemize} -\item {} -\sphinxAtStartPar -The incremental update protocol does not transport changes to policy -objects. Any policy changes on the primary will result in full -resyncs to all replicas. - -\item {} -\sphinxAtStartPar -The replica’s KDB module must support locking; it cannot be using the -LDAP KDB module. - -\item {} -\sphinxAtStartPar -The primary and replica must be able to initiate TCP connections in -both directions, without an intervening NAT. - -\end{itemize} - - -\subsection{Sun/MIT incremental propagation differences} -\label{\detokenize{admin/database:sun-mit-incremental-propagation-differences}} -\sphinxAtStartPar -Sun donated the original code for supporting incremental database -propagation to MIT. Some changes have been made in the MIT source -tree that will be visible to administrators. (These notes are based -on Sun’s patches. Changes to Sun’s implementation since then may not -be reflected here.) - -\sphinxAtStartPar -The Sun config file support looks for \sphinxcode{\sphinxupquote{sunw\_dbprop\_enable}}, -\sphinxcode{\sphinxupquote{sunw\_dbprop\_master\_ulogsize}}, and \sphinxcode{\sphinxupquote{sunw\_dbprop\_slave\_poll}}. - -\sphinxAtStartPar -The incremental propagation service is implemented as an ONC RPC -service. In the Sun implementation, the service is registered with -rpcbind (also known as portmapper) and the client looks up the port -number to contact. In the MIT implementation, where interaction with -some modern versions of rpcbind doesn’t always work well, the port -number must be specified in the config file on both the primary and -replica sides. - -\sphinxAtStartPar -The Sun implementation hard\sphinxhyphen{}codes pathnames in \sphinxcode{\sphinxupquote{/var/krb5}} for the -update log and the per\sphinxhyphen{}replica kprop dump files. In the MIT -implementation, the pathname for the update log is specified in the -config file, and the per\sphinxhyphen{}replica dump files are stored in -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/replica\_datatrans\_hostname}}. - -\sphinxstepscope - - -\chapter{Database types} -\label{\detokenize{admin/dbtypes:database-types}}\label{\detokenize{admin/dbtypes:dbtypes}}\label{\detokenize{admin/dbtypes::doc}} -\sphinxAtStartPar -A Kerberos database can be implemented with one of three built\sphinxhyphen{}in -database providers, called KDB modules. Software which incorporates -the MIT krb5 KDC may also provide its own KDB module. The following -subsections describe the three built\sphinxhyphen{}in KDB modules and the -configuration specific to them. - -\sphinxAtStartPar -The database type can be configured with the \sphinxstylestrong{db\_library} variable -in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} subsection for the realm. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{db\PYGZus{}library} \PYG{o}{=} \PYG{n}{db2} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} realm subsection contains a -\sphinxstylestrong{database\_module} setting, then the subsection within -\sphinxcode{\sphinxupquote{{[}dbmodules{]}}} should use that name instead of \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}}. - -\sphinxAtStartPar -To transition from one database type to another, stop the -{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} service, use \sphinxcode{\sphinxupquote{kdb5\_util dump}} to create a dump -file, change the \sphinxstylestrong{db\_library} value and set any appropriate -configuration for the new database type, and use \sphinxcode{\sphinxupquote{kdb5\_util load}} to -create and populate the new database. If the new database type is -LDAP, create the new database using \sphinxcode{\sphinxupquote{kdb5\_ldap\_util}} and populate it -from the dump file using \sphinxcode{\sphinxupquote{kdb5\_util load \sphinxhyphen{}update}}. Then restart the -{\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} and {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} services. - - -\section{Berkeley database module (db2)} -\label{\detokenize{admin/dbtypes:berkeley-database-module-db2}} -\sphinxAtStartPar -The default KDB module is \sphinxcode{\sphinxupquote{db2}}, which uses a version of the -Berkeley DB library. It creates four files based on the database -pathname. If the pathname ends with \sphinxcode{\sphinxupquote{principal}} then the four files -are: -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{principal}}, containing principal entry data - -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{principal.ok}}, a lock file for the principal database - -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{principal.kadm5}}, containing policy object data - -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{principal.kadm5.lock}}, a lock file for the policy database - -\end{itemize} - -\sphinxAtStartPar -For large databases, the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} \sphinxstylestrong{dump} command (perhaps -invoked by {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} or by {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} for incremental -propagation) may cause {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} to stop for a noticeable -period of time while it iterates over the database. This delay can be -avoided by disabling account lockout features so that the KDC does not -perform database writes (see {\hyperref[\detokenize{admin/lockout:disable-lockout}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC performance and account lockout}}}}). Alternatively, -a slower form of iteration can be enabled by setting the -\sphinxstylestrong{unlockiter} variable to \sphinxcode{\sphinxupquote{true}}. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{db\PYGZus{}library} \PYG{o}{=} \PYG{n}{db2} - \PYG{n}{unlockiter} \PYG{o}{=} \PYG{n}{true} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -In rare cases, a power failure or other unclean system shutdown may -cause inconsistencies in the internal pointers within a database file, -such that \sphinxcode{\sphinxupquote{kdb5\_util dump}} cannot retrieve all principal entries in -the database. In this situation, it may be possible to retrieve all -of the principal data by running \sphinxcode{\sphinxupquote{kdb5\_util dump \sphinxhyphen{}recurse}} to -iterate over the database using the tree pointers instead of the -iteration pointers. Running \sphinxcode{\sphinxupquote{kdb5\_util dump \sphinxhyphen{}rev}} to iterate over -the database backwards may also retrieve some of the data which is not -retrieved by a normal dump operation. - - -\section{Lightning Memory\sphinxhyphen{}Mapped Database module (klmdb)} -\label{\detokenize{admin/dbtypes:lightning-memory-mapped-database-module-klmdb}} -\sphinxAtStartPar -The klmdb module was added in release 1.17. It uses the LMDB library, -and may offer better performance and reliability than the db2 module. -It creates four files based on the database pathname. If the pathname -ends with \sphinxcode{\sphinxupquote{principal}}, then the four files are: -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{principal.mdb}}, containing policy object data and most principal -entry data - -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{principal.mdb\sphinxhyphen{}lock}}, a lock file for the primary database - -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{principal.lockout.mdb}}, containing the account lockout attributes -(last successful authentication time, last failed authentication -time, and number of failed attempts) for each principal entry - -\item {} -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{principal.lockout.mdb\sphinxhyphen{}lock}}, a lock file for the lockout database - -\end{itemize} - -\sphinxAtStartPar -Separating out the lockout attributes ensures that the KDC will never -block on an administrative operation such as a database dump or load. -It also allows the KDC to operate without write access to the primary -database. If both account lockout features are disabled (see -{\hyperref[\detokenize{admin/lockout:disable-lockout}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC performance and account lockout}}}}), the lockout database files will be created -but will not subsequently be opened, and the account lockout -attributes will always have zero values. - -\sphinxAtStartPar -Because LMDB creates a memory map to the database files, it requires a -configured memory map size which also determines the maximum size of -the database. This size is applied equally to the two databases, so -twice the configured size will be consumed in the process address -space; this is primarily a limitation on 32\sphinxhyphen{}bit platforms. The -default value of 128 megabytes should be sufficient for several -hundred thousand principal entries. If the limit is reached, kadmin -operations will fail and the error message “Environment mapsize limit -reached” will appear in the kadmind log file. In this case, the -\sphinxstylestrong{mapsize} variable can be used to increase the map size. The -following example sets the map size to 512 megabytes: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{db\PYGZus{}library} \PYG{o}{=} \PYG{n}{klmdb} - \PYG{n}{mapsize} \PYG{o}{=} \PYG{l+m+mi}{512} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -LMDB has a configurable maximum number of readers. The default value -of 128 should be sufficient for most deployments. If you are going to -use a large number of KDC worker processes, it may be necessary to set -the \sphinxstylestrong{max\_readers} variable to a larger number. - -\sphinxAtStartPar -By default, LMDB synchronizes database files to disk after each write -transaction to ensure durability in the case of an unclean system -shutdown. The klmdb module always turns synchronization off for the -lockout database to ensure reasonable KDC performance, but leaves it -on for the primary database. If high throughput for administrative -operations (including password changes) is required, the \sphinxstylestrong{nosync} -variable can be set to “true” to disable synchronization for the -primary database. - -\sphinxAtStartPar -The klmdb module does not support explicit locking with the -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{lock} command. - - -\section{LDAP module (kldap)} -\label{\detokenize{admin/dbtypes:ldap-module-kldap}} -\sphinxAtStartPar -The kldap module stores principal and policy data using an LDAP -server. To use it you must configure an LDAP server to use the -Kerberos schema. See {\hyperref[\detokenize{admin/conf_ldap:conf-ldap}]{\sphinxcrossref{\DUrole{std,std-ref}{Configuring Kerberos with OpenLDAP back\sphinxhyphen{}end}}}} for details. - -\sphinxAtStartPar -Because {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} is single\sphinxhyphen{}threaded, latency in LDAP database -accesses may limit KDC operation throughput. If the LDAP server is -located on the same server host as the KDC and accessed through an -\sphinxcode{\sphinxupquote{ldapi://}} URL, latency should be minimal. If this is not possible, -consider starting multiple KDC worker processes with the -{\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} \sphinxstylestrong{\sphinxhyphen{}w} option to enable concurrent processing of KDC -requests. - -\sphinxAtStartPar -The kldap module does not support explicit locking with the -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{lock} command. - -\sphinxstepscope - - -\chapter{Account lockout} -\label{\detokenize{admin/lockout:account-lockout}}\label{\detokenize{admin/lockout:lockout}}\label{\detokenize{admin/lockout::doc}} -\sphinxAtStartPar -As of release 1.8, the KDC can be configured to lock out principals -after a number of failed authentication attempts within a period of -time. Account lockout can make it more difficult to attack a -principal’s password by brute force, but also makes it easy for an -attacker to deny access to a principal. - - -\section{Configuring account lockout} -\label{\detokenize{admin/lockout:configuring-account-lockout}} -\sphinxAtStartPar -Account lockout only works for principals with the -\sphinxstylestrong{+requires\_preauth} flag set. Without this flag, the KDC cannot -know whether or not a client successfully decrypted the ticket it -issued. It is also important to set the \sphinxstylestrong{\sphinxhyphen{}allow\_svr} flag on a -principal to protect its password from an off\sphinxhyphen{}line dictionary attack -through a TGS request. You can set these flags on a principal with -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} as follows: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}svr} \PYG{n}{PRINCNAME} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Account lockout parameters are configured via {\hyperref[\detokenize{admin/database:policies}]{\sphinxcrossref{\DUrole{std,std-ref}{policy objects}}}}. There may be an existing policy associated with user -principals (such as the “default” policy), or you may need to create a -new one and associate it with each user principal. - -\sphinxAtStartPar -The policy parameters related to account lockout are: -\begin{itemize} -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:policy-maxfailure}]{\sphinxcrossref{\DUrole{std,std-ref}{maxfailure}}}}: the number of failed attempts -before the principal is locked out - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:policy-failurecountinterval}]{\sphinxcrossref{\DUrole{std,std-ref}{failurecountinterval}}}}: the -allowable interval between failed attempts - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:policy-lockoutduration}]{\sphinxcrossref{\DUrole{std,std-ref}{lockoutduration}}}}: the amount of time -a principal is locked out for - -\end{itemize} - -\sphinxAtStartPar -Here is an example of setting these parameters on a new policy and -associating it with a principal: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addpol} \PYG{o}{\PYGZhy{}}\PYG{n}{maxfailure} \PYG{l+m+mi}{10} \PYG{o}{\PYGZhy{}}\PYG{n}{failurecountinterval} \PYG{l+m+mi}{180} - \PYG{o}{\PYGZhy{}}\PYG{n}{lockoutduration} \PYG{l+m+mi}{60} \PYG{n}{lockout\PYGZus{}policy} -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{policy} \PYG{n}{lockout\PYGZus{}policy} \PYG{n}{PRINCNAME} -\end{sphinxVerbatim} - - -\section{Testing account lockout} -\label{\detokenize{admin/lockout:testing-account-lockout}} -\sphinxAtStartPar -To test that account lockout is working, try authenticating as the -principal (hopefully not one that might be in use) multiple times with -the wrong password. For instance, if \sphinxstylestrong{maxfailure} is set to 2, you -might see: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kinit user -Password for user@KRBTEST.COM: -kinit: Password incorrect while getting initial credentials -\PYGZdl{} kinit user -Password for user@KRBTEST.COM: -kinit: Password incorrect while getting initial credentials -\PYGZdl{} kinit user -kinit: Client\PYGZsq{}s credentials have been revoked while getting initial credentials -\end{sphinxVerbatim} - - -\section{Account lockout principal state} -\label{\detokenize{admin/lockout:account-lockout-principal-state}} -\sphinxAtStartPar -A principal entry keeps three pieces of state related to account -lockout: -\begin{itemize} -\item {} -\sphinxAtStartPar -The time of last successful authentication - -\item {} -\sphinxAtStartPar -The time of last failed authentication - -\item {} -\sphinxAtStartPar -A counter of failed attempts - -\end{itemize} - -\sphinxAtStartPar -The time of last successful authentication is not actually needed for -the account lockout system to function, but may be of administrative -interest. These fields can be observed with the \sphinxstylestrong{getprinc} kadmin -command. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{getprinc} \PYG{n}{user} -\PYG{n}{Principal}\PYG{p}{:} \PYG{n}{user}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} -\PYG{o}{.}\PYG{o}{.}\PYG{o}{.} -\PYG{n}{Last} \PYG{n}{successful} \PYG{n}{authentication}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} -\PYG{n}{Last} \PYG{n}{failed} \PYG{n}{authentication}\PYG{p}{:} \PYG{n}{Mon} \PYG{n}{Dec} \PYG{l+m+mi}{03} \PYG{l+m+mi}{12}\PYG{p}{:}\PYG{l+m+mi}{30}\PYG{p}{:}\PYG{l+m+mi}{33} \PYG{n}{EST} \PYG{l+m+mi}{2012} -\PYG{n}{Failed} \PYG{n}{password} \PYG{n}{attempts}\PYG{p}{:} \PYG{l+m+mi}{2} -\PYG{o}{.}\PYG{o}{.}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -A principal which has been locked out can be administratively unlocked -with the \sphinxstylestrong{\sphinxhyphen{}unlock} option to the \sphinxstylestrong{modprinc} kadmin command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{unlock} \PYG{n}{PRINCNAME} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This command will reset the number of failed attempts to 0. - - -\section{KDC replication and account lockout} -\label{\detokenize{admin/lockout:kdc-replication-and-account-lockout}} -\sphinxAtStartPar -The account lockout state of a principal is not replicated by either -traditional {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} or incremental propagation. Because of -this, the number of attempts an attacker can make within a time period -is multiplied by the number of KDCs. For instance, if the -\sphinxstylestrong{maxfailure} parameter on a policy is 10 and there are four KDCs in -the environment (a primary and three replicas), an attacker could make -as many as 40 attempts before the principal is locked out on all four -KDCs. - -\sphinxAtStartPar -An administrative unlock is propagated from the primary to the replica -KDCs during the next propagation. Propagation of an administrative -unlock will cause the counter of failed attempts on each replica to -reset to 1 on the next failure. - -\sphinxAtStartPar -If a KDC environment uses a replication strategy other than kprop or -incremental propagation, such as the LDAP KDB module with multi\sphinxhyphen{}master -LDAP replication, then account lockout state may be replicated between -KDCs and the concerns of this section may not apply. - - -\section{KDC performance and account lockout} -\label{\detokenize{admin/lockout:kdc-performance-and-account-lockout}}\label{\detokenize{admin/lockout:disable-lockout}} -\sphinxAtStartPar -In order to fully track account lockout state, the KDC must write to -the the database on each successful and failed authentication. -Writing to the database is generally more expensive than reading from -it, so these writes may have a significant impact on KDC performance. -As of release 1.9, it is possible to turn off account lockout state -tracking in order to improve performance, by setting the -\sphinxstylestrong{disable\_last\_success} and \sphinxstylestrong{disable\_lockout} variables in the -database module subsection of {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} - \PYG{n}{DB} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{disable\PYGZus{}last\PYGZus{}success} \PYG{o}{=} \PYG{n}{true} - \PYG{n}{disable\PYGZus{}lockout} \PYG{o}{=} \PYG{n}{true} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Of the two variables, setting \sphinxstylestrong{disable\_last\_success} will usually -have the largest positive impact on performance, and will still allow -account lockout policies to operate. However, it will make it -impossible to observe the last successful authentication time with -kadmin. - - -\section{KDC setup and account lockout} -\label{\detokenize{admin/lockout:kdc-setup-and-account-lockout}} -\sphinxAtStartPar -To update the account lockout state on principals, the KDC must be -able to write to the principal database. For the DB2 module, no -special setup is required. For the LDAP module, the KDC DN must be -granted write access to the principal objects. If the KDC DN has only -read access, account lockout will not function. - -\sphinxstepscope - - -\chapter{Configuring Kerberos with OpenLDAP back\sphinxhyphen{}end} -\label{\detokenize{admin/conf_ldap:configuring-kerberos-with-openldap-back-end}}\label{\detokenize{admin/conf_ldap:conf-ldap}}\label{\detokenize{admin/conf_ldap::doc}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -Make sure the LDAP server is using local authentication -(\sphinxcode{\sphinxupquote{ldapi://}}) or TLS (\sphinxcode{\sphinxupquote{ldaps}}). See -\sphinxurl{https://www.openldap.org/doc/admin/tls.html} for instructions on -configuring TLS support in OpenLDAP. - -\item {} -\sphinxAtStartPar -Add the Kerberos schema file to the LDAP Server using the OpenLDAP -LDIF file from the krb5 source directory -(\sphinxcode{\sphinxupquote{src/plugins/kdb/ldap/libkdb\_ldap/kerberos.openldap.ldif}}). -The following example uses local authentication: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{ldapadd} \PYG{o}{\PYGZhy{}}\PYG{n}{Y} \PYG{n}{EXTERNAL} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldapi}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{o}{/} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{openldap}\PYG{o}{.}\PYG{n}{ldif} -\end{sphinxVerbatim} - -\item {} -\sphinxAtStartPar -Choose DNs for the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} and {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} servers -to bind to the LDAP server, and create them if necessary. Specify -these DNs with the \sphinxstylestrong{ldap\_kdc\_dn} and \sphinxstylestrong{ldap\_kadmind\_dn} -directives in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. The kadmind DN will also be -used for administrative commands such as {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}. - -\sphinxAtStartPar -Alternatively, you may configure krb5kdc and kadmind to use SASL -authentication to access the LDAP server; see the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} -relations \sphinxstylestrong{ldap\_kdc\_sasl\_mech} and similar. - -\item {} -\sphinxAtStartPar -Specify a location for the LDAP service password file by setting -\sphinxstylestrong{ldap\_service\_password\_file}. Use \sphinxcode{\sphinxupquote{kdb5\_ldap\_util stashsrvpw}} -to stash passwords for the KDC and kadmind DNs chosen above. For -example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{n}{stashsrvpw} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{service}\PYG{o}{.}\PYG{n}{keyfile} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{krbadmin}\PYG{p}{,}\PYG{n}{dc}\PYG{o}{=}\PYG{n}{example}\PYG{p}{,}\PYG{n}{dc}\PYG{o}{=}\PYG{n}{com} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Skip this step if you are using SASL authentication and the -mechanism does not require a password. - -\item {} -\sphinxAtStartPar -Choose a DN for the global Kerberos container entry (but do not -create the entry at this time). Specify this DN with the -\sphinxstylestrong{ldap\_kerberos\_container\_dn} directive in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. -Realm container entries will be created underneath this DN. -Principal entries may exist either underneath the realm container -(the default) or in separate trees referenced from the realm -container. - -\item {} -\sphinxAtStartPar -Configure the LDAP server ACLs to enable the KDC and kadmin server -DNs to read and write the Kerberos data. If -\sphinxstylestrong{disable\_last\_success} and \sphinxstylestrong{disable\_lockout} are both set to -true in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} subsection for the realm, then the -KDC DN only requires read access to the Kerberos data. - -\sphinxAtStartPar -Sample access control information: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{access} \PYG{n}{to} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{base}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{n}{by} \PYG{o}{*} \PYG{n}{read} - -\PYG{n}{access} \PYG{n}{to} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{base}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=Subschema}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{n}{by} \PYG{o}{*} \PYG{n}{read} - -\PYG{c+c1}{\PYGZsh{} Provide access to the realm container.} -\PYG{n}{access} \PYG{n}{to} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{subtree}\PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=EXAMPLE.COM,cn=krbcontainer,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{n}{by} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{exact}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=kdc\PYGZhy{}service,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{write} - \PYG{n}{by} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{exact}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=adm\PYGZhy{}service,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{write} - \PYG{n}{by} \PYG{o}{*} \PYG{n}{none} - -\PYG{c+c1}{\PYGZsh{} Provide access to principals, if not underneath the realm container.} -\PYG{n}{access} \PYG{n}{to} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{subtree}\PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{ou=users,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{n}{by} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{exact}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=kdc\PYGZhy{}service,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{write} - \PYG{n}{by} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{exact}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=adm\PYGZhy{}service,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{write} - \PYG{n}{by} \PYG{o}{*} \PYG{n}{none} - -\PYG{n}{access} \PYG{n}{to} \PYG{o}{*} - \PYG{n}{by} \PYG{o}{*} \PYG{n}{read} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the locations of the container and principals or the DNs of the -service objects for a realm are changed then this information -should be updated. - -\item {} -\sphinxAtStartPar -In {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, make sure the following relations are set -in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} subsection for the realm: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -db\PYGZus{}library (set to ``kldap``) -ldap\PYGZus{}kerberos\PYGZus{}container\PYGZus{}dn -ldap\PYGZus{}kdc\PYGZus{}dn -ldap\PYGZus{}kadmind\PYGZus{}dn -ldap\PYGZus{}service\PYGZus{}password\PYGZus{}file -ldap\PYGZus{}servers -\end{sphinxVerbatim} - -\item {} -\sphinxAtStartPar -Create the realm using {\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}}: -\begin{quote} - -\sphinxAtStartPar -kdb5\_ldap\_util create \sphinxhyphen{}subtrees ou=users,dc=example,dc=com \sphinxhyphen{}s -\end{quote} - -\sphinxAtStartPar -Use the \sphinxstylestrong{\sphinxhyphen{}subtrees} option if the principals are to exist in a -separate subtree from the realm container. Before executing the -command, make sure that the subtree mentioned above -\sphinxcode{\sphinxupquote{(ou=users,dc=example,dc=com)}} exists. If the principals will -exist underneath the realm container, omit the \sphinxstylestrong{\sphinxhyphen{}subtrees} option -and do not worry about creating the principal subtree. - -\sphinxAtStartPar -For more information, refer to the section {\hyperref[\detokenize{admin/database:ops-on-ldap}]{\sphinxcrossref{\DUrole{std,std-ref}{Operations on the LDAP database}}}}. - -\sphinxAtStartPar -The realm object is created under the -\sphinxstylestrong{ldap\_kerberos\_container\_dn} specified in the configuration -file. This operation will also create the Kerberos container, if -not present already. This container can be used to store -information related to multiple realms. - -\item {} -\sphinxAtStartPar -Add an \sphinxcode{\sphinxupquote{eq}} index for \sphinxcode{\sphinxupquote{krbPrincipalName}} to speed up principal -lookup operations. See -\sphinxurl{https://www.openldap.org/doc/admin/tuning.html\#Indexes} for -details. - -\end{enumerate} - -\sphinxAtStartPar -With the LDAP back end it is possible to provide aliases for principal -entries. Beginning in release 1.22, aliases can be added with the -kadmin \sphinxstylestrong{add\_alias} command, but it is also possible (in release 1.7 -or later) to provide aliases through direct manipulation of the LDAP -entries. - -\sphinxAtStartPar -An entry with aliases contains multiple values of the -\sphinxstyleemphasis{krbPrincipalName} attribute. Since LDAP attribute values are not -ordered, it is necessary to specify which principal name is canonical, -by using the \sphinxstyleemphasis{krbCanonicalName} attribute. Therefore, to create -aliases for an entry, first set the \sphinxstyleemphasis{krbCanonicalName} attribute of -the entry to the canonical principal name (which should be identical -to the pre\sphinxhyphen{}existing \sphinxstyleemphasis{krbPrincipalName} value), and then add additional -\sphinxstyleemphasis{krbPrincipalName} attributes for the aliases. - -\sphinxAtStartPar -Principal aliases are only returned by the KDC when the client -requests canonicalization. Canonicalization is normally requested for -service principals; for client principals, an explicit flag is often -required (e.g., \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}C}}) and canonicalization is only performed -for initial ticket requests. - -\sphinxstepscope - - -\chapter{Application servers} -\label{\detokenize{admin/appl_servers:application-servers}}\label{\detokenize{admin/appl_servers::doc}} -\sphinxAtStartPar -If you need to install the Kerberos V5 programs on an application -server, please refer to the Kerberos V5 Installation Guide. Once you -have installed the software, you need to add that host to the Kerberos -database (see {\hyperref[\detokenize{admin/database:principals}]{\sphinxcrossref{\DUrole{std,std-ref}{Principals}}}}), and generate a keytab for that host, -that contains the host’s key. You also need to make sure the host’s -clock is within your maximum clock skew of the KDCs. - - -\section{Keytabs} -\label{\detokenize{admin/appl_servers:keytabs}} -\sphinxAtStartPar -A keytab is a host’s copy of its own keylist, which is analogous to a -user’s password. An application server that needs to authenticate -itself to the KDC has to have a keytab that contains its own principal -and key. Just as it is important for users to protect their -passwords, it is equally important for hosts to protect their keytabs. -You should always store keytab files on local disk, and make them -readable only by root, and you should never send a keytab file over a -network in the clear. Ideally, you should run the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} -command to extract a keytab on the host on which the keytab is to -reside. - - -\subsection{Adding principals to keytabs} -\label{\detokenize{admin/appl_servers:adding-principals-to-keytabs}}\label{\detokenize{admin/appl_servers:add-princ-kt}} -\sphinxAtStartPar -To generate a keytab, or to add a principal to an existing keytab, use -the \sphinxstylestrong{ktadd} command from kadmin. Here is a sample session, using -configuration files that enable only AES encryption: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} -\end{sphinxVerbatim} - - -\subsection{Removing principals from keytabs} -\label{\detokenize{admin/appl_servers:removing-principals-from-keytabs}} -\sphinxAtStartPar -To remove a principal from an existing keytab, use the kadmin -\sphinxstylestrong{ktremove} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktremove} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\end{sphinxVerbatim} - - -\subsection{Using a keytab to acquire client credentials} -\label{\detokenize{admin/appl_servers:using-a-keytab-to-acquire-client-credentials}} -\sphinxAtStartPar -While keytabs are ordinarily used to accept credentials from clients, -they can also be used to acquire initial credentials, allowing one -service to authenticate to another. - -\sphinxAtStartPar -To manually obtain credentials using a keytab, use the \DUrole{xref,std,std-ref}{kinit(1)} -\sphinxstylestrong{\sphinxhyphen{}k} option, together with the \sphinxstylestrong{\sphinxhyphen{}t} option if the keytab is not in -the default location. - -\sphinxAtStartPar -Beginning with release 1.11, GSSAPI applications can be configured to -automatically obtain initial credentials from a keytab as needed. The -recommended configuration is as follows: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -Create a keytab containing a single entry for the desired client -identity. - -\item {} -\sphinxAtStartPar -Place the keytab in a location readable by the service, and set the -\sphinxstylestrong{KRB5\_CLIENT\_KTNAME} environment variable to its filename. -Alternatively, use the \sphinxstylestrong{default\_client\_keytab\_name} profile -variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}, or use the default location of -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFCKTNAME}}}}. - -\item {} -\sphinxAtStartPar -Set \sphinxstylestrong{KRB5CCNAME} to a filename writable by the service, which -will not be used for any other purpose. Do not manually obtain -credentials at this location. (Another credential cache type -besides \sphinxstylestrong{FILE} can be used if desired, as long the cache will not -conflict with another use. A \sphinxstylestrong{MEMORY} cache can be used if the -service runs as a long\sphinxhyphen{}lived process. See \DUrole{xref,std,std-ref}{ccache\_definition} -for details.) - -\item {} -\sphinxAtStartPar -Start the service. When it authenticates using GSSAPI, it will -automatically obtain credentials from the client keytab into the -specified credential cache, and refresh them before they expire. - -\end{enumerate} - - -\section{Clock Skew} -\label{\detokenize{admin/appl_servers:clock-skew}} -\sphinxAtStartPar -A Kerberos application server host must keep its clock synchronized or -it will reject authentication requests from clients. Modern operating -systems typically provide a facility to maintain the correct time; -make sure it is enabled. This is especially important on virtual -machines, where clocks tend to drift more rapidly than normal machine -clocks. - -\sphinxAtStartPar -The default allowable clock skew is controlled by the \sphinxstylestrong{clockskew} -variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}. - - -\section{Getting DNS information correct} -\label{\detokenize{admin/appl_servers:getting-dns-information-correct}} -\sphinxAtStartPar -Several aspects of Kerberos rely on name service. When a hostname is -used to name a service, clients may canonicalize the hostname using -forward and possibly reverse name resolution. The result of this -canonicalization must match the principal entry in the host’s keytab, -or authentication will fail. To work with all client canonicalization -configurations, each host’s canonical name must be the fully\sphinxhyphen{}qualified -host name (including the domain), and each host’s IP address must -reverse\sphinxhyphen{}resolve to the canonical name. - -\sphinxAtStartPar -Configuration of hostnames varies by operating system. On the -application server itself, canonicalization will typically use the -\sphinxcode{\sphinxupquote{/etc/hosts}} file rather than the DNS. Ensure that the line for the -server’s hostname is in the following form: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{IP} \PYG{n}{address} \PYG{n}{fully}\PYG{o}{\PYGZhy{}}\PYG{n}{qualified} \PYG{n}{hostname} \PYG{n}{aliases} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Here is a sample \sphinxcode{\sphinxupquote{/etc/hosts}} file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{c+c1}{\PYGZsh{} this is a comment} -\PYG{l+m+mf}{127.0}\PYG{l+m+mf}{.0}\PYG{l+m+mf}{.1} \PYG{n}{localhost} \PYG{n}{localhost}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{l+m+mf}{10.0}\PYG{l+m+mf}{.0}\PYG{l+m+mf}{.6} \PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{daffodil} \PYG{n}{trillium} \PYG{n}{wake}\PYG{o}{\PYGZhy{}}\PYG{n}{robin} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The output of \sphinxcode{\sphinxupquote{klist \sphinxhyphen{}k}} for this example host should look like: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{viola}\PYG{c+c1}{\PYGZsh{} klist \PYGZhy{}k} -\PYG{n}{Keytab} \PYG{n}{name}\PYG{p}{:} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} -\PYG{n}{KVNO} \PYG{n}{Principal} -\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} - \PYG{l+m+mi}{2} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If you were to ssh to this host with a fresh credentials cache (ticket -file), and then \DUrole{xref,std,std-ref}{klist(1)}, the output should list a service -principal of \sphinxcode{\sphinxupquote{host/daffodil.mit.edu@ATHENA.MIT.EDU}}. - - -\section{Configuring your firewall to work with Kerberos V5} -\label{\detokenize{admin/appl_servers:configuring-your-firewall-to-work-with-kerberos-v5}}\label{\detokenize{admin/appl_servers:conf-firewall}} -\sphinxAtStartPar -If you need off\sphinxhyphen{}site users to be able to get Kerberos tickets in your -realm, they must be able to get to your KDC. This requires either -that you have a replica KDC outside your firewall, or that you -configure your firewall to allow UDP requests into at least one of -your KDCs, on whichever port the KDC is running. (The default is port -88; other ports may be specified in the KDC’s {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} -file.) Similarly, if you need off\sphinxhyphen{}site users to be able to change -their passwords in your realm, they must be able to get to your -Kerberos admin server on the kpasswd port (which defaults to 464). If -you need off\sphinxhyphen{}site users to be able to administer your Kerberos realm, -they must be able to get to your Kerberos admin server on the -administrative port (which defaults to 749). - -\sphinxAtStartPar -If your on\sphinxhyphen{}site users inside your firewall will need to get to KDCs in -other realms, you will also need to configure your firewall to allow -outgoing TCP and UDP requests to port 88, and to port 464 to allow -password changes. If your on\sphinxhyphen{}site users inside your firewall will -need to get to Kerberos admin servers in other realms, you will also -need to allow outgoing TCP and UDP requests to port 749. - -\sphinxAtStartPar -If any of your KDCs are outside your firewall, you will need to allow -kprop requests to get through to the remote KDC. {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} uses -the \sphinxcode{\sphinxupquote{krb5\_prop}} service on port 754 (tcp). - -\sphinxAtStartPar -The book \sphinxstyleemphasis{UNIX System Security}, by David Curry, is a good starting -point for learning to configure firewalls. - -\sphinxstepscope - - -\chapter{Host configuration} -\label{\detokenize{admin/host_config:host-configuration}}\label{\detokenize{admin/host_config::doc}} -\sphinxAtStartPar -All hosts running Kerberos software, whether they are clients, -application servers, or KDCs, can be configured using -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. Here we describe some of the behavior changes -you might want to make. - - -\section{Default realm} -\label{\detokenize{admin/host_config:default-realm}} -\sphinxAtStartPar -In the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} section, the \sphinxstylestrong{default\_realm} realm -relation sets the default Kerberos realm. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} - \PYG{n}{default\PYGZus{}realm} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The default realm affects Kerberos behavior in the following ways: -\begin{itemize} -\item {} -\sphinxAtStartPar -When a principal name is parsed from text, the default realm is used -if no \sphinxcode{\sphinxupquote{@REALM}} component is specified. - -\item {} -\sphinxAtStartPar -The default realm affects login authorization as described below. - -\item {} -\sphinxAtStartPar -For programs which operate on a Kerberos database, the default realm -is used to determine which database to operate on, unless the \sphinxstylestrong{\sphinxhyphen{}r} -parameter is given to specify a realm. - -\item {} -\sphinxAtStartPar -A server program may use the default realm when looking up its key -in a {\hyperref[\detokenize{admin/install_appl_srv:keytab-file}]{\sphinxcrossref{\DUrole{std,std-ref}{keytab file}}}}, if its realm is not -determined by {\hyperref[\detokenize{admin/conf_files/krb5_conf:domain-realm}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}domain\_realm{]}}}}} configuration or by the server -program itself. - -\item {} -\sphinxAtStartPar -If \DUrole{xref,std,std-ref}{kinit(1)} is passed the \sphinxstylestrong{\sphinxhyphen{}n} flag, it requests anonymous -tickets from the default realm. - -\end{itemize} - -\sphinxAtStartPar -In some situations, these uses of the default realm might conflict. -For example, it might be desirable for principal name parsing to use -one realm by default, but for login authorization to use a second -realm. In this situation, the first realm can be configured as the -default realm, and \sphinxstylestrong{auth\_to\_local} relations can be used as -described below to use the second realm for login authorization. - - -\section{Login authorization} -\label{\detokenize{admin/host_config:login-authorization}}\label{\detokenize{admin/host_config:id1}} -\sphinxAtStartPar -If a host runs a Kerberos\sphinxhyphen{}enabled login service such as OpenSSH with -GSSAPIAuthentication enabled, login authorization rules determine -whether a Kerberos principal is allowed to access a local account. - -\sphinxAtStartPar -By default, a Kerberos principal is allowed access to an account if -its realm matches the default realm and its name matches the account -name. (For historical reasons, access is also granted by default if -the name has two components and the second component matches the -default realm; for instance, \sphinxcode{\sphinxupquote{alice/ATHENA.MIT.EDU@ATHENA.MIT.EDU}} -is granted access to the \sphinxcode{\sphinxupquote{alice}} account if \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} is -the default realm.) - -\sphinxAtStartPar -The simplest way to control local access is using \DUrole{xref,std,std-ref}{.k5login(5)} -files. To use these, place a \sphinxcode{\sphinxupquote{.k5login}} file in the home directory -of each account listing the principal names which should have login -access to that account. If it is not desirable to use \sphinxcode{\sphinxupquote{.k5login}} -files located in account home directories, the \sphinxstylestrong{k5login\_directory} -relation in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} section can specify a directory -containing one file per account uname. - -\sphinxAtStartPar -By default, if a \sphinxcode{\sphinxupquote{.k5login}} file is present, it controls -authorization both positively and negatively\textendash{}any principal name -contained in the file is granted access and any other principal name -is denied access, even if it would have had access if the \sphinxcode{\sphinxupquote{.k5login}} -file didn’t exist. The \sphinxstylestrong{k5login\_authoritative} relation in the -{\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} section can be set to false to make \sphinxcode{\sphinxupquote{.k5login}} -files provide positive authorization only. - -\sphinxAtStartPar -The \sphinxstylestrong{auth\_to\_local} relation in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section for the -default realm can specify pattern\sphinxhyphen{}matching rules to control login -authorization. For example, the following configuration allows access -to principals from a different realm than the default realm: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -[realms] - DEFAULT.REALM = \PYGZob{} - \PYGZsh{} Allow access to principals from OTHER.REALM. - \PYGZsh{} - \PYGZsh{} [1:\PYGZdl{}1@\PYGZdl{}0] matches single\PYGZhy{}component principal names and creates - \PYGZsh{} a selection string containing the principal name and realm. - \PYGZsh{} - \PYGZsh{} (.*@OTHER\PYGZbs{}.REALM) matches against the selection string, so that - \PYGZsh{} only principals in OTHER.REALM are matched. - \PYGZsh{} - \PYGZsh{} s/@OTHER\PYGZbs{}.REALM\PYGZdl{}// removes the realm name, leaving behind the - \PYGZsh{} principal name as the account name. - auth\PYGZus{}to\PYGZus{}local = RULE:[1:\PYGZdl{}1@\PYGZdl{}0](.*@OTHER\PYGZbs{}.REALM)s/@OTHER\PYGZbs{}.REALM\PYGZdl{}// - - \PYGZsh{} Also allow principals from the default realm. Omit this line - \PYGZsh{} to only allow access to principals in OTHER.REALM. - auth\PYGZus{}to\PYGZus{}local = DEFAULT - \PYGZcb{} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The \sphinxstylestrong{auth\_to\_local\_names} subsection of the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section -for the default realm can specify explicit mappings from principal -names to local accounts. The key used in this subsection is the -principal name without realm, so it is only safe to use in a Kerberos -environment with a single realm or a tightly controlled set of realms. -An example use of \sphinxstylestrong{auth\_to\_local\_names} might be: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{auth\PYGZus{}to\PYGZus{}local\PYGZus{}names} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{c+c1}{\PYGZsh{} Careful, these match principals in any realm!} - \PYG{n}{host}\PYG{o}{/}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} \PYG{o}{=} \PYG{n}{hostaccount} - \PYG{n}{fred} \PYG{o}{=} \PYG{n}{localfred} - \PYG{p}{\PYGZcb{}} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Local authorization behavior can also be modified using plugin -modules; see \DUrole{xref,std,std-ref}{hostrealm\_plugin} for details. - - -\section{Plugin module configuration} -\label{\detokenize{admin/host_config:plugin-module-configuration}}\label{\detokenize{admin/host_config:plugin-config}} -\sphinxAtStartPar -Many aspects of Kerberos behavior, such as client preauthentication -and KDC service location, can be modified through the use of plugin -modules. For most of these behaviors, you can use the {\hyperref[\detokenize{admin/conf_files/krb5_conf:plugins}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}plugins{]}}}}} -section of krb5.conf to register third\sphinxhyphen{}party modules, and to switch -off registered or built\sphinxhyphen{}in modules. - -\sphinxAtStartPar -A plugin module takes the form of a Unix shared object -(\sphinxcode{\sphinxupquote{modname.so}}) or Windows DLL (\sphinxcode{\sphinxupquote{modname.dll}}). If you have -installed a third\sphinxhyphen{}party plugin module and want to register it, you do -so using the \sphinxstylestrong{module} relation in the appropriate subsection of the -{[}plugins{]} section. The value for \sphinxstylestrong{module} must give the module name -and the path to the module, separated by a colon. The module name -will often be the same as the shared object’s name, but in unusual -cases (such as a shared object which implements multiple modules for -the same interface) it might not be. For example, to register a -client preauthentication module named \sphinxcode{\sphinxupquote{mypreauth}} installed at -\sphinxcode{\sphinxupquote{/path/to/mypreauth.so}}, you could write: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{plugins}\PYG{p}{]} - \PYG{n}{clpreauth} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{module} \PYG{o}{=} \PYG{n}{mypreauth}\PYG{p}{:}\PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{mypreauth}\PYG{o}{.}\PYG{n}{so} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Many of the pluggable behaviors in MIT krb5 contain built\sphinxhyphen{}in modules -which can be switched off. You can disable a built\sphinxhyphen{}in module (or one -you have registered) using the \sphinxstylestrong{disable} directive in the -appropriate subsection of the {[}plugins{]} section. For example, to -disable the use of .k5identity files to select credential caches, you -could write: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{plugins}\PYG{p}{]} - \PYG{n}{ccselect} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{disable} \PYG{o}{=} \PYG{n}{k5identity} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If you want to disable multiple modules, specify the \sphinxstylestrong{disable} -directive multiple times, giving one module to disable each time. - -\sphinxAtStartPar -Alternatively, you can explicitly specify which modules you want to be -enabled for that behavior using the \sphinxstylestrong{enable\_only} directive. For -example, to make {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} check password quality using only a -module you have registered, and no other mechanism, you could write: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{plugins}\PYG{p}{]} - \PYG{n}{pwqual} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{module} \PYG{o}{=} \PYG{n}{mymodule}\PYG{p}{:}\PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{mymodule}\PYG{o}{.}\PYG{n}{so} - \PYG{n}{enable\PYGZus{}only} \PYG{o}{=} \PYG{n}{mymodule} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Again, if you want to specify multiple modules, specify the -\sphinxstylestrong{enable\_only} directive multiple times, giving one module to enable -each time. - -\sphinxAtStartPar -Some Kerberos interfaces use different mechanisms to register plugin -modules. - - -\subsection{KDC location modules} -\label{\detokenize{admin/host_config:kdc-location-modules}} -\sphinxAtStartPar -For historical reasons, modules to control how KDC servers are located -are registered simply by placing the shared object or DLL into the -“libkrb5” subdirectory of the krb5 plugin directory, which defaults to -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LIBDIR}}}}\sphinxcode{\sphinxupquote{/krb5/plugins}}. For example, Samba’s winbind krb5 -locator plugin would be registered by placing its shared object in -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LIBDIR}}}}\sphinxcode{\sphinxupquote{/krb5/plugins/libkrb5/winbind\_krb5\_locator.so}}. - - -\subsection{GSSAPI mechanism modules} -\label{\detokenize{admin/host_config:gssapi-mechanism-modules}}\label{\detokenize{admin/host_config:gssapi-plugin-config}} -\sphinxAtStartPar -GSSAPI mechanism modules are registered using the file -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SYSCONFDIR}}}}\sphinxcode{\sphinxupquote{/gss/mech}} or configuration files in the -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SYSCONFDIR}}}}\sphinxcode{\sphinxupquote{/gss/mech.d}} directory with a \sphinxcode{\sphinxupquote{.conf}} -suffix. Each line in these files has the form: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{name} \PYG{n}{oid} \PYG{n}{pathname} \PYG{p}{[}\PYG{n}{options}\PYG{p}{]} \PYG{o}{\PYGZlt{}}\PYG{n+nb}{type}\PYG{o}{\PYGZgt{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Only the name, oid, and pathname are required. \sphinxstyleemphasis{name} is the -mechanism name, which may be used for debugging or logging purposes. -\sphinxstyleemphasis{oid} is the object identifier of the GSSAPI mechanism to be -registered. \sphinxstyleemphasis{pathname} is a path to the module shared object or DLL. -\sphinxstyleemphasis{options} (if present) are options provided to the plugin module, -surrounded in square brackets. \sphinxstyleemphasis{type} (if present) can be used to -indicate a special type of module. Currently the only special module -type is “interposer”, for a module designed to intercept calls to -other mechanisms. - -\sphinxAtStartPar -If the environment variable \sphinxstylestrong{GSS\_MECH\_CONFIG} is set, its value is -used as the sole mechanism configuration filename. - - -\subsection{Configuration profile modules} -\label{\detokenize{admin/host_config:configuration-profile-modules}}\label{\detokenize{admin/host_config:profile-plugin-config}} -\sphinxAtStartPar -A configuration profile module replaces the information source for -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} itself. To use a profile module, begin krb5.conf -with the line: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{module} \PYG{n}{PATHNAME}\PYG{p}{:}\PYG{n}{STRING} -\end{sphinxVerbatim} - -\sphinxAtStartPar -where \sphinxstyleemphasis{PATHNAME} is a path to the module shared object or DLL, and -\sphinxstyleemphasis{STRING} is a string to provide to the module. The module will then -take over, and the rest of krb5.conf will be ignored. - -\sphinxstepscope - - -\chapter{Backups of secure hosts} -\label{\detokenize{admin/backup_host:backups-of-secure-hosts}}\label{\detokenize{admin/backup_host::doc}} -\sphinxAtStartPar -When you back up a secure host, you should exclude the host’s keytab -file from the backup. If someone obtained a copy of the keytab from a -backup, that person could make any host masquerade as the host whose -keytab was compromised. In many configurations, knowledge of the -host’s keytab also allows root access to the host. This could be -particularly dangerous if the compromised keytab was from one of your -KDCs. If the machine has a disk crash and the keytab file is lost, it -is easy to generate another keytab file. (See {\hyperref[\detokenize{admin/appl_servers:add-princ-kt}]{\sphinxcrossref{\DUrole{std,std-ref}{Adding principals to keytabs}}}}.) -If you are unable to exclude particular files from backups, you should -ensure that the backups are kept as secure as the host’s root -password. - - -\section{Backing up the Kerberos database} -\label{\detokenize{admin/backup_host:backing-up-the-kerberos-database}} -\sphinxAtStartPar -As with any file, it is possible that your Kerberos database could -become corrupted. If this happens on one of the replica KDCs, you -might never notice, since the next automatic propagation of the -database would install a fresh copy. However, if it happens to the -primary KDC, the corrupted database would be propagated to all of the -replicas during the next propagation. For this reason, MIT recommends -that you back up your Kerberos database regularly. Because the primary -KDC is continuously dumping the database to a file in order to -propagate it to the replica KDCs, it is a simple matter to have a cron -job periodically copy the dump file to a secure machine elsewhere on -your network. (Of course, it is important to make the host where -these backups are stored as secure as your KDCs, and to encrypt its -transmission across your network.) Then if your database becomes -corrupted, you can load the most recent dump onto the primary KDC. -(See {\hyperref[\detokenize{admin/database:restore-from-dump}]{\sphinxcrossref{\DUrole{std,std-ref}{Dumping and loading a Kerberos database}}}}.) - -\sphinxstepscope - - -\chapter{PKINIT configuration} -\label{\detokenize{admin/pkinit:pkinit-configuration}}\label{\detokenize{admin/pkinit:pkinit}}\label{\detokenize{admin/pkinit::doc}} -\sphinxAtStartPar -PKINIT is a preauthentication mechanism for Kerberos 5 which uses -X.509 certificates to authenticate the KDC to clients and vice versa. -PKINIT can also be used to enable anonymity support, allowing clients -to communicate securely with the KDC or with application servers -without authenticating as a particular client principal. - - -\section{Creating certificates} -\label{\detokenize{admin/pkinit:creating-certificates}} -\sphinxAtStartPar -PKINIT requires an X.509 certificate for the KDC and one for each -client principal which will authenticate using PKINIT. For anonymous -PKINIT, a KDC certificate is required, but client certificates are -not. A commercially issued server certificate can be used for the KDC -certificate, but generally cannot be used for client certificates. - -\sphinxAtStartPar -The instruction in this section describe how to establish a -certificate authority and create standard PKINIT certificates. Skip -this section if you are using a commercially issued server certificate -as the KDC certificate for anonymous PKINIT, or if you are configuring -a client to use an Active Directory KDC. - - -\subsection{Generating a certificate authority certificate} -\label{\detokenize{admin/pkinit:generating-a-certificate-authority-certificate}} -\sphinxAtStartPar -You can establish a new certificate authority (CA) for use with a -PKINIT deployment with the commands: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{openssl} \PYG{n}{genrsa} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{cakey}\PYG{o}{.}\PYG{n}{pem} \PYG{l+m+mi}{2048} -\PYG{n}{openssl} \PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{n}{key} \PYG{n}{cakey}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{new} \PYG{o}{\PYGZhy{}}\PYG{n}{x509} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{days} \PYG{l+m+mi}{3650} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The second command will ask for the values of several certificate -fields. These fields can be set to any values. You can adjust the -expiration time of the CA certificate by changing the number after -\sphinxcode{\sphinxupquote{\sphinxhyphen{}days}}. Since the CA certificate must be deployed to client -machines each time it changes, it should normally have an expiration -time far in the future; however, expiration times after 2037 may cause -interoperability issues in rare circumstances. - -\sphinxAtStartPar -The result of these commands will be two files, cakey.pem and -cacert.pem. cakey.pem will contain a 2048\sphinxhyphen{}bit RSA private key, which -must be carefully protected. cacert.pem will contain the CA -certificate, which must be placed in the filesystems of the KDC and -each client host. cakey.pem will be required to create KDC and client -certificates. - - -\subsection{Generating a KDC certificate} -\label{\detokenize{admin/pkinit:generating-a-kdc-certificate}} -\sphinxAtStartPar -A KDC certificate for use with PKINIT is required to have some unusual -fields, which makes generating them with OpenSSL somewhat complicated. -First, you will need a file containing the following: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -[kdc\PYGZus{}cert] -basicConstraints=CA:FALSE -keyUsage=nonRepudiation,digitalSignature,keyEncipherment,keyAgreement -extendedKeyUsage=1.3.6.1.5.2.3.5 -subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid,issuer -issuerAltName=issuer:copy -subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc\PYGZus{}princ\PYGZus{}name - -[kdc\PYGZus{}princ\PYGZus{}name] -realm=EXP:0,GeneralString:\PYGZdl{}\PYGZob{}ENV::REALM\PYGZcb{} -principal\PYGZus{}name=EXP:1,SEQUENCE:kdc\PYGZus{}principal\PYGZus{}seq - -[kdc\PYGZus{}principal\PYGZus{}seq] -name\PYGZus{}type=EXP:0,INTEGER:2 -name\PYGZus{}string=EXP:1,SEQUENCE:kdc\PYGZus{}principals - -[kdc\PYGZus{}principals] -princ1=GeneralString:krbtgt -princ2=GeneralString:\PYGZdl{}\PYGZob{}ENV::REALM\PYGZcb{} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the above contents are placed in extensions.kdc, you can generate -and sign a KDC certificate with the following commands: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{openssl} \PYG{n}{genrsa} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{kdckey}\PYG{o}{.}\PYG{n}{pem} \PYG{l+m+mi}{2048} -\PYG{n}{openssl} \PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{n}{new} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{kdc}\PYG{o}{.}\PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{n}{key} \PYG{n}{kdckey}\PYG{o}{.}\PYG{n}{pem} -\PYG{n}{env} \PYG{n}{REALM}\PYG{o}{=}\PYG{n}{YOUR\PYGZus{}REALMNAME} \PYG{n}{openssl} \PYG{n}{x509} \PYG{o}{\PYGZhy{}}\PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{o+ow}{in} \PYG{n}{kdc}\PYG{o}{.}\PYG{n}{req} \PYGZbs{} - \PYG{o}{\PYGZhy{}}\PYG{n}{CAkey} \PYG{n}{cakey}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{CA} \PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{kdc}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{days} \PYG{l+m+mi}{365} \PYGZbs{} - \PYG{o}{\PYGZhy{}}\PYG{n}{extfile} \PYG{n}{extensions}\PYG{o}{.}\PYG{n}{kdc} \PYG{o}{\PYGZhy{}}\PYG{n}{extensions} \PYG{n}{kdc\PYGZus{}cert} \PYG{o}{\PYGZhy{}}\PYG{n}{CAcreateserial} -\PYG{n}{rm} \PYG{n}{kdc}\PYG{o}{.}\PYG{n}{req} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The second command will ask for the values of certificate fields, -which can be set to any values. In the third command, substitute your -KDC’s realm name for YOUR\_REALMNAME. You can adjust the certificate’s -expiration date by changing the number after \sphinxcode{\sphinxupquote{\sphinxhyphen{}days}}. Remember to -create a new KDC certificate before the old one expires. - -\sphinxAtStartPar -The result of this operation will be in two files, kdckey.pem and -kdc.pem. Both files must be placed in the KDC’s filesystem. -kdckey.pem, which contains the KDC’s private key, must be carefully -protected. - -\sphinxAtStartPar -If you examine the KDC certificate with \sphinxcode{\sphinxupquote{openssl x509 \sphinxhyphen{}in kdc.pem -\sphinxhyphen{}text \sphinxhyphen{}noout}}, OpenSSL will not know how to display the KDC principal -name in the Subject Alternative Name extension, so it will appear as -\sphinxcode{\sphinxupquote{othername:\textless{}unsupported\textgreater{}}}. This is normal and does not mean -anything is wrong with the KDC certificate. - - -\subsection{Generating client certificates} -\label{\detokenize{admin/pkinit:generating-client-certificates}} -\sphinxAtStartPar -PKINIT client certificates also must have some unusual certificate -fields. To generate a client certificate with OpenSSL for a -single\sphinxhyphen{}component principal name, you will need an extensions file -(different from the KDC extensions file above) containing: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -[client\PYGZus{}cert] -basicConstraints=CA:FALSE -keyUsage=digitalSignature,keyEncipherment,keyAgreement -extendedKeyUsage=1.3.6.1.5.2.3.4 -subjectKeyIdentifier=hash -authorityKeyIdentifier=keyid,issuer -issuerAltName=issuer:copy -subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:princ\PYGZus{}name - -[princ\PYGZus{}name] -realm=EXP:0,GeneralString:\PYGZdl{}\PYGZob{}ENV::REALM\PYGZcb{} -principal\PYGZus{}name=EXP:1,SEQUENCE:principal\PYGZus{}seq - -[principal\PYGZus{}seq] -name\PYGZus{}type=EXP:0,INTEGER:1 -name\PYGZus{}string=EXP:1,SEQUENCE:principals - -[principals] -princ1=GeneralString:\PYGZdl{}\PYGZob{}ENV::CLIENT\PYGZcb{} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the above contents are placed in extensions.client, you can -generate and sign a client certificate with the following commands: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{openssl} \PYG{n}{genrsa} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{clientkey}\PYG{o}{.}\PYG{n}{pem} \PYG{l+m+mi}{2048} -\PYG{n}{openssl} \PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{n}{new} \PYG{o}{\PYGZhy{}}\PYG{n}{key} \PYG{n}{clientkey}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{client}\PYG{o}{.}\PYG{n}{req} -\PYG{n}{env} \PYG{n}{REALM}\PYG{o}{=}\PYG{n}{YOUR\PYGZus{}REALMNAME} \PYG{n}{CLIENT}\PYG{o}{=}\PYG{n}{YOUR\PYGZus{}PRINCNAME} \PYG{n}{openssl} \PYG{n}{x509} \PYGZbs{} - \PYG{o}{\PYGZhy{}}\PYG{n}{CAkey} \PYG{n}{cakey}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{CA} \PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{o+ow}{in} \PYG{n}{client}\PYG{o}{.}\PYG{n}{req} \PYGZbs{} - \PYG{o}{\PYGZhy{}}\PYG{n}{extensions} \PYG{n}{client\PYGZus{}cert} \PYG{o}{\PYGZhy{}}\PYG{n}{extfile} \PYG{n}{extensions}\PYG{o}{.}\PYG{n}{client} \PYGZbs{} - \PYG{o}{\PYGZhy{}}\PYG{n}{days} \PYG{l+m+mi}{365} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{client}\PYG{o}{.}\PYG{n}{pem} -\PYG{n}{rm} \PYG{n}{client}\PYG{o}{.}\PYG{n}{req} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Normally, the first two commands should be run on the client host, and -the resulting client.req file transferred to the certificate authority -host for the third command. As in the previous steps, the second -command will ask for the values of certificate fields, which can be -set to any values. In the third command, substitute your realm’s name -for YOUR\_REALMNAME and the client’s principal name (without realm) for -YOUR\_PRINCNAME. You can adjust the certificate’s expiration date by -changing the number after \sphinxcode{\sphinxupquote{\sphinxhyphen{}days}}. - -\sphinxAtStartPar -The result of this operation will be two files, clientkey.pem and -client.pem. Both files must be present on the client’s host; -clientkey.pem, which contains the client’s private key, must be -protected from access by others. - -\sphinxAtStartPar -As in the KDC certificate, OpenSSL will display the client principal -name as \sphinxcode{\sphinxupquote{othername:\textless{}unsupported\textgreater{}}} in the Subject Alternative Name -extension of a PKINIT client certificate. - -\sphinxAtStartPar -If the client principal name contains more than one component -(e.g. \sphinxcode{\sphinxupquote{host/example.com@REALM}}), the \sphinxcode{\sphinxupquote{{[}principals{]}}} section of -\sphinxcode{\sphinxupquote{extensions.client}} must be altered to contain multiple entries. -(Simply setting \sphinxcode{\sphinxupquote{CLIENT}} to \sphinxcode{\sphinxupquote{host/example.com}} would generate a -certificate for \sphinxcode{\sphinxupquote{host\textbackslash{}/example.com@REALM}} which would not match the -multi\sphinxhyphen{}component principal name.) For a two\sphinxhyphen{}component principal, the -section should read: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -[principals] -princ1=GeneralString:\PYGZdl{}\PYGZob{}ENV::CLIENT1\PYGZcb{} -princ2=GeneralString:\PYGZdl{}\PYGZob{}ENV::CLIENT2\PYGZcb{} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The environment variables \sphinxcode{\sphinxupquote{CLIENT1}} and \sphinxcode{\sphinxupquote{CLIENT2}} must then be set -to the first and second components when running \sphinxcode{\sphinxupquote{openssl x509}}. - - -\section{Configuring the KDC} -\label{\detokenize{admin/pkinit:configuring-the-kdc}} -\sphinxAtStartPar -The KDC must have filesystem access to the KDC certificate (kdc.pem) -and the KDC private key (kdckey.pem). Configure the following -relation in the KDC’s {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file, either in the -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdcdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}kdcdefaults{]}}}}} section or in a {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection (with -appropriate pathnames): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{pkinit\PYGZus{}identity} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{lib}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{kdc}\PYG{o}{.}\PYG{n}{pem}\PYG{p}{,}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{lib}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{kdckey}\PYG{o}{.}\PYG{n}{pem} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If any clients will authenticate using regular (as opposed to -anonymous) PKINIT, the KDC must also have filesystem access to the CA -certificate (cacert.pem), and the following configuration (with the -appropriate pathname): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{lib}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Because of the larger size of requests and responses using PKINIT, you -may also need to allow TCP access to the KDC: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdc\PYGZus{}tcp\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Restart the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon to pick up the configuration -changes. - -\sphinxAtStartPar -The principal entry for each PKINIT\sphinxhyphen{}using client must be configured to -require preauthentication. Ensure this with the command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{modprinc +requires\PYGZus{}preauth YOUR\PYGZus{}PRINCNAME}\PYG{l+s+s1}{\PYGZsq{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Starting with release 1.12, it is possible to remove the long\sphinxhyphen{}term -keys of a principal entry, which can save some space in the database -and help to clarify some PKINIT\sphinxhyphen{}related error conditions by not asking -for a password: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{purgekeys \PYGZhy{}all YOUR\PYGZus{}PRINCNAME}\PYG{l+s+s1}{\PYGZsq{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -These principal options can also be specified at principal creation -time as follows: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{add\PYGZus{}principal +requires\PYGZus{}preauth \PYGZhy{}nokey YOUR\PYGZus{}PRINCNAME}\PYG{l+s+s1}{\PYGZsq{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -By default, the KDC requires PKINIT client certificates to have the -standard Extended Key Usage and Subject Alternative Name attributes -for PKINIT. Starting in release 1.16, it is possible to authorize -client certificates based on the subject or other criteria instead of -the standard PKINIT Subject Alternative Name, by setting the -\sphinxstylestrong{pkinit\_cert\_match} string attribute on each client principal entry. -For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin} \PYG{n}{set\PYGZus{}string} \PYG{n}{user}\PYG{n+nd}{@REALM} \PYG{n}{pkinit\PYGZus{}cert\PYGZus{}match} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZlt{}SUBJECT\PYGZgt{}CN=user@REALM\PYGZdl{}}\PYG{l+s+s2}{\PYGZdq{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The \sphinxstylestrong{pkinit\_cert\_match} string attribute follows the syntax used by -the {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} \sphinxstylestrong{pkinit\_cert\_match} relation. To allow the -use of non\sphinxhyphen{}PKINIT client certificates, it will also be necessary to -disable key usage checking using the \sphinxstylestrong{pkinit\_eku\_checking} relation; -for example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} - \PYG{n}{pkinit\PYGZus{}eku\PYGZus{}checking} \PYG{o}{=} \PYG{n}{none} -\end{sphinxVerbatim} - - -\section{Configuring the clients} -\label{\detokenize{admin/pkinit:configuring-the-clients}} -\sphinxAtStartPar -Client hosts must be configured to trust the issuing authority for the -KDC certificate. For a newly established certificate authority, the -client host must have filesystem access to the CA certificate -(cacert.pem) and the following relation in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} in the -appropriate {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection (with appropriate pathnames): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the KDC certificate is a commercially issued server certificate, -the issuing certificate is most likely included in a system directory. -You can specify it by filename as above, or specify the whole -directory like so: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{DIR}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{ssl}\PYG{o}{/}\PYG{n}{certs} -\end{sphinxVerbatim} - -\sphinxAtStartPar -A commercially issued server certificate will usually not have the -standard PKINIT principal name or Extended Key Usage extensions, so -the following additional configuration is required: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{pkinit\PYGZus{}eku\PYGZus{}checking} \PYG{o}{=} \PYG{n}{kpServerAuth} -\PYG{n}{pkinit\PYGZus{}kdc\PYGZus{}hostname} \PYG{o}{=} \PYG{n}{hostname}\PYG{o}{.}\PYG{n}{of}\PYG{o}{.}\PYG{n}{kdc}\PYG{o}{.}\PYG{n}{certificate} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Multiple \sphinxstylestrong{pkinit\_kdc\_hostname} relations can be configured to -recognize multiple KDC certificates. If the KDC is an Active -Directory domain controller, setting \sphinxstylestrong{pkinit\_kdc\_hostname} is -necessary, but it should not be necessary to set -\sphinxstylestrong{pkinit\_eku\_checking}. - -\sphinxAtStartPar -To perform regular (as opposed to anonymous) PKINIT authentication, a -client host must have filesystem access to a client certificate -(client.pem), and the corresponding private key (clientkey.pem). -Configure the following relations in the client host’s -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file in the appropriate {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection -(with appropriate pathnames): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{pkinit\PYGZus{}identities} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{client}\PYG{o}{.}\PYG{n}{pem}\PYG{p}{,}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{clientkey}\PYG{o}{.}\PYG{n}{pem} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the KDC and client are properly configured, it should now be -possible to run \sphinxcode{\sphinxupquote{kinit username}} without entering a password. - - -\section{Anonymous PKINIT} -\label{\detokenize{admin/pkinit:anonymous-pkinit}}\label{\detokenize{admin/pkinit:id1}} -\sphinxAtStartPar -Anonymity support in Kerberos allows a client to obtain a ticket -without authenticating as any particular principal. Such a ticket can -be used as a FAST armor ticket, or to securely communicate with an -application server anonymously. - -\sphinxAtStartPar -To configure anonymity support, you must generate or otherwise procure -a KDC certificate and configure the KDC host, but you do not need to -generate any client certificates. On the KDC, you must set the -\sphinxstylestrong{pkinit\_identity} variable to provide the KDC certificate, but do -not need to set the \sphinxstylestrong{pkinit\_anchors} variable or store the issuing -certificate if you won’t have any client certificates to verify. On -client hosts, you must set the \sphinxstylestrong{pkinit\_anchors} variable (and -possibly \sphinxstylestrong{pkinit\_kdc\_hostname} and \sphinxstylestrong{pkinit\_eku\_checking}) in order -to trust the issuing authority for the KDC certificate, but do not -need to set the \sphinxstylestrong{pkinit\_identities} variable. - -\sphinxAtStartPar -Anonymity support is not enabled by default. To enable it, you must -create the principal \sphinxcode{\sphinxupquote{WELLKNOWN/ANONYMOUS}} using the command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{addprinc \PYGZhy{}randkey WELLKNOWN/ANONYMOUS}\PYG{l+s+s1}{\PYGZsq{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Some Kerberos deployments include application servers which lack -proper access control, and grant some level of access to any user who -can authenticate. In such an environment, enabling anonymity support -on the KDC would present a security issue. If you need to enable -anonymity support for TGTs (for use as FAST armor tickets) without -enabling anonymous authentication to application servers, you can set -the variable \sphinxstylestrong{restrict\_anonymous\_to\_tgt} to \sphinxcode{\sphinxupquote{true}} in the -appropriate {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection of the KDC’s -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file. - -\sphinxAtStartPar -To obtain anonymous credentials on a client, run \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}n}}, or -\sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}n @REALMNAME}} to specify a realm. The resulting tickets -will have the client name \sphinxcode{\sphinxupquote{WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS}}. - - -\section{Freshness tokens} -\label{\detokenize{admin/pkinit:freshness-tokens}} -\sphinxAtStartPar -Freshness tokens can ensure that the client has recently had access to -its certificate private key. If freshness tokens are not required by -the KDC, a client program with temporary possession of the private key -can compose requests for future timestamps and use them later. - -\sphinxAtStartPar -In release 1.17 and later, freshness tokens are supported by the -client and are sent by the KDC when the client indicates support for -them. Because not all clients support freshness tokens yet, they are -not required by default. To check if freshness tokens are supported -by a realm’s clients, look in the KDC logs for the lines: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{PKINIT}\PYG{p}{:} \PYG{n}{freshness} \PYG{n}{token} \PYG{n}{received} \PYG{k+kn}{from} \PYG{o}{\PYGZlt{}}\PYG{n}{client} \PYG{n}{principal}\PYG{o}{\PYGZgt{}} -\PYG{n}{PKINIT}\PYG{p}{:} \PYG{n}{no} \PYG{n}{freshness} \PYG{n}{token} \PYG{n}{received} \PYG{k+kn}{from} \PYG{o}{\PYGZlt{}}\PYG{n}{client} \PYG{n}{principal}\PYG{o}{\PYGZgt{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -To require freshness tokens for all clients in a realm (except for -clients authenticating anonymously), set the -\sphinxstylestrong{pkinit\_require\_freshness} variable to \sphinxcode{\sphinxupquote{true}} in the appropriate -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection of the KDC’s {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file. To -test that this option is in effect, run \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}X disable\_freshness}} -and verify that authentication is unsuccessful. - -\sphinxstepscope - - -\chapter{OTP Preauthentication} -\label{\detokenize{admin/otp:otp-preauthentication}}\label{\detokenize{admin/otp:otp-preauth}}\label{\detokenize{admin/otp::doc}} -\sphinxAtStartPar -OTP is a preauthentication mechanism for Kerberos 5 which uses One -Time Passwords (OTP) to authenticate the client to the KDC. The OTP -is passed to the KDC over an encrypted FAST channel in clear\sphinxhyphen{}text. -The KDC uses the password along with per\sphinxhyphen{}user configuration to proxy -the request to a third\sphinxhyphen{}party RADIUS system. This enables -out\sphinxhyphen{}of\sphinxhyphen{}the\sphinxhyphen{}box compatibility with a large number of already widely -deployed proprietary systems. - -\sphinxAtStartPar -Additionally, our implementation of the OTP system allows for the -passing of RADIUS requests over a UNIX domain stream socket. This -permits the use of a local companion daemon which can handle the -details of authentication. - - -\section{Defining token types} -\label{\detokenize{admin/otp:defining-token-types}} -\sphinxAtStartPar -Token types are defined in either {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} or -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} according to the following format: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{otp}\PYG{p}{]} - \PYG{o}{\PYGZlt{}}\PYG{n}{name}\PYG{o}{\PYGZgt{}} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{server} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{host}\PYG{p}{:}\PYG{n}{port} \PYG{o+ow}{or} \PYG{n}{filename}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{n}{see} \PYG{n}{below}\PYG{p}{)} - \PYG{n}{secret} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{filename}\PYG{o}{\PYGZgt{}} - \PYG{n}{timeout} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{integer}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{l+m+mi}{5} \PYG{p}{[}\PYG{n}{seconds}\PYG{p}{]}\PYG{p}{)} - \PYG{n}{retries} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{integer}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{l+m+mi}{3}\PYG{p}{)} - \PYG{n}{strip\PYGZus{}realm} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{boolean}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{n}{true}\PYG{p}{)} - \PYG{n}{indicator} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{n}{none}\PYG{p}{)} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the server field begins with ‘/’, it will be interpreted as a UNIX -socket. Otherwise, it is assumed to be in the format host:port. When -a UNIX domain socket is specified, the secret field is optional and an -empty secret is used by default. If the server field is not -specified, it defaults to {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{RUNSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/\textless{}name\textgreater{}.socket}}. - -\sphinxAtStartPar -When forwarding the request over RADIUS, by default the principal is -used in the User\sphinxhyphen{}Name attribute of the RADIUS packet. The strip\_realm -parameter controls whether the principal is forwarded with or without -the realm portion. - -\sphinxAtStartPar -If an indicator field is present, tickets issued using this token type -will be annotated with the specified authentication indicator (see -{\hyperref[\detokenize{admin/auth_indicator:auth-indicator}]{\sphinxcrossref{\DUrole{std,std-ref}{Authentication indicators}}}}). This key may be specified multiple times to -add multiple indicators. - - -\section{The default token type} -\label{\detokenize{admin/otp:the-default-token-type}} -\sphinxAtStartPar -A default token type is used internally when no token type is specified for a -given user. It is defined as follows: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{otp}\PYG{p}{]} - \PYG{n}{DEFAULT} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{strip\PYGZus{}realm} \PYG{o}{=} \PYG{n}{false} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The administrator may override the internal \sphinxcode{\sphinxupquote{DEFAULT}} token type -simply by defining a configuration with the same name. - - -\section{Token instance configuration} -\label{\detokenize{admin/otp:token-instance-configuration}} -\sphinxAtStartPar -To enable OTP for a client principal, the administrator must define -the \sphinxstylestrong{otp} string attribute for that principal. (See -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:set-string}]{\sphinxcrossref{\DUrole{std,std-ref}{set\_string}}}}.) The \sphinxstylestrong{otp} user string is a JSON string of the -format: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -[\PYGZob{} -\PYG{+w}{ }\PYGZdq{}type\PYGZdq{}:\PYG{+w}{ }\PYG{n+nt}{\PYGZlt{}string}\PYG{n+nt}{\PYGZgt{}}, -\PYG{+w}{ }\PYGZdq{}username\PYGZdq{}:\PYG{+w}{ }\PYG{n+nt}{\PYGZlt{}string}\PYG{n+nt}{\PYGZgt{}}, -\PYG{+w}{ }\PYGZdq{}indicators\PYGZdq{}:\PYG{+w}{ }[\PYG{n+nt}{\PYGZlt{}string}\PYG{n+nt}{\PYGZgt{}},\PYG{+w}{ }...] -\PYG{+w}{ }\PYGZcb{},\PYG{+w}{ }...] -\end{sphinxVerbatim} - -\sphinxAtStartPar -This is an array of token objects. Both fields of token objects are -optional. The \sphinxstylestrong{type} field names the token type of this token; if -not specified, it defaults to \sphinxcode{\sphinxupquote{DEFAULT}}. The \sphinxstylestrong{username} field -specifies the value to be sent in the User\sphinxhyphen{}Name RADIUS attribute. If -not specified, the principal name is sent, with or without realm as -defined in the token type. The \sphinxstylestrong{indicators} field specifies a list -of authentication indicators to annotate tickets with, overriding any -indicators specified in the token type. - -\sphinxAtStartPar -For ease of configuration, an empty array (\sphinxcode{\sphinxupquote{{[}{]}}}) is treated as -equivalent to one DEFAULT token (\sphinxcode{\sphinxupquote{{[}\{\}{]}}}). - - -\section{Other considerations} -\label{\detokenize{admin/otp:other-considerations}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -FAST is required for OTP to work. - -\end{enumerate} - -\sphinxstepscope - - -\chapter{SPAKE Preauthentication} -\label{\detokenize{admin/spake:spake-preauthentication}}\label{\detokenize{admin/spake:spake}}\label{\detokenize{admin/spake::doc}} -\sphinxAtStartPar -SPAKE preauthentication (added in release 1.17) uses public key -cryptography techniques to protect against {\hyperref[\detokenize{admin/dictionary:dictionary}]{\sphinxcrossref{\DUrole{std,std-ref}{password dictionary -attacks}}}}. Unlike {\hyperref[\detokenize{admin/pkinit:pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{PKINIT}}}}, it does not -require any additional infrastructure such as certificates; it simply -needs to be turned on. Using SPAKE preauthentication may modestly -increase the CPU and network load on the KDC. - -\sphinxAtStartPar -SPAKE preauthentication can use one of four elliptic curve groups for -its password\sphinxhyphen{}authenticated key exchange. The recommended group is -\sphinxcode{\sphinxupquote{edwards25519}}; three NIST curves (\sphinxcode{\sphinxupquote{P\sphinxhyphen{}256}}, \sphinxcode{\sphinxupquote{P\sphinxhyphen{}384}}, and -\sphinxcode{\sphinxupquote{P\sphinxhyphen{}521}}) are also supported. - -\sphinxAtStartPar -By default, SPAKE with the \sphinxcode{\sphinxupquote{edwards25519}} group is enabled on -clients, but the KDC does not offer SPAKE by default. To turn it on, -set the \sphinxstylestrong{spake\_preauth\_groups} variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} to a -list of allowed groups. This variable affects both the client and the -KDC. Simply setting it to \sphinxcode{\sphinxupquote{edwards25519}} is recommended: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} - \PYG{n}{spake\PYGZus{}preauth\PYGZus{}groups} \PYG{o}{=} \PYG{n}{edwards25519} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Set the \sphinxstylestrong{+requires\_preauth} and \sphinxstylestrong{\sphinxhyphen{}allow\_svr} flags on client -principal entries, as you would for any preauthentication mechanism: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}svr} \PYG{n}{PRINCNAME} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Clients which do not implement SPAKE preauthentication will fall back -to encrypted timestamp. - -\sphinxAtStartPar -An active attacker can force a fallback to encrypted timestamp by -modifying the initial KDC response, defeating the protection against -dictionary attacks. To prevent this fallback on clients which do -implement SPAKE preauthentication, set the -\sphinxstylestrong{disable\_encrypted\_timestamp} variable to \sphinxcode{\sphinxupquote{true}} in the -{\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection for realms whose KDCs offer SPAKE -preauthentication. - -\sphinxAtStartPar -By default, SPAKE preauthentication requires an extra network round -trip to the KDC during initial authentication. If most of the clients -in a realm support SPAKE, this extra round trip can be eliminated -using an optimistic challenge, by setting the -\sphinxstylestrong{spake\_preauth\_kdc\_challenge} variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdcdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}kdcdefaults{]}}}}} to a -single group name: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} - \PYG{n}{spake\PYGZus{}preauth\PYGZus{}kdc\PYGZus{}challenge} \PYG{o}{=} \PYG{n}{edwards25519} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Using optimistic challenge will cause the KDC to do extra work for -initial authentication requests that do not result in SPAKE -preauthentication, but will save work when SPAKE preauthentication is -used. - -\sphinxstepscope - - -\chapter{Addressing dictionary attack risks} -\label{\detokenize{admin/dictionary:addressing-dictionary-attack-risks}}\label{\detokenize{admin/dictionary:dictionary}}\label{\detokenize{admin/dictionary::doc}} -\sphinxAtStartPar -Kerberos initial authentication is normally secured using the client -principal’s long\sphinxhyphen{}term key, which for users is generally derived from a -password. Using a pasword\sphinxhyphen{}derived long\sphinxhyphen{}term key carries the risk of a -dictionary attack, where an attacker tries a sequence of possible -passwords, possibly requiring much less effort than would be required -to try all possible values of the key. Even if {\hyperref[\detokenize{admin/database:policies}]{\sphinxcrossref{\DUrole{std,std-ref}{password policy -objects}}}} are used to force users not to pick trivial -passwords, dictionary attacks can sometimes be successful against a -significant fraction of the users in a realm. Dictionary attacks are -not a concern for principals using random keys. - -\sphinxAtStartPar -A dictionary attack may be online or offline. An online dictionary -attack is performed by trying each password in a separate request to -the KDC, and is therefore visible to the KDC and also limited in speed -by the KDC’s processing power and the network capacity between the -client and the KDC. Online dictionary attacks can be mitigated using -{\hyperref[\detokenize{admin/lockout:lockout}]{\sphinxcrossref{\DUrole{std,std-ref}{account lockout}}}}. This measure is not totally -satisfactory, as it makes it easy for an attacker to deny access to a -client principal. - -\sphinxAtStartPar -An offline dictionary attack is performed by obtaining a ciphertext -generated using the password\sphinxhyphen{}derived key, and trying each password -against the ciphertext. This category of attack is invisible to the -KDC and can be performed much faster than an online attack. The -attack will generally take much longer with more recent encryption -types (particularly the ones based on AES), because those encryption -types use a much more expensive string\sphinxhyphen{}to\sphinxhyphen{}key function. However, the -best defense is to deny the attacker access to a useful ciphertext. -The required defensive measures depend on the attacker’s level of -network access. - -\sphinxAtStartPar -An off\sphinxhyphen{}path attacker has no access to packets sent between legitimate -users and the KDC. An off\sphinxhyphen{}path attacker could gain access to an -attackable ciphertext either by making an AS request for a client -principal which does not have the \sphinxstylestrong{+requires\_preauth} flag, or by -making a TGS request (after authenticating as a different user) for a -server principal which does not have the \sphinxstylestrong{\sphinxhyphen{}allow\_svr} flag. To -address off\sphinxhyphen{}path attackers, a KDC administrator should set those flags -on principals with password\sphinxhyphen{}derived keys: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{add\PYGZus{}principal} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}svr} \PYG{n}{princname} -\end{sphinxVerbatim} - -\sphinxAtStartPar -An attacker with passive network access (one who can monitor packets -sent between legitimate users and the KDC, but cannot change them or -insert their own packets) can gain access to an attackable ciphertext -by observing an authentication by a user using the most common form of -preauthentication, encrypted timestamp. Any of the following methods -can prevent dictionary attacks by attackers with passive network -access: -\begin{itemize} -\item {} -\sphinxAtStartPar -Enabling {\hyperref[\detokenize{admin/spake:spake}]{\sphinxcrossref{\DUrole{std,std-ref}{SPAKE preauthentication}}}} (added in release -1.17) on the KDC, and ensuring that all clients are able to support -it. - -\item {} -\sphinxAtStartPar -Using an {\hyperref[\detokenize{admin/https:https}]{\sphinxcrossref{\DUrole{std,std-ref}{HTTPS proxy}}}} for communication with the KDC, -if the attacker cannot monitor communication between the proxy -server and the KDC. - -\item {} -\sphinxAtStartPar -Using FAST, protecting the initial authentication with either a -random key (such as a host key) or with {\hyperref[\detokenize{admin/pkinit:anonymous-pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{anonymous PKINIT}}}}. - -\end{itemize} - -\sphinxAtStartPar -An attacker with active network access (one who can inject or modify -packets sent between legitimate users and the KDC) can try to fool the -client software into sending an attackable ciphertext using an -encryption type and salt string of the attacker’s choosing. Any of the -following methods can prevent dictionary attacks by active attackers: -\begin{itemize} -\item {} -\sphinxAtStartPar -Enabling SPAKE preauthentication and setting the -\sphinxstylestrong{disable\_encrypted\_timestamp} variable to \sphinxcode{\sphinxupquote{true}} in the -{\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection of the client configuration. - -\item {} -\sphinxAtStartPar -Using an HTTPS proxy as described above, configured in the client’s -krb5.conf realm configuration. If {\hyperref[\detokenize{admin/realm_config:kdc-discovery}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC discovery}}}} is used to locate a proxy server, an active -attacker may be able to use DNS spoofing to cause the client to use -a different HTTPS server or to not use HTTPS. - -\item {} -\sphinxAtStartPar -Using FAST as described above. - -\end{itemize} - -\sphinxAtStartPar -If {\hyperref[\detokenize{admin/pkinit:pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{PKINIT}}}} or {\hyperref[\detokenize{admin/otp:otp-preauth}]{\sphinxcrossref{\DUrole{std,std-ref}{OTP}}}} are used for -initial authentication, the principal’s long\sphinxhyphen{}term keys are not used -and dictionary attacks are usually not a concern. - -\sphinxstepscope - - -\chapter{Principal names and DNS} -\label{\detokenize{admin/princ_dns:principal-names-and-dns}}\label{\detokenize{admin/princ_dns::doc}} -\sphinxAtStartPar -Kerberos clients can do DNS lookups to canonicalize service principal -names. This can cause difficulties when setting up Kerberos -application servers, especially when the client’s name for the service -is different from what the service thinks its name is. - - -\section{Service principal names} -\label{\detokenize{admin/princ_dns:service-principal-names}} -\sphinxAtStartPar -A frequently used kind of principal name is the host\sphinxhyphen{}based service -principal name. This kind of principal name has two components: a -service name and a hostname. For example, \sphinxcode{\sphinxupquote{imap/imap.example.com}} -is the principal name of the “imap” service on the host -“imap.example.com”. Other possible service names for the first -component include “host” (remote login services such as ssh), “HTTP”, -and “nfs” (Network File System). - -\sphinxAtStartPar -Service administrators often publish well\sphinxhyphen{}known hostname aliases that -they would prefer users to use instead of the canonical name of the -service host. This gives service administrators more flexibility in -deploying services. For example, a shell login server might be named -“long\sphinxhyphen{}vanity\sphinxhyphen{}hostname.example.com”, but users will naturally prefer to -type something like “login.example.com”. Hostname aliases also allow -for administrators to set up load balancing for some sorts of services -based on rotating \sphinxcode{\sphinxupquote{CNAME}} records in DNS. - - -\section{Service principal canonicalization} -\label{\detokenize{admin/princ_dns:service-principal-canonicalization}} -\sphinxAtStartPar -In the MIT krb5 client library, canonicalization of host\sphinxhyphen{}based service -principals is controlled by the \sphinxstylestrong{dns\_canonicalize\_hostname}, -\sphinxstylestrong{rnds}, and \sphinxstylestrong{qualify\_shortname} variables in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}. - -\sphinxAtStartPar -If \sphinxstylestrong{dns\_canonicalize\_hostname} is set to \sphinxcode{\sphinxupquote{true}} (the default -value), the client performs forward resolution by looking up the IPv4 -and/or IPv6 addresses of the hostname using \sphinxcode{\sphinxupquote{getaddrinfo()}}. This -process will typically add a domain suffix to the hostname if needed, -and follow CNAME records in the DNS. If \sphinxstylestrong{rdns} is also set to -\sphinxcode{\sphinxupquote{true}} (the default), the client will then perform a reverse lookup -of the first returned Internet address using \sphinxcode{\sphinxupquote{getnameinfo()}}, -finding the name associated with the PTR record. - -\sphinxAtStartPar -If \sphinxstylestrong{dns\_canonicalize\_hostname} is set to \sphinxcode{\sphinxupquote{false}}, the hostname is -not canonicalized using DNS. If the hostname has only one component -(i.e. it contains no “.” characters), the host’s primary DNS search -domain will be appended, if there is one. The \sphinxstylestrong{qualify\_shortname} -variable can be used to override or disable this suffix. - -\sphinxAtStartPar -If \sphinxstylestrong{dns\_canonicalize\_hostname} is set to \sphinxcode{\sphinxupquote{fallback}} (added in -release 1.18), the hostname is initially treated according to the -rules for \sphinxcode{\sphinxupquote{dns\_canonicalize\_hostname=false}}. If a ticket request -fails because the service principal is unknown, the hostname will be -canonicalized according to the rules for -\sphinxcode{\sphinxupquote{dns\_canonicalize\_hostname=true}} and the request will be retried. - -\sphinxAtStartPar -In all cases, the hostname is converted to lowercase, and any trailing -dot is removed. - - -\section{Reverse DNS mismatches} -\label{\detokenize{admin/princ_dns:reverse-dns-mismatches}} -\sphinxAtStartPar -Sometimes, an enterprise will have control over its forward DNS but -not its reverse DNS. The reverse DNS is sometimes under the control -of the Internet service provider of the enterprise, and the enterprise -may not have much influence in setting up reverse DNS records for its -address space. If there are difficulties with getting forward and -reverse DNS to match, it is best to set \sphinxcode{\sphinxupquote{rdns = false}} on client -machines. - - -\section{Overriding application behavior} -\label{\detokenize{admin/princ_dns:overriding-application-behavior}} -\sphinxAtStartPar -Applications can choose to use a default hostname component in their -service principal name when accepting authentication, which avoids -some sorts of hostname mismatches. Because not all relevant -applications do this yet, using the {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} setting: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} - \PYG{n}{ignore\PYGZus{}acceptor\PYGZus{}hostname} \PYG{o}{=} \PYG{n}{true} -\end{sphinxVerbatim} - -\sphinxAtStartPar -will allow the Kerberos library to override the application’s choice -of service principal hostname and will allow a server program to -accept incoming authentications using any key in its keytab that -matches the service name and realm name (if given). This setting -defaults to “false” and is available in releases krb5\sphinxhyphen{}1.10 and later. - - -\section{Provisioning keytabs} -\label{\detokenize{admin/princ_dns:provisioning-keytabs}} -\sphinxAtStartPar -One service principal entry that should be in the keytab is a -principal whose hostname component is the canonical hostname that -\sphinxcode{\sphinxupquote{getaddrinfo()}} reports for all known aliases for the host. If the -reverse DNS information does not match this canonical hostname, an -additional service principal entry should be in the keytab for this -different hostname. - - -\section{Specific application advice} -\label{\detokenize{admin/princ_dns:specific-application-advice}} - -\subsection{Secure shell (ssh)} -\label{\detokenize{admin/princ_dns:secure-shell-ssh}} -\sphinxAtStartPar -Setting \sphinxcode{\sphinxupquote{GSSAPIStrictAcceptorCheck = no}} in the configuration file -of modern versions of the openssh daemon will allow the daemon to try -any key in its keytab when accepting a connection, rather than looking -for the keytab entry that matches the host’s own idea of its name -(typically the name that \sphinxcode{\sphinxupquote{gethostname()}} returns). This requires -krb5\sphinxhyphen{}1.10 or later. - - -\subsection{OpenLDAP (ldapsearch, etc.)} -\label{\detokenize{admin/princ_dns:openldap-ldapsearch-etc}} -\sphinxAtStartPar -OpenLDAP’s SASL implementation performs reverse DNS lookup in order to -canonicalize service principal names, even if \sphinxstylestrong{rdns} is set to -\sphinxcode{\sphinxupquote{false}} in the Kerberos configuration. To disable this behavior, -add \sphinxcode{\sphinxupquote{SASL\_NOCANON on}} to \sphinxcode{\sphinxupquote{ldap.conf}}, or set the -\sphinxcode{\sphinxupquote{LDAPSASL\_NOCANON}} environment variable. - -\sphinxstepscope - - -\chapter{Encryption types} -\label{\detokenize{admin/enctypes:encryption-types}}\label{\detokenize{admin/enctypes:enctypes}}\label{\detokenize{admin/enctypes::doc}} -\sphinxAtStartPar -Kerberos can use a variety of cipher algorithms to protect data. A -Kerberos \sphinxstylestrong{encryption type} (also known as an \sphinxstylestrong{enctype}) is a -specific combination of a cipher algorithm with an integrity algorithm -to provide both confidentiality and integrity to data. - - -\section{Enctypes in requests} -\label{\detokenize{admin/enctypes:enctypes-in-requests}} -\sphinxAtStartPar -Clients make two types of requests (KDC\sphinxhyphen{}REQ) to the KDC: AS\sphinxhyphen{}REQs and -TGS\sphinxhyphen{}REQs. The client uses the AS\sphinxhyphen{}REQ to obtain initial tickets -(typically a Ticket\sphinxhyphen{}Granting Ticket (TGT)), and uses the TGS\sphinxhyphen{}REQ to -obtain service tickets. - -\sphinxAtStartPar -The KDC uses three different keys when issuing a ticket to a client: -\begin{itemize} -\item {} -\sphinxAtStartPar -The long\sphinxhyphen{}term key of the service: the KDC uses this to encrypt the -actual service ticket. The KDC only uses the first long\sphinxhyphen{}term key in -the most recent kvno for this purpose. - -\item {} -\sphinxAtStartPar -The session key: the KDC randomly chooses this key and places one -copy inside the ticket and the other copy inside the encrypted part -of the reply. - -\item {} -\sphinxAtStartPar -The reply\sphinxhyphen{}encrypting key: the KDC uses this to encrypt the reply it -sends to the client. For AS replies, this is a long\sphinxhyphen{}term key of the -client principal. For TGS replies, this is either the session key of the -authenticating ticket, or a subsession key. - -\end{itemize} - -\sphinxAtStartPar -Each of these keys is of a specific enctype. - -\sphinxAtStartPar -Each request type allows the client to submit a list of enctypes that -it is willing to accept. For the AS\sphinxhyphen{}REQ, this list affects both the -session key selection and the reply\sphinxhyphen{}encrypting key selection. For the -TGS\sphinxhyphen{}REQ, this list only affects the session key selection. - - -\section{Session key selection} -\label{\detokenize{admin/enctypes:session-key-selection}}\label{\detokenize{admin/enctypes:id1}} -\sphinxAtStartPar -The KDC chooses the session key enctype by taking the intersection of -its \sphinxstylestrong{permitted\_enctypes} list, the list of long\sphinxhyphen{}term keys for the -most recent kvno of the service, and the client’s requested list of -enctypes. Starting in krb5\sphinxhyphen{}1.21, all services are assumed to support -aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96; also, des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 and arcfour\sphinxhyphen{}hmac session -keys will not be issued by default. - -\sphinxAtStartPar -Starting in krb5\sphinxhyphen{}1.11, it is possible to set a string attribute on a -service principal to control what session key enctypes the KDC may -issue for service tickets for that principal, overriding the service’s -long\sphinxhyphen{}term keys and the assumption of aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 support. -See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:set-string}]{\sphinxcrossref{\DUrole{std,std-ref}{set\_string}}}} in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for details. - - -\section{Choosing enctypes for a service} -\label{\detokenize{admin/enctypes:choosing-enctypes-for-a-service}} -\sphinxAtStartPar -Generally, a service should have a key of the strongest -enctype that both it and the KDC support. If the KDC is running a -release earlier than krb5\sphinxhyphen{}1.11, it is also useful to generate an -additional key for each enctype that the service can support. The KDC -will only use the first key in the list of long\sphinxhyphen{}term keys for encrypting -the service ticket, but the additional long\sphinxhyphen{}term keys indicate the -other enctypes that the service supports. - -\sphinxAtStartPar -As noted above, starting with release krb5\sphinxhyphen{}1.11, there are additional -configuration settings that control session key enctype selection -independently of the set of long\sphinxhyphen{}term keys that the KDC has stored for -a service principal. - - -\section{Configuration variables} -\label{\detokenize{admin/enctypes:configuration-variables}} -\sphinxAtStartPar -The following \sphinxcode{\sphinxupquote{{[}libdefaults{]}}} settings in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} will -affect how enctypes are chosen. -\begin{description} -\sphinxlineitem{\sphinxstylestrong{allow\_weak\_crypto}} -\sphinxAtStartPar -defaults to \sphinxstyleemphasis{false} starting with krb5\sphinxhyphen{}1.8. When \sphinxstyleemphasis{false}, removes -weak enctypes from \sphinxstylestrong{permitted\_enctypes}, -\sphinxstylestrong{default\_tkt\_enctypes}, and \sphinxstylestrong{default\_tgs\_enctypes}. Do not -set this to \sphinxstyleemphasis{true} unless the use of weak enctypes is an -acceptable risk for your environment and the weak enctypes are -required for backward compatibility. - -\sphinxlineitem{\sphinxstylestrong{allow\_des3}} -\sphinxAtStartPar -was added in release 1.21 and defaults to \sphinxstyleemphasis{false}. Unless this -flag is set to \sphinxstyleemphasis{true}, the KDC will not issue tickets with -des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 session keys. In a future release, this flag will -control whether des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 is permitted in similar fashion to -weak enctypes. - -\sphinxlineitem{\sphinxstylestrong{allow\_rc4}} -\sphinxAtStartPar -was added in release 1.21 and defaults to \sphinxstyleemphasis{false}. Unless this -flag is set to \sphinxstyleemphasis{true}, the KDC will not issue tickets with -arcfour\sphinxhyphen{}hmac session keys. In a future release, this flag will -control whether arcfour\sphinxhyphen{}hmac is permitted in similar fashion to -weak enctypes. - -\sphinxlineitem{\sphinxstylestrong{permitted\_enctypes}} -\sphinxAtStartPar -controls the set of enctypes that a service will permit for -session keys and for ticket and authenticator encryption. The KDC -and other programs that access the Kerberos database will ignore -keys of non\sphinxhyphen{}permitted enctypes. Starting in release 1.18, this -setting also acts as the default for \sphinxstylestrong{default\_tkt\_enctypes} and -\sphinxstylestrong{default\_tgs\_enctypes}. - -\sphinxlineitem{\sphinxstylestrong{default\_tkt\_enctypes}} -\sphinxAtStartPar -controls the default set of enctypes that the Kerberos client -library requests when making an AS\sphinxhyphen{}REQ. Do not set this unless -required for specific backward compatibility purposes; stale -values of this setting can prevent clients from taking advantage -of new stronger enctypes when the libraries are upgraded. - -\sphinxlineitem{\sphinxstylestrong{default\_tgs\_enctypes}} -\sphinxAtStartPar -controls the default set of enctypes that the Kerberos client -library requests when making a TGS\sphinxhyphen{}REQ. Do not set this unless -required for specific backward compatibility purposes; stale -values of this setting can prevent clients from taking advantage -of new stronger enctypes when the libraries are upgraded. - -\end{description} - -\sphinxAtStartPar -The following per\sphinxhyphen{}realm setting in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} affects the -generation of long\sphinxhyphen{}term keys. -\begin{description} -\sphinxlineitem{\sphinxstylestrong{supported\_enctypes}} -\sphinxAtStartPar -controls the default set of enctype\sphinxhyphen{}salttype pairs that {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} -will use for generating long\sphinxhyphen{}term keys, either randomly or from -passwords - -\end{description} - - -\section{Enctype compatibility} -\label{\detokenize{admin/enctypes:enctype-compatibility}} -\sphinxAtStartPar -See {\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} for additional information about enctypes. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TTTT} -\sphinxtoprule -\sphinxstyletheadfamily -\sphinxAtStartPar -enctype -&\sphinxstyletheadfamily -\sphinxAtStartPar -weak? -&\sphinxstyletheadfamily -\sphinxAtStartPar -krb5 -&\sphinxstyletheadfamily -\sphinxAtStartPar -Windows -\\ -\sphinxmidrule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -des\sphinxhyphen{}cbc\sphinxhyphen{}crc -& -\sphinxAtStartPar -weak -& -\sphinxAtStartPar -\textless{}1.18 -& -\sphinxAtStartPar -\textgreater{}=2000 -\\ -\sphinxhline -\sphinxAtStartPar -des\sphinxhyphen{}cbc\sphinxhyphen{}md4 -& -\sphinxAtStartPar -weak -& -\sphinxAtStartPar -\textless{}1.18 -& -\sphinxAtStartPar -? -\\ -\sphinxhline -\sphinxAtStartPar -des\sphinxhyphen{}cbc\sphinxhyphen{}md5 -& -\sphinxAtStartPar -weak -& -\sphinxAtStartPar -\textless{}1.18 -& -\sphinxAtStartPar -\textgreater{}=2000 -\\ -\sphinxhline -\sphinxAtStartPar -des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 -& -\sphinxAtStartPar -deprecated -& -\sphinxAtStartPar -\textgreater{}=1.1 -& -\sphinxAtStartPar -none -\\ -\sphinxhline -\sphinxAtStartPar -arcfour\sphinxhyphen{}hmac -& -\sphinxAtStartPar -deprecated -& -\sphinxAtStartPar -\textgreater{}=1.3 -& -\sphinxAtStartPar -\textgreater{}=2000 -\\ -\sphinxhline -\sphinxAtStartPar -arcfour\sphinxhyphen{}hmac\sphinxhyphen{}exp -& -\sphinxAtStartPar -weak -& -\sphinxAtStartPar -\textgreater{}=1.3 -& -\sphinxAtStartPar -\textgreater{}=2000 -\\ -\sphinxhline -\sphinxAtStartPar -aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 -&& -\sphinxAtStartPar -\textgreater{}=1.3 -& -\sphinxAtStartPar -\textgreater{}=Vista -\\ -\sphinxhline -\sphinxAtStartPar -aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 -&& -\sphinxAtStartPar -\textgreater{}=1.3 -& -\sphinxAtStartPar -\textgreater{}=Vista -\\ -\sphinxhline -\sphinxAtStartPar -aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 -&& -\sphinxAtStartPar -\textgreater{}=1.15 -& -\sphinxAtStartPar -none -\\ -\sphinxhline -\sphinxAtStartPar -aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 -&& -\sphinxAtStartPar -\textgreater{}=1.15 -& -\sphinxAtStartPar -none -\\ -\sphinxhline -\sphinxAtStartPar -camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac -&& -\sphinxAtStartPar -\textgreater{}=1.9 -& -\sphinxAtStartPar -none -\\ -\sphinxhline -\sphinxAtStartPar -camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac -&& -\sphinxAtStartPar -\textgreater{}=1.9 -& -\sphinxAtStartPar -none -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxAtStartPar -krb5 releases 1.18 and later do not support single\sphinxhyphen{}DES. krb5 releases -1.8 and later disable the single\sphinxhyphen{}DES enctypes by default. Microsoft -Windows releases Windows 7 and later disable single\sphinxhyphen{}DES enctypes by -default. - -\sphinxAtStartPar -krb5 releases 1.17 and later flag deprecated encryption types -(including \sphinxcode{\sphinxupquote{des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1}} and \sphinxcode{\sphinxupquote{arcfour\sphinxhyphen{}hmac}}) in KDC logs and -kadmin output. krb5 release 1.19 issues a warning during initial -authentication if \sphinxcode{\sphinxupquote{des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1}} is used. Future releases will -disable \sphinxcode{\sphinxupquote{des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1}} by default and eventually remove support for -it. - - -\section{Migrating away from older encryption types} -\label{\detokenize{admin/enctypes:migrating-away-from-older-encryption-types}} -\sphinxAtStartPar -Administrator intervention may be required to migrate a realm away -from legacy encryption types, especially if the realm was created -using krb5 release 1.2 or earlier. This migration should be performed -before upgrading to krb5 versions which disable or remove support for -legacy encryption types. - -\sphinxAtStartPar -If there is a \sphinxstylestrong{supported\_enctypes} setting in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} on -the KDC, make sure that it does not include weak or deprecated -encryption types. This will ensure that newly created keys do not use -those encryption types by default. - -\sphinxAtStartPar -Check the \sphinxcode{\sphinxupquote{krbtgt/REALM}} principal using the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} -\sphinxstylestrong{getprinc} command. If it lists a weak or deprecated encryption -type as the first key, it must be migrated using the procedure in -{\hyperref[\detokenize{admin/database:changing-krbtgt-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Changing the krbtgt key}}}}. - -\sphinxAtStartPar -Check the \sphinxcode{\sphinxupquote{kadmin/history}} principal, which should have only one key -entry. If it uses a weak or deprecated encryption type, it should be -upgraded following the notes in {\hyperref[\detokenize{admin/database:updating-history-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Updating the history key}}}}. - -\sphinxAtStartPar -Check the other kadmin principals: kadmin/changepw, kadmin/admin, and -any kadmin/hostname principals that may exist. These principals can -be upgraded with \sphinxstylestrong{change\_password \sphinxhyphen{}randkey} in kadmin. - -\sphinxAtStartPar -Check the \sphinxcode{\sphinxupquote{K/M}} entry. If it uses a weak or deprecated encryption -type, it should be upgraded following the procedure in -{\hyperref[\detokenize{admin/database:updating-master-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Updating the master key}}}}. - -\sphinxAtStartPar -User and service principals using legacy encryption types can be -enumerated with the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} \sphinxstylestrong{tabdump keyinfo} command. - -\sphinxAtStartPar -Service principals can be migrated with a keytab rotation on the -service host, which can be accomplished using the {\hyperref[\detokenize{admin/admin_commands/k5srvutil:k5srvutil-1}]{\sphinxcrossref{\DUrole{std,std-ref}{k5srvutil}}}} -\sphinxstylestrong{change} and \sphinxstylestrong{delold} commands. Allow enough time for existing -tickets to expire between the change and delold operations. - -\sphinxAtStartPar -User principals with password\sphinxhyphen{}based keys can be migrated with a -password change. The realm administrator can set a password -expiration date using the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{modify\_principal -\sphinxhyphen{}pwexpire} command to force a password change. - -\sphinxAtStartPar -If a legacy encryption type has not yet been disabled by default in -the version of krb5 running on the KDC, it can be disabled -administratively with the \sphinxstylestrong{permitted\_enctypes} variable. For -example, setting \sphinxstylestrong{permitted\_enctypes} to \sphinxcode{\sphinxupquote{DEFAULT \sphinxhyphen{}des3 \sphinxhyphen{}rc4}} will -cause any database keys of the triple\sphinxhyphen{}DES and RC4 encryption types to -be ignored. - -\sphinxstepscope - - -\chapter{HTTPS proxy configuration} -\label{\detokenize{admin/https:https-proxy-configuration}}\label{\detokenize{admin/https:https}}\label{\detokenize{admin/https::doc}} -\sphinxAtStartPar -In addition to being able to use UDP or TCP to communicate directly -with a KDC as is outlined in RFC4120, and with kpasswd services in a -similar fashion, the client libraries can attempt to use an HTTPS -proxy server to communicate with a KDC or kpasswd service, using the -protocol outlined in {[}MS\sphinxhyphen{}KKDCP{]}. - -\sphinxAtStartPar -Communicating with a KDC through an HTTPS proxy allows clients to -contact servers when network firewalls might otherwise prevent them -from doing so. The use of TLS also encrypts all traffic between the -clients and the KDC, preventing observers from conducting password -dictionary attacks or from observing the client and server principals -being authenticated, at additional computational cost to both clients -and servers. - -\sphinxAtStartPar -An HTTPS proxy server is provided as a feature in some versions of -Microsoft Windows Server, and a WSGI implementation named \sphinxtitleref{kdcproxy} -is available in the python package index. - - -\section{Configuring the clients} -\label{\detokenize{admin/https:configuring-the-clients}} -\sphinxAtStartPar -To use an HTTPS proxy, a client host must trust the CA which issued -that proxy’s SSL certificate. If that CA’s certificate is not in the -system\sphinxhyphen{}wide default set of trusted certificates, configure the -following relation in the client host’s {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file in -the appropriate {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{http\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Adjust the pathname to match the path of the file which contains a -copy of the CA’s certificate. The \sphinxtitleref{http\_anchors} option is documented -more fully in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. - -\sphinxAtStartPar -Configure the client to access the KDC and kpasswd service by -specifying their locations in its {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file in the form -of HTTPS URLs for the proxy server: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdc} \PYG{o}{=} \PYG{n}{https}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{server}\PYG{o}{.}\PYG{n}{fqdn}\PYG{o}{/}\PYG{n}{KdcProxy} -\PYG{n}{kpasswd\PYGZus{}server} \PYG{o}{=} \PYG{n}{https}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{server}\PYG{o}{.}\PYG{n}{fqdn}\PYG{o}{/}\PYG{n}{KdcProxy} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the proxy and client are properly configured, client commands such -as \sphinxcode{\sphinxupquote{kinit}}, \sphinxcode{\sphinxupquote{kvno}}, and \sphinxcode{\sphinxupquote{kpasswd}} should all function normally. - -\sphinxstepscope - - -\chapter{Authentication indicators} -\label{\detokenize{admin/auth_indicator:authentication-indicators}}\label{\detokenize{admin/auth_indicator:auth-indicator}}\label{\detokenize{admin/auth_indicator::doc}} -\sphinxAtStartPar -As of release 1.14, the KDC can be configured to annotate tickets if -the client authenticated using a stronger preauthentication mechanism -such as {\hyperref[\detokenize{admin/pkinit:pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{PKINIT}}}} or {\hyperref[\detokenize{admin/otp:otp-preauth}]{\sphinxcrossref{\DUrole{std,std-ref}{OTP}}}}. These -annotations are called “authentication indicators.” Service -principals can be configured to require particular authentication -indicators in order to authenticate to that service. An -authentication indicator value can be any string chosen by the KDC -administrator; there are no pre\sphinxhyphen{}set values. - -\sphinxAtStartPar -To use authentication indicators with PKINIT or OTP, first configure -the KDC to include an indicator when that preauthentication mechanism -is used. For PKINIT, use the \sphinxstylestrong{pkinit\_indicator} variable in -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. For OTP, use the \sphinxstylestrong{indicator} variable in the -token type definition, or specify the indicators in the \sphinxstylestrong{otp} user -string as described in {\hyperref[\detokenize{admin/otp:otp-preauth}]{\sphinxcrossref{\DUrole{std,std-ref}{OTP Preauthentication}}}}. - -\sphinxAtStartPar -To require an indicator to be present in order to authenticate to a -service principal, set the \sphinxstylestrong{require\_auth} string attribute on the -principal to the indicator value to be required. If you wish to allow -one of several indicators to be accepted, you can specify multiple -indicator values separated by spaces. - -\sphinxAtStartPar -For example, a realm could be configured to set the authentication -indicator value “strong” when PKINIT is used to authenticate, using a -setting in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{pkinit\PYGZus{}indicator} \PYG{o}{=} \PYG{n}{strong} -\end{sphinxVerbatim} - -\sphinxAtStartPar -A service principal could be configured to require the “strong” -authentication indicator value: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kadmin setstr host/high.value.server require\PYGZus{}auth strong -Password for user/admin@KRBTEST.COM: -\end{sphinxVerbatim} - -\sphinxAtStartPar -A user who authenticates with PKINIT would be able to obtain a ticket -for the service principal: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kinit \PYGZhy{}X X509\PYGZus{}user\PYGZus{}identity=FILE:/my/cert.pem,/my/key.pem user -\PYGZdl{} kvno host/high.value.server -host/high.value.server@KRBTEST.COM: kvno = 1 -\end{sphinxVerbatim} - -\sphinxAtStartPar -but a user who authenticates with a password would not: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kinit user -Password for user@KRBTEST.COM: -\PYGZdl{} kvno host/high.value.server -kvno: KDC policy rejects request while getting credentials for - host/high.value.server@KRBTEST.COM -\end{sphinxVerbatim} - -\sphinxAtStartPar -GSSAPI server applications can inspect authentication indicators -through the \DUrole{xref,std,std-ref}{auth\sphinxhyphen{}indicators} name -attribute. - -\sphinxstepscope - - -\chapter{Administration programs} -\label{\detokenize{admin/admin_commands/index:administration-programs}}\label{\detokenize{admin/admin_commands/index::doc}} -\sphinxstepscope - - -\section{kadmin} -\label{\detokenize{admin/admin_commands/kadmin_local:kadmin}}\label{\detokenize{admin/admin_commands/kadmin_local:kadmin-1}}\label{\detokenize{admin/admin_commands/kadmin_local::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/kadmin_local:synopsis}}\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:kadmin-synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kadmin} -{[}\sphinxstylestrong{\sphinxhyphen{}O}|\sphinxstylestrong{\sphinxhyphen{}N}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}q} \sphinxstyleemphasis{query}{]} -{[}{[}\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{cache\_name}{]}|{[}\sphinxstylestrong{\sphinxhyphen{}k} {[}\sphinxstylestrong{\sphinxhyphen{}t} \sphinxstyleemphasis{keytab}{]}{]}|\sphinxstylestrong{\sphinxhyphen{}n}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{password}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{admin\_server}{[}:\sphinxstyleemphasis{port}{]}{]} -{[}command args…{]} - -\sphinxAtStartPar -\sphinxstylestrong{kadmin.local} -{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}q} \sphinxstyleemphasis{query}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt} …{]} -{[}\sphinxstylestrong{\sphinxhyphen{}m}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}{]} -{[}command args…{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/kadmin_local:description}} -\sphinxAtStartPar -kadmin and kadmin.local are command\sphinxhyphen{}line interfaces to the Kerberos V5 -administration system. They provide nearly identical functionalities; -the difference is that kadmin.local directly accesses the KDC -database, while kadmin performs operations using {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}}. -Except as explicitly noted otherwise, this man page will use “kadmin” -to refer to both versions. kadmin provides for the maintenance of -Kerberos principals, password policies, and service key tables -(keytabs). - -\sphinxAtStartPar -The remote kadmin client uses Kerberos to authenticate to kadmind -using the service principal \sphinxcode{\sphinxupquote{kadmin/admin}} or \sphinxcode{\sphinxupquote{kadmin/ADMINHOST}} -(where \sphinxstyleemphasis{ADMINHOST} is the fully\sphinxhyphen{}qualified hostname of the admin -server). If the credentials cache contains a ticket for one of these -principals, and the \sphinxstylestrong{\sphinxhyphen{}c} credentials\_cache option is specified, that -ticket is used to authenticate to kadmind. Otherwise, the \sphinxstylestrong{\sphinxhyphen{}p} and -\sphinxstylestrong{\sphinxhyphen{}k} options are used to specify the client Kerberos principal name -used to authenticate. Once kadmin has determined the principal name, -it requests a service ticket from the KDC, and uses that service -ticket to authenticate to kadmind. - -\sphinxAtStartPar -Since kadmin.local directly accesses the KDC database, it usually must -be run directly on the primary KDC with sufficient permissions to read -the KDC database. If the KDC database uses the LDAP database module, -kadmin.local can be run on any host which can access the LDAP server. - - -\subsection{OPTIONS} -\label{\detokenize{admin/admin_commands/kadmin_local:options}}\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:kadmin-options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{realm} as the default database realm. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{principal} to authenticate. Otherwise, kadmin will append -\sphinxcode{\sphinxupquote{/admin}} to the primary principal name of the default ccache, -the value of the \sphinxstylestrong{USER} environment variable, or the username as -obtained with getpwuid, in order of preference. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k}} -\sphinxAtStartPar -Use a keytab to decrypt the KDC response instead of prompting for -a password. In this case, the default principal will be -\sphinxcode{\sphinxupquote{host/hostname}}. If there is no keytab specified with the -\sphinxstylestrong{\sphinxhyphen{}t} option, then the default keytab will be used. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}t} \sphinxstyleemphasis{keytab}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{keytab} to decrypt the KDC response. This can only be used -with the \sphinxstylestrong{\sphinxhyphen{}k} option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}n}} -\sphinxAtStartPar -Requests anonymous processing. Two types of anonymous principals -are supported. For fully anonymous Kerberos, configure PKINIT on -the KDC and configure \sphinxstylestrong{pkinit\_anchors} in the client’s -{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. Then use the \sphinxstylestrong{\sphinxhyphen{}n} option with a principal -of the form \sphinxcode{\sphinxupquote{@REALM}} (an empty principal name followed by the -at\sphinxhyphen{}sign and a realm name). If permitted by the KDC, an anonymous -ticket will be returned. A second form of anonymous tickets is -supported; these realm\sphinxhyphen{}exposed tickets hide the identity of the -client but not the client’s realm. For this mode, use \sphinxcode{\sphinxupquote{kinit -\sphinxhyphen{}n}} with a normal principal name. If supported by the KDC, the -principal (but not realm) will be replaced by the anonymous -principal. As of release 1.8, the MIT Kerberos KDC only supports -fully anonymous operation. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{credentials\_cache}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{credentials\_cache} as the credentials cache. The cache -should contain a service ticket for the \sphinxcode{\sphinxupquote{kadmin/admin}} or -\sphinxcode{\sphinxupquote{kadmin/ADMINHOST}} (where \sphinxstyleemphasis{ADMINHOST} is the fully\sphinxhyphen{}qualified -hostname of the admin server) service; it can be acquired with the -\DUrole{xref,std,std-ref}{kinit(1)} program. If this option is not specified, kadmin -requests a new service ticket from the KDC, and stores it in its -own temporary ccache. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{password}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{password} instead of prompting for one. Use this option with -care, as it may expose the password to other users on the system -via the process list. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}q} \sphinxstyleemphasis{query}} -\sphinxAtStartPar -Perform the specified query and then exit. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}} -\sphinxAtStartPar -Specifies the name of the KDC database. This option does not -apply to the LDAP database module. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{admin\_server}{[}:\sphinxstyleemphasis{port}{]}} -\sphinxAtStartPar -Specifies the admin server which kadmin should contact. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}m}} -\sphinxAtStartPar -If using kadmin.local, prompt for the database master password -instead of reading it from a stash file. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e} “\sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt} …”} -\sphinxAtStartPar -Sets the keysalt list to be used for any new keys created. See -{\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of possible -values. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}O}} -\sphinxAtStartPar -Force use of old AUTH\_GSSAPI authentication flavor. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}N}} -\sphinxAtStartPar -Prevent fallback to AUTH\_GSSAPI authentication flavor. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}} -\sphinxAtStartPar -Specifies the database specific arguments. See the next section -for supported options. - -\end{description} - -\sphinxAtStartPar -Starting with release 1.14, if any command\sphinxhyphen{}line arguments remain after -the options, they will be treated as a single query to be executed. -This mode of operation is intended for scripts and behaves differently -from the interactive mode in several respects: -\begin{itemize} -\item {} -\sphinxAtStartPar -Query arguments are split by the shell, not by kadmin. - -\item {} -\sphinxAtStartPar -Informational and warning messages are suppressed. Error messages -and query output (e.g. for \sphinxstylestrong{get\_principal}) will still be -displayed. - -\item {} -\sphinxAtStartPar -Confirmation prompts are disabled (as if \sphinxstylestrong{\sphinxhyphen{}force} was given). -Password prompts will still be issued as required. - -\item {} -\sphinxAtStartPar -The exit status will be non\sphinxhyphen{}zero if the query fails. - -\end{itemize} - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}q} option does not carry these behavior differences; the query -will be processed as if it was entered interactively. The \sphinxstylestrong{\sphinxhyphen{}q} -option cannot be used in combination with a query in the remaining -arguments. - - -\subsection{DATABASE OPTIONS} -\label{\detokenize{admin/admin_commands/kadmin_local:database-options}}\label{\detokenize{admin/admin_commands/kadmin_local:dboptions}} -\sphinxAtStartPar -Database options can be used to override database\sphinxhyphen{}specific defaults. -Supported options for the DB2 module are: -\begin{quote} -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x dbname=}*filename*} -\sphinxAtStartPar -Specifies the base filename of the DB2 database. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x lockiter}} -\sphinxAtStartPar -Make iteration operations hold the lock for the duration of -the entire operation, rather than temporarily releasing the -lock while handling each principal. This is the default -behavior, but this option exists to allow command line -override of a {[}dbmodules{]} setting. First introduced in -release 1.13. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x unlockiter}} -\sphinxAtStartPar -Make iteration operations unlock the database for each -principal, instead of holding the lock for the duration of the -entire operation. First introduced in release 1.13. - -\end{description} -\end{quote} - -\sphinxAtStartPar -Supported options for the LDAP module are: -\begin{quote} -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x host=}\sphinxstyleemphasis{ldapuri}} -\sphinxAtStartPar -Specifies the LDAP server to connect to by a LDAP URI. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x binddn=}\sphinxstyleemphasis{bind\_dn}} -\sphinxAtStartPar -Specifies the DN used to bind to the LDAP server. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x bindpwd=}\sphinxstyleemphasis{password}} -\sphinxAtStartPar -Specifies the password or SASL secret used to bind to the LDAP -server. Using this option may expose the password to other -users on the system via the process list; to avoid this, -instead stash the password using the \sphinxstylestrong{stashsrvpw} command of -{\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x sasl\_mech=}\sphinxstyleemphasis{mechanism}} -\sphinxAtStartPar -Specifies the SASL mechanism used to bind to the LDAP server. -The bind DN is ignored if a SASL mechanism is used. New in -release 1.13. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x sasl\_authcid=}\sphinxstyleemphasis{name}} -\sphinxAtStartPar -Specifies the authentication name used when binding to the -LDAP server with a SASL mechanism, if the mechanism requires -one. New in release 1.13. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x sasl\_authzid=}\sphinxstyleemphasis{name}} -\sphinxAtStartPar -Specifies the authorization name used when binding to the LDAP -server with a SASL mechanism. New in release 1.13. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x sasl\_realm=}\sphinxstyleemphasis{realm}} -\sphinxAtStartPar -Specifies the realm used when binding to the LDAP server with -a SASL mechanism, if the mechanism uses one. New in release -1.13. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x debug=}\sphinxstyleemphasis{level}} -\sphinxAtStartPar -sets the OpenLDAP client library debug level. \sphinxstyleemphasis{level} is an -integer to be interpreted by the library. Debugging messages -are printed to standard error. New in release 1.12. - -\end{description} -\end{quote} - - -\subsection{COMMANDS} -\label{\detokenize{admin/admin_commands/kadmin_local:commands}} -\sphinxAtStartPar -When using the remote client, available commands may be restricted -according to the privileges specified in the {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} file -on the admin server. - - -\subsubsection{add\_principal} -\label{\detokenize{admin/admin_commands/kadmin_local:add-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id1}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{add\_principal} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{newprinc} -\end{quote} - -\sphinxAtStartPar -Creates the principal \sphinxstyleemphasis{newprinc}, prompting twice for a password. If -no password policy is specified with the \sphinxstylestrong{\sphinxhyphen{}policy} option, and the -policy named \sphinxcode{\sphinxupquote{default}} is assigned to the principal if it exists. -However, creating a policy named \sphinxcode{\sphinxupquote{default}} will not automatically -assign this policy to previously existing principals. This policy -assignment can be suppressed with the \sphinxstylestrong{\sphinxhyphen{}clearpolicy} option. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{add} privilege. - -\sphinxAtStartPar -Aliases: \sphinxstylestrong{addprinc}, \sphinxstylestrong{ank} - -\sphinxAtStartPar -Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}expire} \sphinxstyleemphasis{expdate}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) The expiration date of the principal. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}pwexpire} \sphinxstyleemphasis{pwexpdate}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) The password expiration date. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxlife} \sphinxstyleemphasis{maxlife}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) The maximum ticket life -for the principal. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{maxrenewlife}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) The maximum renewable -life of tickets for the principal. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}kvno} \sphinxstyleemphasis{kvno}} -\sphinxAtStartPar -The initial key version number. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}policy} \sphinxstyleemphasis{policy}} -\sphinxAtStartPar -The password policy used by this principal. If not specified, the -policy \sphinxcode{\sphinxupquote{default}} is used if it exists (unless \sphinxstylestrong{\sphinxhyphen{}clearpolicy} -is specified). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}clearpolicy}} -\sphinxAtStartPar -Prevents any policy from being assigned when \sphinxstylestrong{\sphinxhyphen{}policy} is not -specified. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_postdated}} -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}allow\_postdated} prohibits this principal from obtaining -postdated tickets. \sphinxstylestrong{+allow\_postdated} clears this flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_forwardable}} -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}allow\_forwardable} prohibits this principal from obtaining -forwardable tickets. \sphinxstylestrong{+allow\_forwardable} clears this flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_renewable}} -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}allow\_renewable} prohibits this principal from obtaining -renewable tickets. \sphinxstylestrong{+allow\_renewable} clears this flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_proxiable}} -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}allow\_proxiable} prohibits this principal from obtaining -proxiable tickets. \sphinxstylestrong{+allow\_proxiable} clears this flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_dup\_skey}} -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}allow\_dup\_skey} disables user\sphinxhyphen{}to\sphinxhyphen{}user authentication for this -principal by prohibiting others from obtaining a service ticket -encrypted in this principal’s TGT session key. -\sphinxstylestrong{+allow\_dup\_skey} clears this flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{requires\_preauth}} -\sphinxAtStartPar -\sphinxstylestrong{+requires\_preauth} requires this principal to preauthenticate -before being allowed to kinit. \sphinxstylestrong{\sphinxhyphen{}requires\_preauth} clears this -flag. When \sphinxstylestrong{+requires\_preauth} is set on a service principal, -the KDC will only issue service tickets for that service principal -if the client’s initial authentication was performed using -preauthentication. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{requires\_hwauth}} -\sphinxAtStartPar -\sphinxstylestrong{+requires\_hwauth} requires this principal to preauthenticate -using a hardware device before being allowed to kinit. -\sphinxstylestrong{\sphinxhyphen{}requires\_hwauth} clears this flag. When \sphinxstylestrong{+requires\_hwauth} is -set on a service principal, the KDC will only issue service tickets -for that service principal if the client’s initial authentication was -performed using a hardware device to preauthenticate. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{ok\_as\_delegate}} -\sphinxAtStartPar -\sphinxstylestrong{+ok\_as\_delegate} sets the \sphinxstylestrong{okay as delegate} flag on tickets -issued with this principal as the service. Clients may use this -flag as a hint that credentials should be delegated when -authenticating to the service. \sphinxstylestrong{\sphinxhyphen{}ok\_as\_delegate} clears this -flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_svr}} -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}allow\_svr} prohibits the issuance of service tickets for this -principal. In release 1.17 and later, user\sphinxhyphen{}to\sphinxhyphen{}user service -tickets are still allowed unless the \sphinxstylestrong{\sphinxhyphen{}allow\_dup\_skey} flag is -also set. \sphinxstylestrong{+allow\_svr} clears this flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_tgs\_req}} -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}allow\_tgs\_req} specifies that a Ticket\sphinxhyphen{}Granting Service (TGS) -request for a service ticket for this principal is not permitted. -\sphinxstylestrong{+allow\_tgs\_req} clears this flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_tix}} -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}allow\_tix} forbids the issuance of any tickets for this -principal. \sphinxstylestrong{+allow\_tix} clears this flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{needchange}} -\sphinxAtStartPar -\sphinxstylestrong{+needchange} forces a password change on the next initial -authentication to this principal. \sphinxstylestrong{\sphinxhyphen{}needchange} clears this -flag. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{password\_changing\_service}} -\sphinxAtStartPar -\sphinxstylestrong{+password\_changing\_service} marks this principal as a password -change service principal. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{ok\_to\_auth\_as\_delegate}} -\sphinxAtStartPar -\sphinxstylestrong{+ok\_to\_auth\_as\_delegate} allows this principal to acquire -forwardable tickets to itself from arbitrary users, for use with -constrained delegation. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{no\_auth\_data\_required}} -\sphinxAtStartPar -\sphinxstylestrong{+no\_auth\_data\_required} prevents PAC or AD\sphinxhyphen{}SIGNEDPATH data from -being added to service tickets for the principal. - -\sphinxlineitem{\{\sphinxhyphen{}|+\}\sphinxstylestrong{lockdown\_keys}} -\sphinxAtStartPar -\sphinxstylestrong{+lockdown\_keys} prevents keys for this principal from leaving -the KDC via kadmind. The chpass and extract operations are denied -for a principal with this attribute. The chrand operation is -allowed, but will not return the new keys. The delete and rename -operations are also denied if this attribute is set, in order to -prevent a malicious administrator from replacing principals like -krbtgt/* or kadmin/* with new principals without the attribute. -This attribute can be set via the network protocol, but can only -be removed using kadmin.local. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}randkey}} -\sphinxAtStartPar -Sets the key of the principal to a random value. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}nokey}} -\sphinxAtStartPar -Causes the principal to be created with no key. New in release -1.12. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}pw} \sphinxstyleemphasis{password}} -\sphinxAtStartPar -Sets the password of the principal to the specified string and -does not prompt for a password. Note: using this option in a -shell script may expose the password to other users on the system -via the process list. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt},…} -\sphinxAtStartPar -Uses the specified keysalt list for setting the keys of the -principal. See {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a -list of possible values. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_princ\_args}} -\sphinxAtStartPar -Indicates database\sphinxhyphen{}specific options. The options for the LDAP -database module are: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x dn=}\sphinxstyleemphasis{dn}} -\sphinxAtStartPar -Specifies the LDAP object that will contain the Kerberos -principal being created. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x linkdn=}\sphinxstyleemphasis{dn}} -\sphinxAtStartPar -Specifies the LDAP object to which the newly created Kerberos -principal object will point. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x containerdn=}\sphinxstyleemphasis{container\_dn}} -\sphinxAtStartPar -Specifies the container object under which the Kerberos -principal is to be created. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x tktpolicy=}\sphinxstyleemphasis{policy}} -\sphinxAtStartPar -Associates a ticket policy to the Kerberos principal. - -\end{description} - -\begin{sphinxadmonition}{note}{Note:}\begin{itemize} -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{containerdn} and \sphinxstylestrong{linkdn} options cannot be -specified with the \sphinxstylestrong{dn} option. - -\item {} -\sphinxAtStartPar -If the \sphinxstyleemphasis{dn} or \sphinxstyleemphasis{containerdn} options are not specified while -adding the principal, the principals are created under the -principal container configured in the realm or the realm -container. - -\item {} -\sphinxAtStartPar -\sphinxstyleemphasis{dn} and \sphinxstyleemphasis{containerdn} should be within the subtrees or -principal container configured in the realm. - -\end{itemize} -\end{sphinxadmonition} - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{n}{jennifer} -\PYG{n}{No} \PYG{n}{policy} \PYG{n}{specified} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{jennifer@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} -\PYG{n}{defaulting} \PYG{n}{to} \PYG{n}{no} \PYG{n}{policy}\PYG{o}{.} -\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} -\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} -\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{jennifer@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{created}\PYG{o}{.} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{modify\_principal} -\label{\detokenize{admin/admin_commands/kadmin_local:modify-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id2}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{modify\_principal} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{principal} -\end{quote} - -\sphinxAtStartPar -Modifies the specified principal, changing the fields as specified. -The options to \sphinxstylestrong{add\_principal} also apply to this command, except -for the \sphinxstylestrong{\sphinxhyphen{}randkey}, \sphinxstylestrong{\sphinxhyphen{}pw}, and \sphinxstylestrong{\sphinxhyphen{}e} options. In addition, the -option \sphinxstylestrong{\sphinxhyphen{}clearpolicy} will clear the current policy of a principal. - -\sphinxAtStartPar -This command requires the \sphinxstyleemphasis{modify} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{modprinc} - -\sphinxAtStartPar -Options (in addition to the \sphinxstylestrong{addprinc} options): -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}unlock}} -\sphinxAtStartPar -Unlocks a locked principal (one which has received too many failed -authentication attempts without enough time between them according -to its password policy) so that it can successfully authenticate. - -\end{description} - - -\subsubsection{rename\_principal} -\label{\detokenize{admin/admin_commands/kadmin_local:rename-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id3}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{rename\_principal} {[}\sphinxstylestrong{\sphinxhyphen{}force}{]} \sphinxstyleemphasis{old\_principal} \sphinxstyleemphasis{new\_principal} -\end{quote} - -\sphinxAtStartPar -Renames the specified \sphinxstyleemphasis{old\_principal} to \sphinxstyleemphasis{new\_principal}. This -command prompts for confirmation, unless the \sphinxstylestrong{\sphinxhyphen{}force} option is -given. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{add} and \sphinxstylestrong{delete} privileges. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{renprinc} - - -\subsubsection{add\_alias} -\label{\detokenize{admin/admin_commands/kadmin_local:add-alias}}\label{\detokenize{admin/admin_commands/kadmin_local:id4}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{add\_alias} \sphinxstyleemphasis{alias\_princ} \sphinxstyleemphasis{target\_princ} -\end{quote} - -\sphinxAtStartPar -Create an alias \sphinxstyleemphasis{alias\_princ} pointing to \sphinxstyleemphasis{target\_princ}. Aliases may -be chained (that is, \sphinxstyleemphasis{target\_princ} may itself be an alias) up to a -depth of 10. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{add} privilege for \sphinxstyleemphasis{alias\_princ} and the -\sphinxstylestrong{modify} privilege for \sphinxstyleemphasis{target\_princ}. - -\sphinxAtStartPar -(New in release 1.22.) - -\sphinxAtStartPar -Aliases: \sphinxstylestrong{alias} - - -\subsubsection{delete\_principal} -\label{\detokenize{admin/admin_commands/kadmin_local:delete-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id5}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{delete\_principal} {[}\sphinxstylestrong{\sphinxhyphen{}force}{]} \sphinxstyleemphasis{principal} -\end{quote} - -\sphinxAtStartPar -Deletes the specified \sphinxstyleemphasis{principal} or alias from the database. This -command prompts for deletion, unless the \sphinxstylestrong{\sphinxhyphen{}force} option is given. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{delete} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{delprinc} - - -\subsubsection{change\_password} -\label{\detokenize{admin/admin_commands/kadmin_local:change-password}}\label{\detokenize{admin/admin_commands/kadmin_local:id6}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{change\_password} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{principal} -\end{quote} - -\sphinxAtStartPar -Changes the password of \sphinxstyleemphasis{principal}. Prompts for a new password if -neither \sphinxstylestrong{\sphinxhyphen{}randkey} or \sphinxstylestrong{\sphinxhyphen{}pw} is specified. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{changepw} privilege, or that the -principal running the program is the same as the principal being -changed. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{cpw} - -\sphinxAtStartPar -The following options are available: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}randkey}} -\sphinxAtStartPar -Sets the key of the principal to a random value. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}pw} \sphinxstyleemphasis{password}} -\sphinxAtStartPar -Set the password to the specified string. Using this option in a -script may expose the password to other users on the system via -the process list. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt},…} -\sphinxAtStartPar -Uses the specified keysalt list for setting the keys of the -principal. See {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a -list of possible values. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}keepold}} -\sphinxAtStartPar -Keeps the existing keys in the database. This flag is usually not -necessary except perhaps for \sphinxcode{\sphinxupquote{krbtgt}} principals. - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{cpw} \PYG{n}{systest} -\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{systest}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} -\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{systest}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{systest}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{changed}\PYG{o}{.} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{purgekeys} -\label{\detokenize{admin/admin_commands/kadmin_local:purgekeys}}\label{\detokenize{admin/admin_commands/kadmin_local:id7}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{purgekeys} {[}\sphinxstylestrong{\sphinxhyphen{}all}|\sphinxstylestrong{\sphinxhyphen{}keepkvno} \sphinxstyleemphasis{oldest\_kvno\_to\_keep}{]} \sphinxstyleemphasis{principal} -\end{quote} - -\sphinxAtStartPar -Purges previously retained old keys (e.g., from \sphinxstylestrong{change\_password -\sphinxhyphen{}keepold}) from \sphinxstyleemphasis{principal}. If \sphinxstylestrong{\sphinxhyphen{}keepkvno} is specified, then -only purges keys with kvnos lower than \sphinxstyleemphasis{oldest\_kvno\_to\_keep}. If -\sphinxstylestrong{\sphinxhyphen{}all} is specified, then all keys are purged. The \sphinxstylestrong{\sphinxhyphen{}all} option -is new in release 1.12. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{modify} privilege. - - -\subsubsection{get\_principal} -\label{\detokenize{admin/admin_commands/kadmin_local:get-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id8}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{get\_principal} {[}\sphinxstylestrong{\sphinxhyphen{}terse}{]} \sphinxstyleemphasis{principal} -\end{quote} - -\sphinxAtStartPar -Gets the attributes of principal. With the \sphinxstylestrong{\sphinxhyphen{}terse} option, outputs -fields as quoted tab\sphinxhyphen{}separated strings. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{inquire} privilege, or that the principal -running the the program to be the same as the one being listed. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{getprinc} - -\sphinxAtStartPar -Examples: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{getprinc} \PYG{n}{tlyu}\PYG{o}{/}\PYG{n}{admin} -\PYG{n}{Principal}\PYG{p}{:} \PYG{n}{tlyu}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{Expiration} \PYG{n}{date}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} -\PYG{n}{Last} \PYG{n}{password} \PYG{n}{change}\PYG{p}{:} \PYG{n}{Mon} \PYG{n}{Aug} \PYG{l+m+mi}{12} \PYG{l+m+mi}{14}\PYG{p}{:}\PYG{l+m+mi}{16}\PYG{p}{:}\PYG{l+m+mi}{47} \PYG{n}{EDT} \PYG{l+m+mi}{1996} -\PYG{n}{Password} \PYG{n}{expiration} \PYG{n}{date}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} -\PYG{n}{Maximum} \PYG{n}{ticket} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{10}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} -\PYG{n}{Maximum} \PYG{n}{renewable} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{7} \PYG{n}{days} \PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} -\PYG{n}{Last} \PYG{n}{modified}\PYG{p}{:} \PYG{n}{Mon} \PYG{n}{Aug} \PYG{l+m+mi}{12} \PYG{l+m+mi}{14}\PYG{p}{:}\PYG{l+m+mi}{16}\PYG{p}{:}\PYG{l+m+mi}{47} \PYG{n}{EDT} \PYG{l+m+mi}{1996} \PYG{p}{(}\PYG{n}{bjaspan}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{)} -\PYG{n}{Last} \PYG{n}{successful} \PYG{n}{authentication}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} -\PYG{n}{Last} \PYG{n}{failed} \PYG{n}{authentication}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} -\PYG{n}{Failed} \PYG{n}{password} \PYG{n}{attempts}\PYG{p}{:} \PYG{l+m+mi}{0} -\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{1} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} -\PYG{n}{MKey}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{1} -\PYG{n}{Attributes}\PYG{p}{:} -\PYG{n}{Policy}\PYG{p}{:} \PYG{p}{[}\PYG{n}{none}\PYG{p}{]} - -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{getprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{terse} \PYG{n}{systest} -\PYG{n}{systest}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{l+m+mi}{3} \PYG{l+m+mi}{86400} \PYG{l+m+mi}{604800} \PYG{l+m+mi}{1} -\PYG{l+m+mi}{785926535} \PYG{l+m+mi}{753241234} \PYG{l+m+mi}{785900000} -\PYG{n}{tlyu}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{l+m+mi}{786100034} \PYG{l+m+mi}{0} \PYG{l+m+mi}{0} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{list\_principals} -\label{\detokenize{admin/admin_commands/kadmin_local:list-principals}}\label{\detokenize{admin/admin_commands/kadmin_local:id9}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{list\_principals} {[}\sphinxstyleemphasis{expression}{]} -\end{quote} - -\sphinxAtStartPar -Retrieves all or some principal names. \sphinxstyleemphasis{expression} is a shell\sphinxhyphen{}style -glob expression that can contain the wild\sphinxhyphen{}card characters \sphinxcode{\sphinxupquote{?}}, -\sphinxcode{\sphinxupquote{*}}, and \sphinxcode{\sphinxupquote{{[}{]}}}. All principal names matching the expression are -printed. If no expression is provided, all principal names are -printed. If the expression does not contain an \sphinxcode{\sphinxupquote{@}} character, an -\sphinxcode{\sphinxupquote{@}} character followed by the local realm is appended to the -expression. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{list} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{listprincs}, \sphinxstylestrong{get\_principals}, \sphinxstylestrong{getprincs} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{listprincs} \PYG{n}{test}\PYG{o}{*} -\PYG{n}{test3}\PYG{n+nd}{@SECURE}\PYG{o}{\PYGZhy{}}\PYG{n}{TEST}\PYG{o}{.}\PYG{n}{OV}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{test2}\PYG{n+nd}{@SECURE}\PYG{o}{\PYGZhy{}}\PYG{n}{TEST}\PYG{o}{.}\PYG{n}{OV}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{test1}\PYG{n+nd}{@SECURE}\PYG{o}{\PYGZhy{}}\PYG{n}{TEST}\PYG{o}{.}\PYG{n}{OV}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{testuser}\PYG{n+nd}{@SECURE}\PYG{o}{\PYGZhy{}}\PYG{n}{TEST}\PYG{o}{.}\PYG{n}{OV}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{get\_strings} -\label{\detokenize{admin/admin_commands/kadmin_local:get-strings}}\label{\detokenize{admin/admin_commands/kadmin_local:id10}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{get\_strings} \sphinxstyleemphasis{principal} -\end{quote} - -\sphinxAtStartPar -Displays string attributes on \sphinxstyleemphasis{principal}. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{inquire} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{getstrs} - - -\subsubsection{set\_string} -\label{\detokenize{admin/admin_commands/kadmin_local:set-string}}\label{\detokenize{admin/admin_commands/kadmin_local:id11}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{set\_string} \sphinxstyleemphasis{principal} \sphinxstyleemphasis{name} \sphinxstyleemphasis{value} -\end{quote} - -\sphinxAtStartPar -Sets a string attribute on \sphinxstyleemphasis{principal}. String attributes are used to -supply per\sphinxhyphen{}principal configuration to the KDC and some KDC plugin -modules. The following string attribute names are recognized by the -KDC: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{require\_auth}} -\sphinxAtStartPar -Specifies an authentication indicator which is required to -authenticate to the principal as a service. Multiple indicators -can be specified, separated by spaces; in this case any of the -specified indicators will be accepted. (New in release 1.14.) - -\sphinxlineitem{\sphinxstylestrong{session\_enctypes}} -\sphinxAtStartPar -Specifies the encryption types supported for session keys when the -principal is authenticated to as a server. See -{\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of the -accepted values. - -\sphinxlineitem{\sphinxstylestrong{otp}} -\sphinxAtStartPar -Enables One Time Passwords (OTP) preauthentication for a client -\sphinxstyleemphasis{principal}. The \sphinxstyleemphasis{value} is a JSON string representing an array -of objects, each having optional \sphinxcode{\sphinxupquote{type}} and \sphinxcode{\sphinxupquote{username}} fields. - -\sphinxlineitem{\sphinxstylestrong{pkinit\_cert\_match}} -\sphinxAtStartPar -Specifies a matching expression that defines the certificate -attributes required for the client certificate used by the -principal during PKINIT authentication. The matching expression -is in the same format as those used by the \sphinxstylestrong{pkinit\_cert\_match} -option in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. (New in release 1.16.) - -\sphinxlineitem{\sphinxstylestrong{pac\_privsvr\_enctype}} -\sphinxAtStartPar -Forces the encryption type of the PAC KDC checksum buffers to the -specified encryption type for tickets issued to this server, by -deriving a key from the local krbtgt key if it is of a different -encryption type. It may be necessary to set this value to -“aes256\sphinxhyphen{}sha1” on the cross\sphinxhyphen{}realm krbtgt entry for an Active -Directory realm when using aes\sphinxhyphen{}sha2 keys on the local krbtgt -entry. - -\end{description} - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{modify} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{setstr} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{set\PYGZus{}string} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{session\PYGZus{}enctypes} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts} -\PYG{n}{set\PYGZus{}string} \PYG{n}{user}\PYG{n+nd}{@FOO}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{otp} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{[}\PYG{l+s+s2}{\PYGZob{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{type}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{:}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{hotp}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{,}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{username}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{:}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{al}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZcb{}]}\PYG{l+s+s2}{\PYGZdq{}} -\end{sphinxVerbatim} - - -\subsubsection{del\_string} -\label{\detokenize{admin/admin_commands/kadmin_local:del-string}}\label{\detokenize{admin/admin_commands/kadmin_local:id12}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{del\_string} \sphinxstyleemphasis{principal} \sphinxstyleemphasis{key} -\end{quote} - -\sphinxAtStartPar -Deletes a string attribute from \sphinxstyleemphasis{principal}. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{delete} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{delstr} - - -\subsubsection{add\_policy} -\label{\detokenize{admin/admin_commands/kadmin_local:add-policy}}\label{\detokenize{admin/admin_commands/kadmin_local:id13}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{add\_policy} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{policy} -\end{quote} - -\sphinxAtStartPar -Adds a password policy named \sphinxstyleemphasis{policy} to the database. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{add} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{addpol} - -\sphinxAtStartPar -The following options are available: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxlife} \sphinxstyleemphasis{time}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) Sets the maximum -lifetime of a password. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}minlife} \sphinxstyleemphasis{time}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) Sets the minimum -lifetime of a password. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}minlength} \sphinxstyleemphasis{length}} -\sphinxAtStartPar -Sets the minimum length of a password. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}minclasses} \sphinxstyleemphasis{number}} -\sphinxAtStartPar -Sets the minimum number of character classes required in a -password. The five character classes are lower case, upper case, -numbers, punctuation, and whitespace/unprintable characters. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}history} \sphinxstyleemphasis{number}} -\sphinxAtStartPar -Sets the number of past keys kept for a principal. This option is -not supported with the LDAP KDC database module. - -\end{description} -\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:policy-maxfailure}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxfailure} \sphinxstyleemphasis{maxnumber}} -\sphinxAtStartPar -Sets the number of authentication failures before the principal is -locked. Authentication failures are only tracked for principals -which require preauthentication. The counter of failed attempts -resets to 0 after a successful attempt to authenticate. A -\sphinxstyleemphasis{maxnumber} value of 0 (the default) disables lockout. - -\end{description} -\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:policy-failurecountinterval}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}failurecountinterval} \sphinxstyleemphasis{failuretime}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) Sets the allowable time -between authentication failures. If an authentication failure -happens after \sphinxstyleemphasis{failuretime} has elapsed since the previous -failure, the number of authentication failures is reset to 1. A -\sphinxstyleemphasis{failuretime} value of 0 (the default) means forever. - -\end{description} -\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:policy-lockoutduration}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}lockoutduration} \sphinxstyleemphasis{lockouttime}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) Sets the duration for -which the principal is locked from authenticating if too many -authentication failures occur without the specified failure count -interval elapsing. A duration of 0 (the default) means the -principal remains locked out until it is administratively unlocked -with \sphinxcode{\sphinxupquote{modprinc \sphinxhyphen{}unlock}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}allowedkeysalts}} -\sphinxAtStartPar -Specifies the key/salt tuples supported for long\sphinxhyphen{}term keys when -setting or changing a principal’s password/keys. See -{\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of the -accepted values, but note that key/salt tuples must be separated -with commas (‘,’) only. To clear the allowed key/salt policy use -a value of ‘\sphinxhyphen{}‘. - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{add\PYGZus{}policy} \PYG{o}{\PYGZhy{}}\PYG{n}{maxlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{2 days}\PYG{l+s+s2}{\PYGZdq{}} \PYG{o}{\PYGZhy{}}\PYG{n}{minlength} \PYG{l+m+mi}{5} \PYG{n}{guests} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{modify\_policy} -\label{\detokenize{admin/admin_commands/kadmin_local:modify-policy}}\label{\detokenize{admin/admin_commands/kadmin_local:id14}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{modify\_policy} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{policy} -\end{quote} - -\sphinxAtStartPar -Modifies the password policy named \sphinxstyleemphasis{policy}. Options are as described -for \sphinxstylestrong{add\_policy}. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{modify} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{modpol} - - -\subsubsection{delete\_policy} -\label{\detokenize{admin/admin_commands/kadmin_local:delete-policy}}\label{\detokenize{admin/admin_commands/kadmin_local:id15}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{delete\_policy} {[}\sphinxstylestrong{\sphinxhyphen{}force}{]} \sphinxstyleemphasis{policy} -\end{quote} - -\sphinxAtStartPar -Deletes the password policy named \sphinxstyleemphasis{policy}. Prompts for confirmation -before deletion. The command will fail if the policy is in use by any -principals. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{delete} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{delpol} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -kadmin: del\PYGZus{}policy guests -Are you sure you want to delete the policy \PYGZdq{}guests\PYGZdq{}? -(yes/no): yes -kadmin: -\end{sphinxVerbatim} - - -\subsubsection{get\_policy} -\label{\detokenize{admin/admin_commands/kadmin_local:get-policy}}\label{\detokenize{admin/admin_commands/kadmin_local:id16}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{get\_policy} {[} \sphinxstylestrong{\sphinxhyphen{}terse} {]} \sphinxstyleemphasis{policy} -\end{quote} - -\sphinxAtStartPar -Displays the values of the password policy named \sphinxstyleemphasis{policy}. With the -\sphinxstylestrong{\sphinxhyphen{}terse} flag, outputs the fields as quoted strings separated by -tabs. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{inquire} privilege. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{getpol} - -\sphinxAtStartPar -Examples: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{get\PYGZus{}policy} \PYG{n}{admin} -\PYG{n}{Policy}\PYG{p}{:} \PYG{n}{admin} -\PYG{n}{Maximum} \PYG{n}{password} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{180} \PYG{n}{days} \PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} -\PYG{n}{Minimum} \PYG{n}{password} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} -\PYG{n}{Minimum} \PYG{n}{password} \PYG{n}{length}\PYG{p}{:} \PYG{l+m+mi}{6} -\PYG{n}{Minimum} \PYG{n}{number} \PYG{n}{of} \PYG{n}{password} \PYG{n}{character} \PYG{n}{classes}\PYG{p}{:} \PYG{l+m+mi}{2} -\PYG{n}{Number} \PYG{n}{of} \PYG{n}{old} \PYG{n}{keys} \PYG{n}{kept}\PYG{p}{:} \PYG{l+m+mi}{5} -\PYG{n}{Reference} \PYG{n}{count}\PYG{p}{:} \PYG{l+m+mi}{17} - -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{get\PYGZus{}policy} \PYG{o}{\PYGZhy{}}\PYG{n}{terse} \PYG{n}{admin} -\PYG{n}{admin} \PYG{l+m+mi}{15552000} \PYG{l+m+mi}{0} \PYG{l+m+mi}{6} \PYG{l+m+mi}{2} \PYG{l+m+mi}{5} \PYG{l+m+mi}{17} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The “Reference count” is the number of principals using that policy. -With the LDAP KDC database module, the reference count field is not -meaningful. - - -\subsubsection{list\_policies} -\label{\detokenize{admin/admin_commands/kadmin_local:list-policies}}\label{\detokenize{admin/admin_commands/kadmin_local:id17}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{list\_policies} {[}\sphinxstyleemphasis{expression}{]} -\end{quote} - -\sphinxAtStartPar -Retrieves all or some policy names. \sphinxstyleemphasis{expression} is a shell\sphinxhyphen{}style -glob expression that can contain the wild\sphinxhyphen{}card characters \sphinxcode{\sphinxupquote{?}}, -\sphinxcode{\sphinxupquote{*}}, and \sphinxcode{\sphinxupquote{{[}{]}}}. All policy names matching the expression are -printed. If no expression is provided, all existing policy names are -printed. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{list} privilege. - -\sphinxAtStartPar -Aliases: \sphinxstylestrong{listpols}, \sphinxstylestrong{get\_policies}, \sphinxstylestrong{getpols}. - -\sphinxAtStartPar -Examples: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{listpols} -\PYG{n}{test}\PYG{o}{\PYGZhy{}}\PYG{n}{pol} -\PYG{n+nb}{dict}\PYG{o}{\PYGZhy{}}\PYG{n}{only} -\PYG{n}{once}\PYG{o}{\PYGZhy{}}\PYG{n}{a}\PYG{o}{\PYGZhy{}}\PYG{n+nb}{min} -\PYG{n}{test}\PYG{o}{\PYGZhy{}}\PYG{n}{pol}\PYG{o}{\PYGZhy{}}\PYG{n}{nopw} - -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{listpols} \PYG{n}{t}\PYG{o}{*} -\PYG{n}{test}\PYG{o}{\PYGZhy{}}\PYG{n}{pol} -\PYG{n}{test}\PYG{o}{\PYGZhy{}}\PYG{n}{pol}\PYG{o}{\PYGZhy{}}\PYG{n}{nopw} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{ktadd} -\label{\detokenize{admin/admin_commands/kadmin_local:ktadd}}\label{\detokenize{admin/admin_commands/kadmin_local:id18}}\begin{quote} - -\begin{DUlineblock}{0em} -\item[] \sphinxstylestrong{ktadd} {[}options{]} \sphinxstyleemphasis{principal} -\item[] \sphinxstylestrong{ktadd} {[}options{]} \sphinxstylestrong{\sphinxhyphen{}glob} \sphinxstyleemphasis{princ\sphinxhyphen{}exp} -\end{DUlineblock} -\end{quote} - -\sphinxAtStartPar -Adds a \sphinxstyleemphasis{principal}, or all principals matching \sphinxstyleemphasis{princ\sphinxhyphen{}exp}, to a -keytab file. Each principal’s keys are randomized in the process. -The rules for \sphinxstyleemphasis{princ\sphinxhyphen{}exp} are described in the \sphinxstylestrong{list\_principals} -command. - -\sphinxAtStartPar -This command requires the \sphinxstylestrong{inquire} and \sphinxstylestrong{changepw} privileges. -With the \sphinxstylestrong{\sphinxhyphen{}glob} form, it also requires the \sphinxstylestrong{list} privilege. - -\sphinxAtStartPar -The options are: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k{[}eytab{]}} \sphinxstyleemphasis{keytab}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{keytab} as the keytab file. Otherwise, the default keytab is -used. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt},…} -\sphinxAtStartPar -Uses the specified keysalt list for setting the new keys of the -principal. See {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a -list of possible values. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}q}} -\sphinxAtStartPar -Display less verbose information. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}norandkey}} -\sphinxAtStartPar -Do not randomize the keys. The keys and their version numbers stay -unchanged. This option cannot be specified in combination with the -\sphinxstylestrong{\sphinxhyphen{}e} option. - -\end{description} - -\sphinxAtStartPar -An entry for each of the principal’s unique encryption types is added, -ignoring multiple keys with the same encryption type but different -salt types. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{xst} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{\PYGZhy{}}\PYG{n}{new}\PYG{o}{\PYGZhy{}}\PYG{n}{keytab} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} - \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} - \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{\PYGZhy{}}\PYG{n}{new}\PYG{o}{\PYGZhy{}}\PYG{n}{keytab} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{ktremove} -\label{\detokenize{admin/admin_commands/kadmin_local:ktremove}}\label{\detokenize{admin/admin_commands/kadmin_local:id19}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{ktremove} {[}options{]} \sphinxstyleemphasis{principal} {[}\sphinxstyleemphasis{kvno} | \sphinxstyleemphasis{all} | \sphinxstyleemphasis{old}{]} -\end{quote} - -\sphinxAtStartPar -Removes entries for the specified \sphinxstyleemphasis{principal} from a keytab. Requires -no permissions, since this does not require database access. - -\sphinxAtStartPar -If the string “all” is specified, all entries for that principal are -removed; if the string “old” is specified, all entries for that -principal except those with the highest kvno are removed. Otherwise, -the value specified is parsed as an integer, and all entries whose -kvno match that integer are removed. - -\sphinxAtStartPar -The options are: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k{[}eytab{]}} \sphinxstyleemphasis{keytab}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{keytab} as the keytab file. Otherwise, the default keytab is -used. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}q}} -\sphinxAtStartPar -Display less verbose information. - -\end{description} - -\sphinxAtStartPar -Alias: \sphinxstylestrong{ktrem} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktremove} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{admin} \PYG{n+nb}{all} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{admin} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} - \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} -\PYG{n}{kadmin}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{lock} -\label{\detokenize{admin/admin_commands/kadmin_local:lock}} -\sphinxAtStartPar -Lock database exclusively. Use with extreme caution! This command -only works with the DB2 KDC database module. - - -\subsubsection{unlock} -\label{\detokenize{admin/admin_commands/kadmin_local:unlock}} -\sphinxAtStartPar -Release the exclusive database lock. - - -\subsubsection{list\_requests} -\label{\detokenize{admin/admin_commands/kadmin_local:list-requests}} -\sphinxAtStartPar -Lists available for kadmin requests. - -\sphinxAtStartPar -Aliases: \sphinxstylestrong{lr}, \sphinxstylestrong{?} - - -\subsubsection{quit} -\label{\detokenize{admin/admin_commands/kadmin_local:quit}} -\sphinxAtStartPar -Exit program. If the database was locked, the lock is released. - -\sphinxAtStartPar -Aliases: \sphinxstylestrong{exit}, \sphinxstylestrong{q} - - -\subsection{HISTORY} -\label{\detokenize{admin/admin_commands/kadmin_local:history}} -\sphinxAtStartPar -The kadmin program was originally written by Tom Yu at MIT, as an -interface to the OpenVision Kerberos administration program. - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/kadmin_local:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/kadmin_local:see-also}} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{kpasswd(1)}, {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{kadmind} -\label{\detokenize{admin/admin_commands/kadmind:kadmind}}\label{\detokenize{admin/admin_commands/kadmind:kadmind-8}}\label{\detokenize{admin/admin_commands/kadmind::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/kadmind:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kadmind} -{[}\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}m}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}nofork}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}proponly}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}port} \sphinxstyleemphasis{port\sphinxhyphen{}number}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{pid\_file}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{kdb5\_util\_path}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}K} \sphinxstyleemphasis{kprop\_path}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{kprop\_port}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{dump\_file}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/kadmind:description}} -\sphinxAtStartPar -kadmind starts the Kerberos administration server. kadmind typically -runs on the primary Kerberos server, which stores the KDC database. -If the KDC database uses the LDAP module, the administration server -and the KDC server need not run on the same machine. kadmind accepts -remote requests from programs such as {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} and -\DUrole{xref,std,std-ref}{kpasswd(1)} to administer the information in these database. - -\sphinxAtStartPar -kadmind requires a number of configuration files to be set up in order -for it to work: -\begin{description} -\sphinxlineitem{{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}} -\sphinxAtStartPar -The KDC configuration file contains configuration information for -the KDC and admin servers. kadmind uses settings in this file to -locate the Kerberos database, and is also affected by the -\sphinxstylestrong{acl\_file}, \sphinxstylestrong{dict\_file}, \sphinxstylestrong{kadmind\_port}, and iprop\sphinxhyphen{}related -settings. - -\sphinxlineitem{{\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}} -\sphinxAtStartPar -kadmind’s ACL (access control list) tells it which principals are -allowed to perform administration actions. The pathname to the -ACL file can be specified with the \sphinxstylestrong{acl\_file} {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} -variable; by default, it is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}}. - -\end{description} - -\sphinxAtStartPar -After the server begins running, it puts itself in the background and -disassociates itself from its controlling terminal. - -\sphinxAtStartPar -kadmind can be configured for incremental database propagation. -Incremental propagation allows replica KDC servers to receive -principal and policy updates incrementally instead of receiving full -dumps of the database. This facility can be enabled in the -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file with the \sphinxstylestrong{iprop\_enable} option. Incremental -propagation requires the principal \sphinxcode{\sphinxupquote{kiprop/PRIMARY\textbackslash{}@REALM}} (where -PRIMARY is the primary KDC’s canonical host name, and REALM the realm -name). In release 1.13, this principal is automatically created and -registered into the datebase. - - -\subsection{OPTIONS} -\label{\detokenize{admin/admin_commands/kadmind:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}} -\sphinxAtStartPar -specifies the realm that kadmind will serve; if it is not -specified, the default realm of the host is used. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}m}} -\sphinxAtStartPar -causes the master database password to be fetched from the -keyboard (before the server puts itself in the background, if not -invoked with the \sphinxstylestrong{\sphinxhyphen{}nofork} option) rather than from a file on -disk. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}nofork}} -\sphinxAtStartPar -causes the server to remain in the foreground and remain -associated to the terminal. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}proponly}} -\sphinxAtStartPar -causes the server to only listen and respond to Kerberos replica -incremental propagation polling requests. This option can be used -to set up a hierarchical propagation topology where a replica KDC -provides incremental updates to other Kerberos replicas. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}port} \sphinxstyleemphasis{port\sphinxhyphen{}number}} -\sphinxAtStartPar -specifies the port on which the administration server listens for -connections. The default port is determined by the -\sphinxstylestrong{kadmind\_port} configuration variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{pid\_file}} -\sphinxAtStartPar -specifies the file to which the PID of kadmind process should be -written after it starts up. This file can be used to identify -whether kadmind is still running and to allow init scripts to stop -the correct process. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{kdb5\_util\_path}} -\sphinxAtStartPar -specifies the path to the kdb5\_util command to use when dumping the -KDB in response to full resync requests when iprop is enabled. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}K} \sphinxstyleemphasis{kprop\_path}} -\sphinxAtStartPar -specifies the path to the kprop command to use to send full dumps -to replicas in response to full resync requests. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{kprop\_port}} -\sphinxAtStartPar -specifies the port by which the kprop process that is spawned by -kadmind connects to the replica kpropd, in order to transfer the -dump file during an iprop full resync request. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{dump\_file}} -\sphinxAtStartPar -specifies the file path to be used for dumping the KDB in response -to full resync requests when iprop is enabled. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}} -\sphinxAtStartPar -specifies database\sphinxhyphen{}specific arguments. See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:dboptions}]{\sphinxcrossref{\DUrole{std,std-ref}{Database Options}}}} in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for supported arguments. - -\end{description} - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/kadmind:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - -\sphinxAtStartPar -As of release 1.22, kadmind supports systemd socket activation via the -LISTEN\_PID and LISTEN\_FDS environment variables. Sockets provided by -the caller must correspond to configured listener addresses (via the -\sphinxstylestrong{kadmind\_listen} or \sphinxstylestrong{kpasswd\_listen} variables or equivalents) or -they will be ignored. Any configured listener addresses that do not -correspond to caller\sphinxhyphen{}provided sockets will be ignored if socket -activation is used. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/kadmind:see-also}} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{kpasswd(1)}, {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, -{\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}}, {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{kdb5\_util} -\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}}\label{\detokenize{admin/admin_commands/kdb5_util::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/kdb5_util:synopsis}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kdb5\_util} -{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{mkeytype}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}kv} \sphinxstyleemphasis{mkeyVNO}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}m}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}sf} \sphinxstyleemphasis{stashfilename}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{password}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}{]} -\sphinxstyleemphasis{command} {[}\sphinxstyleemphasis{command\_options}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/kdb5_util:description}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-synopsis-end}} -\sphinxAtStartPar -kdb5\_util allows an administrator to perform maintenance procedures on -the KDC database. Databases can be created, destroyed, and dumped to -or loaded from ASCII files. kdb5\_util can create a Kerberos master -key stash file or perform live rollover of the master key. - -\sphinxAtStartPar -When kdb5\_util is run, it attempts to acquire the master key and open -the database. However, execution continues regardless of whether or -not kdb5\_util successfully opens the database, because the database -may not exist yet or the stash file may be corrupt. - -\sphinxAtStartPar -Note that some KDC database modules may not support all kdb5\_util -commands. - - -\subsection{COMMAND\sphinxhyphen{}LINE OPTIONS} -\label{\detokenize{admin/admin_commands/kdb5_util:command-line-options}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}} -\sphinxAtStartPar -specifies the Kerberos realm of the database. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}} -\sphinxAtStartPar -specifies the name under which the principal database is stored; -by default the database is that listed in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. The -password policy database and lock files are also derived from this -value. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{mkeytype}} -\sphinxAtStartPar -specifies the key type of the master key in the database. The -default is given by the \sphinxstylestrong{master\_key\_type} variable in -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}kv} \sphinxstyleemphasis{mkeyVNO}} -\sphinxAtStartPar -Specifies the version number of the master key in the database; -the default is 1. Note that 0 is not allowed. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}} -\sphinxAtStartPar -principal name for the master key in the database. If not -specified, the name is determined by the \sphinxstylestrong{master\_key\_name} -variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}m}} -\sphinxAtStartPar -specifies that the master database password should be read from -the keyboard rather than fetched from a file on disk. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}sf} \sphinxstyleemphasis{stash\_file}} -\sphinxAtStartPar -specifies the stash filename of the master database password. If -not specified, the filename is determined by the -\sphinxstylestrong{key\_stash\_file} variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{password}} -\sphinxAtStartPar -specifies the master database password. Using this option may -expose the password to other users on the system via the process -list. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}} -\sphinxAtStartPar -specifies database\sphinxhyphen{}specific options. See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for -supported options. - -\end{description} - - -\subsection{COMMANDS} -\label{\detokenize{admin/admin_commands/kdb5_util:commands}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-options-end}} - -\subsubsection{create} -\label{\detokenize{admin/admin_commands/kdb5_util:create}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-create}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{create} {[}\sphinxstylestrong{\sphinxhyphen{}s}{]} -\end{quote} - -\sphinxAtStartPar -Creates a new database. If the \sphinxstylestrong{\sphinxhyphen{}s} option is specified, the stash -file is also created. This command fails if the database already -exists. If the command is successful, the database is opened just as -if it had already existed when the program was first run. - - -\subsubsection{destroy} -\label{\detokenize{admin/admin_commands/kdb5_util:destroy}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-create-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-destroy}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{destroy} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} -\end{quote} - -\sphinxAtStartPar -Destroys the database, first overwriting the disk sectors and then -unlinking the files, after prompting the user for confirmation. With -the \sphinxstylestrong{\sphinxhyphen{}f} argument, does not prompt the user. - - -\subsubsection{stash} -\label{\detokenize{admin/admin_commands/kdb5_util:stash}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-destroy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-stash}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{stash} {[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{keyfile}{]} -\end{quote} - -\sphinxAtStartPar -Stores the master principal’s keys in a stash file. The \sphinxstylestrong{\sphinxhyphen{}f} -argument can be used to override the \sphinxstyleemphasis{keyfile} specified in -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - - -\subsubsection{dump} -\label{\detokenize{admin/admin_commands/kdb5_util:dump}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-stash-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-dump}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{dump} {[}\sphinxstylestrong{\sphinxhyphen{}b7}|\sphinxstylestrong{\sphinxhyphen{}r13}|\sphinxstylestrong{\sphinxhyphen{}r18}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}verbose}{]} {[}\sphinxstylestrong{\sphinxhyphen{}mkey\_convert}{]} {[}\sphinxstylestrong{\sphinxhyphen{}new\_mkey\_file} -\sphinxstyleemphasis{mkey\_file}{]} {[}\sphinxstylestrong{\sphinxhyphen{}rev}{]} {[}\sphinxstylestrong{\sphinxhyphen{}recurse}{]} {[}\sphinxstyleemphasis{filename} -{[}\sphinxstyleemphasis{principals}…{]}{]} -\end{quote} - -\sphinxAtStartPar -Dumps the current Kerberos and KADM5 database into an ASCII file. By -default, the database is dumped in current format, “kdb5\_util -load\_dump version 7”. If filename is not specified, or is the string -“\sphinxhyphen{}”, the dump is sent to standard output. Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}b7}} -\sphinxAtStartPar -causes the dump to be in the Kerberos 5 Beta 7 format (“kdb5\_util -load\_dump version 4”). This was the dump format produced on -releases prior to 1.2.2. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r13}} -\sphinxAtStartPar -causes the dump to be in the Kerberos 5 1.3 format (“kdb5\_util -load\_dump version 5”). This was the dump format produced on -releases prior to 1.8. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r18}} -\sphinxAtStartPar -causes the dump to be in the Kerberos 5 1.8 format (“kdb5\_util -load\_dump version 6”). This was the dump format produced on -releases prior to 1.11. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}verbose}} -\sphinxAtStartPar -causes the name of each principal and policy to be printed as it -is dumped. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}mkey\_convert}} -\sphinxAtStartPar -prompts for a new master key. This new master key will be used to -re\sphinxhyphen{}encrypt principal key data in the dumpfile. The principal keys -themselves will not be changed. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}new\_mkey\_file} \sphinxstyleemphasis{mkey\_file}} -\sphinxAtStartPar -the filename of a stash file. The master key in this stash file -will be used to re\sphinxhyphen{}encrypt the key data in the dumpfile. The key -data in the database will not be changed. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}rev}} -\sphinxAtStartPar -dumps in reverse order. This may recover principals that do not -dump normally, in cases where database corruption has occurred. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}recurse}} -\sphinxAtStartPar -causes the dump to walk the database recursively (btree only). -This may recover principals that do not dump normally, in cases -where database corruption has occurred. In cases of such -corruption, this option will probably retrieve more principals -than the \sphinxstylestrong{\sphinxhyphen{}rev} option will. - -\sphinxAtStartPar -\DUrole{versionmodified,changed}{Changed in version 1.15: }Release 1.15 restored the functionality of the \sphinxstylestrong{\sphinxhyphen{}recurse} -option. - -\sphinxAtStartPar -\DUrole{versionmodified,changed}{Changed in version 1.5: }The \sphinxstylestrong{\sphinxhyphen{}recurse} option ceased working until release 1.15, -doing a normal dump instead of a recursive traversal. - -\end{description} - - -\subsubsection{load} -\label{\detokenize{admin/admin_commands/kdb5_util:load}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-dump-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-load}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{load} {[}\sphinxstylestrong{\sphinxhyphen{}b7}|\sphinxstylestrong{\sphinxhyphen{}r13}|\sphinxstylestrong{\sphinxhyphen{}r18}{]} {[}\sphinxstylestrong{\sphinxhyphen{}hash}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}verbose}{]} {[}\sphinxstylestrong{\sphinxhyphen{}update}{]} \sphinxstyleemphasis{filename} -\end{quote} - -\sphinxAtStartPar -Loads a database dump from the named file into the named database. If -no option is given to determine the format of the dump file, the -format is detected automatically and handled as appropriate. Unless -the \sphinxstylestrong{\sphinxhyphen{}update} option is given, \sphinxstylestrong{load} creates a new database -containing only the data in the dump file, overwriting the contents of -any previously existing database. Note that when using the LDAP KDC -database module, the \sphinxstylestrong{\sphinxhyphen{}update} flag is required. - -\sphinxAtStartPar -Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}b7}} -\sphinxAtStartPar -requires the database to be in the Kerberos 5 Beta 7 format -(“kdb5\_util load\_dump version 4”). This was the dump format -produced on releases prior to 1.2.2. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r13}} -\sphinxAtStartPar -requires the database to be in Kerberos 5 1.3 format (“kdb5\_util -load\_dump version 5”). This was the dump format produced on -releases prior to 1.8. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r18}} -\sphinxAtStartPar -requires the database to be in Kerberos 5 1.8 format (“kdb5\_util -load\_dump version 6”). This was the dump format produced on -releases prior to 1.11. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}hash}} -\sphinxAtStartPar -stores the database in hash format, if using the DB2 database -type. If this option is not specified, the database will be -stored in btree format. This option is not recommended, as -databases stored in hash format are known to corrupt data and lose -principals. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}verbose}} -\sphinxAtStartPar -causes the name of each principal and policy to be printed as it -is dumped. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}update}} -\sphinxAtStartPar -records from the dump file are added to or updated in the existing -database. Otherwise, a new database is created containing only -what is in the dump file and the old one destroyed upon successful -completion. - -\end{description} - - -\subsubsection{ark} -\label{\detokenize{admin/admin_commands/kdb5_util:ark}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-load-end}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{ark} {[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt},…{]} \sphinxstyleemphasis{principal} -\end{quote} - -\sphinxAtStartPar -Adds new random keys to \sphinxstyleemphasis{principal} at the next available key version -number. Keys for the current highest key version number will be -preserved. The \sphinxstylestrong{\sphinxhyphen{}e} option specifies the list of encryption and -salt types to be used for the new keys. - - -\subsubsection{add\_mkey} -\label{\detokenize{admin/admin_commands/kdb5_util:add-mkey}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{add\_mkey} {[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{etype}{]} {[}\sphinxstylestrong{\sphinxhyphen{}s}{]} -\end{quote} - -\sphinxAtStartPar -Adds a new master key to the master key principal, but does not mark -it as active. Existing master keys will remain. The \sphinxstylestrong{\sphinxhyphen{}e} option -specifies the encryption type of the new master key; see -{\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of possible -values. The \sphinxstylestrong{\sphinxhyphen{}s} option stashes the new master key in the stash -file, which will be created if it doesn’t already exist. - -\sphinxAtStartPar -After a new master key is added, it should be propagated to replica -servers via a manual or periodic invocation of {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}}. Then, -the stash files on the replica servers should be updated with the -kdb5\_util \sphinxstylestrong{stash} command. Once those steps are complete, the key -is ready to be marked active with the kdb5\_util \sphinxstylestrong{use\_mkey} command. - - -\subsubsection{use\_mkey} -\label{\detokenize{admin/admin_commands/kdb5_util:use-mkey}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{use\_mkey} \sphinxstyleemphasis{mkeyVNO} {[}\sphinxstyleemphasis{time}{]} -\end{quote} - -\sphinxAtStartPar -Sets the activation time of the master key specified by \sphinxstyleemphasis{mkeyVNO}. -Once a master key becomes active, it will be used to encrypt newly -created principal keys. If no \sphinxstyleemphasis{time} argument is given, the current -time is used, causing the specified master key version to become -active immediately. The format for \sphinxstyleemphasis{time} is \DUrole{xref,std,std-ref}{getdate} string. - -\sphinxAtStartPar -After a new master key becomes active, the kdb5\_util -\sphinxstylestrong{update\_princ\_encryption} command can be used to update all -principal keys to be encrypted in the new master key. - - -\subsubsection{list\_mkeys} -\label{\detokenize{admin/admin_commands/kdb5_util:list-mkeys}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{list\_mkeys} -\end{quote} - -\sphinxAtStartPar -List all master keys, from most recent to earliest, in the master key -principal. The output will show the kvno, enctype, and salt type for -each mkey, similar to the output of {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{getprinc}. A -\sphinxcode{\sphinxupquote{*}} following an mkey denotes the currently active master key. - - -\subsubsection{purge\_mkeys} -\label{\detokenize{admin/admin_commands/kdb5_util:purge-mkeys}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{purge\_mkeys} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} {[}\sphinxstylestrong{\sphinxhyphen{}n}{]} {[}\sphinxstylestrong{\sphinxhyphen{}v}{]} -\end{quote} - -\sphinxAtStartPar -Delete master keys from the master key principal that are not used to -protect any principals. This command can be used to remove old master -keys all principal keys are protected by a newer master key. -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}f}} -\sphinxAtStartPar -does not prompt for confirmation. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}n}} -\sphinxAtStartPar -performs a dry run, showing master keys that would be purged, but -not actually purging any keys. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}v}} -\sphinxAtStartPar -gives more verbose output. - -\end{description} - - -\subsubsection{update\_princ\_encryption} -\label{\detokenize{admin/admin_commands/kdb5_util:update-princ-encryption}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{update\_princ\_encryption} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} {[}\sphinxstylestrong{\sphinxhyphen{}n}{]} {[}\sphinxstylestrong{\sphinxhyphen{}v}{]} -{[}\sphinxstyleemphasis{princ\sphinxhyphen{}pattern}{]} -\end{quote} - -\sphinxAtStartPar -Update all principal records (or only those matching the -\sphinxstyleemphasis{princ\sphinxhyphen{}pattern} glob pattern) to re\sphinxhyphen{}encrypt the key data using the -active database master key, if they are encrypted using a different -version, and give a count at the end of the number of principals -updated. If the \sphinxstylestrong{\sphinxhyphen{}f} option is not given, ask for confirmation -before starting to make changes. The \sphinxstylestrong{\sphinxhyphen{}v} option causes each -principal processed to be listed, with an indication as to whether it -needed updating or not. The \sphinxstylestrong{\sphinxhyphen{}n} option performs a dry run, only -showing the actions which would have been taken. - - -\subsubsection{tabdump} -\label{\detokenize{admin/admin_commands/kdb5_util:tabdump}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{tabdump} {[}\sphinxstylestrong{\sphinxhyphen{}H}{]} {[}\sphinxstylestrong{\sphinxhyphen{}c}{]} {[}\sphinxstylestrong{\sphinxhyphen{}e}{]} {[}\sphinxstylestrong{\sphinxhyphen{}n}{]} {[}\sphinxstylestrong{\sphinxhyphen{}o} \sphinxstyleemphasis{outfile}{]} -\sphinxstyleemphasis{dumptype} -\end{quote} - -\sphinxAtStartPar -Dump selected fields of the database in a tabular format suitable for -reporting (e.g., using traditional Unix text processing tools) or -importing into relational databases. The data format is tab\sphinxhyphen{}separated -(default), or optionally comma\sphinxhyphen{}separated (CSV), with a fixed number of -columns. The output begins with a header line containing field names, -unless suppression is requested using the \sphinxstylestrong{\sphinxhyphen{}H} option. - -\sphinxAtStartPar -The \sphinxstyleemphasis{dumptype} parameter specifies the name of an output table (see -below). - -\sphinxAtStartPar -Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}H}} -\sphinxAtStartPar -suppress writing the field names in a header line - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}c}} -\sphinxAtStartPar -use comma separated values (CSV) format, with minimal quoting, -instead of the default tab\sphinxhyphen{}separated (unquoted, unescaped) format - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e}} -\sphinxAtStartPar -write empty hexadecimal string fields as empty fields instead of -as “\sphinxhyphen{}1”. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}n}} -\sphinxAtStartPar -produce numeric output for fields that normally have symbolic -output, such as enctypes and flag names. Also requests output of -time stamps as decimal POSIX time\_t values. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}o} \sphinxstyleemphasis{outfile}} -\sphinxAtStartPar -write the dump to the specified output file instead of to standard -output - -\end{description} - -\sphinxAtStartPar -Dump types: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{alias}} -\sphinxAtStartPar -principal alias information -\begin{description} -\sphinxlineitem{\sphinxstylestrong{aliasname}} -\sphinxAtStartPar -the name of the alias - -\sphinxlineitem{\sphinxstylestrong{targetname}} -\sphinxAtStartPar -the target of the alias - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{keydata}} -\sphinxAtStartPar -principal encryption key information, including actual key data -(which is still encrypted in the master key) -\begin{description} -\sphinxlineitem{\sphinxstylestrong{name}} -\sphinxAtStartPar -principal name - -\sphinxlineitem{\sphinxstylestrong{keyindex}} -\sphinxAtStartPar -index of this key in the principal’s key list - -\sphinxlineitem{\sphinxstylestrong{kvno}} -\sphinxAtStartPar -key version number - -\sphinxlineitem{\sphinxstylestrong{enctype}} -\sphinxAtStartPar -encryption type - -\sphinxlineitem{\sphinxstylestrong{key}} -\sphinxAtStartPar -key data as a hexadecimal string - -\sphinxlineitem{\sphinxstylestrong{salttype}} -\sphinxAtStartPar -salt type - -\sphinxlineitem{\sphinxstylestrong{salt}} -\sphinxAtStartPar -salt data as a hexadecimal string - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{keyinfo}} -\sphinxAtStartPar -principal encryption key information (as in \sphinxstylestrong{keydata} above), -excluding actual key data - -\sphinxlineitem{\sphinxstylestrong{princ\_flags}} -\sphinxAtStartPar -principal boolean attributes. Flag names print as hexadecimal -numbers if the \sphinxstylestrong{\sphinxhyphen{}n} option is specified, and all flag positions -are printed regardless of whether or not they are set. If \sphinxstylestrong{\sphinxhyphen{}n} -is not specified, print all known flag names for each principal, -but only print hexadecimal flag names if the corresponding flag is -set. -\begin{description} -\sphinxlineitem{\sphinxstylestrong{name}} -\sphinxAtStartPar -principal name - -\sphinxlineitem{\sphinxstylestrong{flag}} -\sphinxAtStartPar -flag name - -\sphinxlineitem{\sphinxstylestrong{value}} -\sphinxAtStartPar -boolean value (0 for clear, or 1 for set) - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{princ\_lockout}} -\sphinxAtStartPar -state information used for tracking repeated password failures -\begin{description} -\sphinxlineitem{\sphinxstylestrong{name}} -\sphinxAtStartPar -principal name - -\sphinxlineitem{\sphinxstylestrong{last\_success}} -\sphinxAtStartPar -time stamp of most recent successful authentication - -\sphinxlineitem{\sphinxstylestrong{last\_failed}} -\sphinxAtStartPar -time stamp of most recent failed authentication - -\sphinxlineitem{\sphinxstylestrong{fail\_count}} -\sphinxAtStartPar -count of failed attempts - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{princ\_meta}} -\sphinxAtStartPar -principal metadata -\begin{description} -\sphinxlineitem{\sphinxstylestrong{name}} -\sphinxAtStartPar -principal name - -\sphinxlineitem{\sphinxstylestrong{modby}} -\sphinxAtStartPar -name of last principal to modify this principal - -\sphinxlineitem{\sphinxstylestrong{modtime}} -\sphinxAtStartPar -timestamp of last modification - -\sphinxlineitem{\sphinxstylestrong{lastpwd}} -\sphinxAtStartPar -timestamp of last password change - -\sphinxlineitem{\sphinxstylestrong{policy}} -\sphinxAtStartPar -policy object name - -\sphinxlineitem{\sphinxstylestrong{mkvno}} -\sphinxAtStartPar -key version number of the master key that encrypts this -principal’s key data - -\sphinxlineitem{\sphinxstylestrong{hist\_kvno}} -\sphinxAtStartPar -key version number of the history key that encrypts the key -history data for this principal - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{princ\_stringattrs}} -\sphinxAtStartPar -string attributes (key/value pairs) -\begin{description} -\sphinxlineitem{\sphinxstylestrong{name}} -\sphinxAtStartPar -principal name - -\sphinxlineitem{\sphinxstylestrong{key}} -\sphinxAtStartPar -attribute name - -\sphinxlineitem{\sphinxstylestrong{value}} -\sphinxAtStartPar -attribute value - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{princ\_tktpolicy}} -\sphinxAtStartPar -per\sphinxhyphen{}principal ticket policy data, including maximum ticket -lifetimes -\begin{description} -\sphinxlineitem{\sphinxstylestrong{name}} -\sphinxAtStartPar -principal name - -\sphinxlineitem{\sphinxstylestrong{expiration}} -\sphinxAtStartPar -principal expiration date - -\sphinxlineitem{\sphinxstylestrong{pw\_expiration}} -\sphinxAtStartPar -password expiration date - -\sphinxlineitem{\sphinxstylestrong{max\_life}} -\sphinxAtStartPar -maximum ticket lifetime - -\sphinxlineitem{\sphinxstylestrong{max\_renew\_life}} -\sphinxAtStartPar -maximum renewable ticket lifetime - -\end{description} - -\end{description} - -\sphinxAtStartPar -Examples: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYGZdl{} kdb5\PYGZus{}util tabdump \PYGZhy{}o keyinfo.txt keyinfo -\PYGZdl{} cat keyinfo.txt -name keyindex kvno enctype salttype salt -K/M@EXAMPLE.COM 0 1 aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha384\PYGZhy{}192 normal \PYGZhy{}1 -foo@EXAMPLE.COM 0 1 aes128\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 normal \PYGZhy{}1 -bar@EXAMPLE.COM 0 1 aes128\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 normal \PYGZhy{}1 -\PYGZdl{} sqlite3 -sqlite\PYGZgt{} .mode tabs -sqlite\PYGZgt{} .import keyinfo.txt keyinfo -sqlite\PYGZgt{} select * from keyinfo where enctype like \PYGZsq{}aes256\PYGZhy{}\PYGZpc{}\PYGZsq{}; -K/M@EXAMPLE.COM 1 1 aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha384\PYGZhy{}192 normal \PYGZhy{}1 -sqlite\PYGZgt{} .quit -\PYGZdl{} awk \PYGZhy{}F\PYGZsq{}\PYGZbs{}t\PYGZsq{} \PYGZsq{}\PYGZdl{}4 \PYGZti{} /aes256\PYGZhy{}/ \PYGZob{} print \PYGZcb{}\PYGZsq{} keyinfo.txt -K/M@EXAMPLE.COM 1 1 aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha384\PYGZhy{}192 normal \PYGZhy{}1 -\end{sphinxVerbatim} - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/kdb5_util:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/kdb5_util:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{kdb5\_ldap\_util} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:synopsis}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kdb5\_ldap\_util} -{[}\sphinxstylestrong{\sphinxhyphen{}D} \sphinxstyleemphasis{user\_dn} {[}\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{passwd}{]}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}H} \sphinxstyleemphasis{ldapuri}{]} -\sphinxstylestrong{command} -{[}\sphinxstyleemphasis{command\_options}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:description}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-synopsis-end}} -\sphinxAtStartPar -kdb5\_ldap\_util allows an administrator to manage realms, Kerberos -services and ticket policies. - - -\subsection{COMMAND\sphinxhyphen{}LINE OPTIONS} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:command-line-options}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}} -\sphinxAtStartPar -Specifies the realm to be operated on. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}D} \sphinxstyleemphasis{user\_dn}} -\sphinxAtStartPar -Specifies the Distinguished Name (DN) of the user who has -sufficient rights to perform the operation on the LDAP server. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{passwd}} -\sphinxAtStartPar -Specifies the password of \sphinxstyleemphasis{user\_dn}. This option is not -recommended. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}H} \sphinxstyleemphasis{ldapuri}} -\sphinxAtStartPar -Specifies the URI of the LDAP server. - -\end{description} - -\sphinxAtStartPar -By default, kdb5\_ldap\_util operates on the default realm (as specified -in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}) and connects and authenticates to the LDAP -server in the same manner as :ref:kadmind(8)\textasciigrave{} would given the -parameters in {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbdefaults{]}}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - - -\subsection{COMMANDS} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:commands}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-options-end}} - -\subsubsection{create} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:create}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-create}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{create} -{[}\sphinxstylestrong{\sphinxhyphen{}subtrees} \sphinxstyleemphasis{subtree\_dn\_list}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}sscope} \sphinxstyleemphasis{search\_scope}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}containerref} \sphinxstyleemphasis{container\_reference\_dn}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{mkeytype}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}kv} \sphinxstyleemphasis{mkeyVNO}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}m|\sphinxhyphen{}P} \sphinxstyleemphasis{password}|\sphinxstylestrong{\sphinxhyphen{}sf} \sphinxstyleemphasis{stashfilename}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}s}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}{]} -{[}\sphinxstyleemphasis{ticket\_flags}{]} -\end{quote} - -\sphinxAtStartPar -Creates realm in directory. Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}subtrees} \sphinxstyleemphasis{subtree\_dn\_list}} -\sphinxAtStartPar -Specifies the list of subtrees containing the principals of a -realm. The list contains the DNs of the subtree objects separated -by colon (\sphinxcode{\sphinxupquote{:}}). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}sscope} \sphinxstyleemphasis{search\_scope}} -\sphinxAtStartPar -Specifies the scope for searching the principals under the -subtree. The possible values are 1 or one (one level), 2 or sub -(subtrees). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}containerref} \sphinxstyleemphasis{container\_reference\_dn}} -\sphinxAtStartPar -Specifies the DN of the container object in which the principals -of a realm will be created. If the container reference is not -configured for a realm, the principals will be created in the -realm container. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{mkeytype}} -\sphinxAtStartPar -Specifies the key type of the master key in the database. The -default is given by the \sphinxstylestrong{master\_key\_type} variable in -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}kv} \sphinxstyleemphasis{mkeyVNO}} -\sphinxAtStartPar -Specifies the version number of the master key in the database; -the default is 1. Note that 0 is not allowed. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}} -\sphinxAtStartPar -Specifies the principal name for the master key in the database. -If not specified, the name is determined by the -\sphinxstylestrong{master\_key\_name} variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}m}} -\sphinxAtStartPar -Specifies that the master database password should be read from -the TTY rather than fetched from a file on the disk. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{password}} -\sphinxAtStartPar -Specifies the master database password. This option is not -recommended. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}sf} \sphinxstyleemphasis{stashfilename}} -\sphinxAtStartPar -Specifies the stash file of the master database password. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}s}} -\sphinxAtStartPar -Specifies that the stash file is to be created. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum ticket life for -principals in this realm. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum renewable life of -tickets for principals in this realm. - -\sphinxlineitem{\sphinxstyleemphasis{ticket\_flags}} -\sphinxAtStartPar -Specifies global ticket flags for the realm. Allowable flags are -documented in the description of the \sphinxstylestrong{add\_principal} command in -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}. - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{create} \PYG{o}{\PYGZhy{}}\PYG{n}{subtrees} \PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{sscope} \PYG{n}{SUB} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\PYG{n}{Initializing} \PYG{n}{database} \PYG{k}{for} \PYG{n}{realm} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{ATHENA.MIT.EDU}\PYG{l+s+s1}{\PYGZsq{}} -\PYG{n}{You} \PYG{n}{will} \PYG{n}{be} \PYG{n}{prompted} \PYG{k}{for} \PYG{n}{the} \PYG{n}{database} \PYG{n}{Master} \PYG{n}{Password}\PYG{o}{.} -\PYG{n}{It} \PYG{o+ow}{is} \PYG{n}{important} \PYG{n}{that} \PYG{n}{you} \PYG{n}{NOT} \PYG{n}{FORGET} \PYG{n}{this} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Enter} \PYG{n}{KDC} \PYG{n}{database} \PYG{n}{master} \PYG{n}{key}\PYG{p}{:} -\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{KDC} \PYG{n}{database} \PYG{n}{master} \PYG{n}{key} \PYG{n}{to} \PYG{n}{verify}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{modify} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:modify}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-create-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-modify}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{modify} -{[}\sphinxstylestrong{\sphinxhyphen{}subtrees} \sphinxstyleemphasis{subtree\_dn\_list}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}sscope} \sphinxstyleemphasis{search\_scope}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}containerref} \sphinxstyleemphasis{container\_reference\_dn}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}{]} -{[}\sphinxstyleemphasis{ticket\_flags}{]} -\end{quote} - -\sphinxAtStartPar -Modifies the attributes of a realm. Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}subtrees} \sphinxstyleemphasis{subtree\_dn\_list}} -\sphinxAtStartPar -Specifies the list of subtrees containing the principals of a -realm. The list contains the DNs of the subtree objects separated -by colon (\sphinxcode{\sphinxupquote{:}}). This list replaces the existing list. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}sscope} \sphinxstyleemphasis{search\_scope}} -\sphinxAtStartPar -Specifies the scope for searching the principals under the -subtrees. The possible values are 1 or one (one level), 2 or sub -(subtrees). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}containerref} \sphinxstyleemphasis{container\_reference\_dn} Specifies the DN of the} -\sphinxAtStartPar -container object in which the principals of a realm will be -created. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum ticket life for -principals in this realm. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum renewable life of -tickets for principals in this realm. - -\sphinxlineitem{\sphinxstyleemphasis{ticket\_flags}} -\sphinxAtStartPar -Specifies global ticket flags for the realm. Allowable flags are -documented in the description of the \sphinxstylestrong{add\_principal} command in -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}. - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} - \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{modify} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - - -\subsubsection{view} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:view}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-modify-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-view}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{view} -\end{quote} - -\sphinxAtStartPar -Displays the attributes of a realm. - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{view} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\PYG{n}{Realm} \PYG{n}{Name}\PYG{p}{:} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{Subtree}\PYG{p}{:} \PYG{n}{ou}\PYG{o}{=}\PYG{n}{users}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} -\PYG{n}{Subtree}\PYG{p}{:} \PYG{n}{ou}\PYG{o}{=}\PYG{n}{servers}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} -\PYG{n}{SearchScope}\PYG{p}{:} \PYG{n}{ONE} -\PYG{n}{Maximum} \PYG{n}{ticket} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{01}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} -\PYG{n}{Maximum} \PYG{n}{renewable} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{10}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} -\PYG{n}{Ticket} \PYG{n}{flags}\PYG{p}{:} \PYG{n}{DISALLOW\PYGZus{}FORWARDABLE} \PYG{n}{REQUIRES\PYGZus{}PWCHANGE} -\end{sphinxVerbatim} - - -\subsubsection{destroy} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:destroy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-view-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-destroy}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{destroy} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} -\end{quote} - -\sphinxAtStartPar -Destroys an existing realm. Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}f}} -\sphinxAtStartPar -If specified, will not prompt the user for confirmation. - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -shell\PYGZpc{} kdb5\PYGZus{}ldap\PYGZus{}util \PYGZhy{}r ATHENA.MIT.EDU \PYGZhy{}D cn=admin,o=org \PYGZhy{}H - ldaps://ldap\PYGZhy{}server1.mit.edu destroy -Password for \PYGZdq{}cn=admin,o=org\PYGZdq{}: -Deleting KDC database of \PYGZsq{}ATHENA.MIT.EDU\PYGZsq{}, are you sure? -(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes -OK, deleting database of \PYGZsq{}ATHENA.MIT.EDU\PYGZsq{}... -shell\PYGZpc{} -\end{sphinxVerbatim} - - -\subsubsection{list} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:list}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-destroy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-list}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{list} -\end{quote} - -\sphinxAtStartPar -Lists the names of realms under the container. - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} - \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n+nb}{list} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{OPENLDAP}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{MEDIA}\PYG{o}{\PYGZhy{}}\PYG{n}{LAB}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - - -\subsubsection{stashsrvpw} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:stashsrvpw}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-list-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-stashsrvpw}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{stashsrvpw} -{[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{filename}{]} -\sphinxstyleemphasis{name} -\end{quote} - -\sphinxAtStartPar -Allows an administrator to store the password for service object in a -file so that KDC and Administration server can use it to authenticate -to the LDAP server. Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{filename}} -\sphinxAtStartPar -Specifies the complete path of the service password file. By -default, \sphinxcode{\sphinxupquote{/usr/local/var/service\_passwd}} is used. - -\sphinxlineitem{\sphinxstyleemphasis{name}} -\sphinxAtStartPar -Specifies the name of the object whose password is to be stored. -If {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} or {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} are configured for -simple binding, this should be the distinguished name it will -use as given by the \sphinxstylestrong{ldap\_kdc\_dn} or \sphinxstylestrong{ldap\_kadmind\_dn} -variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. If the KDC or kadmind is -configured for SASL binding, this should be the authentication -name it will use as given by the \sphinxstylestrong{ldap\_kdc\_sasl\_authcid} or -\sphinxstylestrong{ldap\_kadmind\_sasl\_authcid} variable. - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{n}{stashsrvpw} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{/}\PYG{n}{home}\PYG{o}{/}\PYG{n}{andrew}\PYG{o}{/}\PYG{n}{conf\PYGZus{}keyfile} - \PYG{n}{cn}\PYG{o}{=}\PYG{n}{service}\PYG{o}{\PYGZhy{}}\PYG{n}{kdc}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=service\PYGZhy{}kdc,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=service\PYGZhy{}kdc,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{create\_policy} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:create-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-stashsrvpw-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-create-policy}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{create\_policy} -{[}\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}{]} -{[}\sphinxstyleemphasis{ticket\_flags}{]} -\sphinxstyleemphasis{policy\_name} -\end{quote} - -\sphinxAtStartPar -Creates a ticket policy in the directory. Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum ticket life for -principals. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum renewable life of -tickets for principals. - -\sphinxlineitem{\sphinxstyleemphasis{ticket\_flags}} -\sphinxAtStartPar -Specifies the ticket flags. If this option is not specified, by -default, no restriction will be set by the policy. Allowable -flags are documented in the description of the \sphinxstylestrong{add\_principal} -command in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}. - -\sphinxlineitem{\sphinxstyleemphasis{policy\_name}} -\sphinxAtStartPar -Specifies the name of the ticket policy. - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{create\PYGZus{}policy} \PYG{o}{\PYGZhy{}}\PYG{n}{maxtktlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{1 day}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{o}{\PYGZhy{}}\PYG{n}{maxrenewlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{1 week}\PYG{l+s+s2}{\PYGZdq{}} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}postdated} \PYG{o}{+}\PYG{n}{needchange} - \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}forwardable} \PYG{n}{tktpolicy} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{modify\_policy} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:modify-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-create-policy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-modify-policy}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{modify\_policy} -{[}\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}{]} -{[}\sphinxstyleemphasis{ticket\_flags}{]} -\sphinxstyleemphasis{policy\_name} -\end{quote} - -\sphinxAtStartPar -Modifies the attributes of a ticket policy. Options are same as for -\sphinxstylestrong{create\_policy}. - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} - \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{modify\PYGZus{}policy} - \PYG{o}{\PYGZhy{}}\PYG{n}{maxtktlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{60 minutes}\PYG{l+s+s2}{\PYGZdq{}} \PYG{o}{\PYGZhy{}}\PYG{n}{maxrenewlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{10 hours}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{o}{+}\PYG{n}{allow\PYGZus{}postdated} \PYG{o}{\PYGZhy{}}\PYG{n}{requires\PYGZus{}preauth} \PYG{n}{tktpolicy} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\end{sphinxVerbatim} - - -\subsubsection{view\_policy} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:view-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-modify-policy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-view-policy}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{view\_policy} -\sphinxstyleemphasis{policy\_name} -\end{quote} - -\sphinxAtStartPar -Displays the attributes of the named ticket policy. - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{view\PYGZus{}policy} \PYG{n}{tktpolicy} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\PYG{n}{Ticket} \PYG{n}{policy}\PYG{p}{:} \PYG{n}{tktpolicy} -\PYG{n}{Maximum} \PYG{n}{ticket} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{01}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} -\PYG{n}{Maximum} \PYG{n}{renewable} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{10}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} -\PYG{n}{Ticket} \PYG{n}{flags}\PYG{p}{:} \PYG{n}{DISALLOW\PYGZus{}FORWARDABLE} \PYG{n}{REQUIRES\PYGZus{}PWCHANGE} -\end{sphinxVerbatim} - - -\subsubsection{destroy\_policy} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:destroy-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-view-policy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-destroy-policy}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{destroy\_policy} -{[}\sphinxstylestrong{\sphinxhyphen{}force}{]} -\sphinxstyleemphasis{policy\_name} -\end{quote} - -\sphinxAtStartPar -Destroys an existing ticket policy. Options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}force}} -\sphinxAtStartPar -Forces the deletion of the policy object. If not specified, the -user will be prompted for confirmation before deleting the policy. - -\sphinxlineitem{\sphinxstyleemphasis{policy\_name}} -\sphinxAtStartPar -Specifies the name of the ticket policy. - -\end{description} - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -kdb5\PYGZus{}ldap\PYGZus{}util \PYGZhy{}D cn=admin,o=org \PYGZhy{}H ldaps://ldap\PYGZhy{}server1.mit.edu - \PYGZhy{}r ATHENA.MIT.EDU destroy\PYGZus{}policy tktpolicy -Password for \PYGZdq{}cn=admin,o=org\PYGZdq{}: -This will delete the policy object \PYGZsq{}tktpolicy\PYGZsq{}, are you sure? -(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes -** policy object \PYGZsq{}tktpolicy\PYGZsq{} deleted. -\end{sphinxVerbatim} - - -\subsubsection{list\_policy} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:list-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-destroy-policy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-list-policy}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{list\_policy} -\end{quote} - -\sphinxAtStartPar -Lists ticket policies. - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} - \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{list\PYGZus{}policy} -\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} -\PYG{n}{tktpolicy} -\PYG{n}{tmppolicy} -\PYG{n}{userpolicy} -\end{sphinxVerbatim} - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:environment}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-list-policy-end}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/kdb5_ldap_util:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{krb5kdc} -\label{\detokenize{admin/admin_commands/krb5kdc:krb5kdc}}\label{\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}}\label{\detokenize{admin/admin_commands/krb5kdc::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/krb5kdc:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{krb5kdc} -{[}\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{keytype}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{portnum}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}m}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}n}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{numworkers}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{pid\_file}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}T} \sphinxstyleemphasis{time\_offset}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/krb5kdc:description}} -\sphinxAtStartPar -krb5kdc is the Kerberos version 5 Authentication Service and Key -Distribution Center (AS/KDC). - - -\subsection{OPTIONS} -\label{\detokenize{admin/admin_commands/krb5kdc:options}} -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm} option specifies the realm for which the server -should provide service. This option may be specified multiple times -to serve multiple realms. If no \sphinxstylestrong{\sphinxhyphen{}r} option is given, the default -realm (as specified in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}) will be served. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname} option specifies the name under which the -principal database can be found. This option does not apply to the -LDAP database. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{keytype} option specifies the key type of the master key -to be entered manually as a password when \sphinxstylestrong{\sphinxhyphen{}m} is given; the default -is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96}}. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname} option specifies the principal name for the -master key in the database (usually \sphinxcode{\sphinxupquote{K/M}} in the KDC’s realm). - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}m} option specifies that the master database password should -be fetched from the keyboard rather than from a stash file. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}n} option specifies that the KDC does not put itself in the -background and does not disassociate itself from the terminal. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{pid\_file} option tells the KDC to write its PID into -\sphinxstyleemphasis{pid\_file} after it starts up. This can be used to identify whether -the KDC is still running and to allow init scripts to stop the correct -process. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{portnum} option specifies the default UDP and TCP port -numbers which the KDC should listen on for Kerberos version 5 -requests, as a comma\sphinxhyphen{}separated list. This value overrides the port -numbers specified in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdcdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}kdcdefaults{]}}}}} section of -{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, but may be overridden by realm\sphinxhyphen{}specific values. -If no value is given from any source, the default port is 88. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{numworkers} option tells the KDC to fork \sphinxstyleemphasis{numworkers} -processes to listen to the KDC ports and process requests in parallel. -The top level KDC process (whose pid is recorded in the pid file if -the \sphinxstylestrong{\sphinxhyphen{}P} option is also given) acts as a supervisor. The supervisor -will relay SIGHUP signals to the worker subprocesses, and will -terminate the worker subprocess if the it is itself terminated or if -any other worker process exits. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args} option specifies database\sphinxhyphen{}specific arguments. -See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:dboptions}]{\sphinxcrossref{\DUrole{std,std-ref}{Database Options}}}} in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for -supported arguments. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}T} \sphinxstyleemphasis{offset} option specifies a time offset, in seconds, which -the KDC will operate under. It is intended only for testing purposes. - - -\subsection{EXAMPLE} -\label{\detokenize{admin/admin_commands/krb5kdc:example}} -\sphinxAtStartPar -The KDC may service requests for multiple realms (maximum 32 realms). -The realms are listed on the command line. Per\sphinxhyphen{}realm options that can -be specified on the command line pertain for each realm that follows -it and are superseded by subsequent definitions of the same option. - -\sphinxAtStartPar -For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5kdc} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{l+m+mi}{2001} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{REALM1} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{l+m+mi}{2002} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{REALM2} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{REALM3} -\end{sphinxVerbatim} - -\sphinxAtStartPar -specifies that the KDC listen on port 2001 for REALM1 and on port 2002 -for REALM2 and REALM3. Additionally, per\sphinxhyphen{}realm parameters may be -specified in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file. The location of this file -may be specified by the \sphinxstylestrong{KRB5\_KDC\_PROFILE} environment variable. -Per\sphinxhyphen{}realm parameters specified in this file take precedence over -options specified on the command line. See the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} -description for further details. - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/krb5kdc:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - -\sphinxAtStartPar -As of release 1.22, krb5kdc supports systemd socket activation via the -LISTEN\_PID and LISTEN\_FDS environment variables. Sockets provided by -the caller must correspond to configured listener addresses (via the -\sphinxstylestrong{kdc\_listen} variable or equivalent) or they will be ignored. Any -configured listener addresses that do not correspond to -caller\sphinxhyphen{}provided sockets will be ignored if socket activation is used. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/krb5kdc:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}, -{\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{kprop} -\label{\detokenize{admin/admin_commands/kprop:kprop}}\label{\detokenize{admin/admin_commands/kprop:kprop-8}}\label{\detokenize{admin/admin_commands/kprop::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/kprop:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kprop} -{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{file}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}d}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{port}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{keytab}{]} -\sphinxstyleemphasis{replica\_host} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/kprop:description}} -\sphinxAtStartPar -kprop is used to securely propagate a Kerberos V5 database dump file -from the primary Kerberos server to a replica Kerberos server, which is -specified by \sphinxstyleemphasis{replica\_host}. The dump file must be created by -{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}. - - -\subsection{OPTIONS} -\label{\detokenize{admin/admin_commands/kprop:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}} -\sphinxAtStartPar -Specifies the realm of the primary server. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{file}} -\sphinxAtStartPar -Specifies the filename where the dumped principal database file is -to be found; by default the dumped database file is normally -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/replica\_datatrans}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{port}} -\sphinxAtStartPar -Specifies the port to use to contact the {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} server -on the remote host. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}d}} -\sphinxAtStartPar -Prints debugging information. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{keytab}} -\sphinxAtStartPar -Specifies the location of the keytab file. - -\end{description} - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/kprop:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/kprop:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}}, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}, -\DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{kpropd} -\label{\detokenize{admin/admin_commands/kpropd:kpropd}}\label{\detokenize{admin/admin_commands/kpropd:kpropd-8}}\label{\detokenize{admin/admin_commands/kpropd::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/kpropd:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kpropd} -{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}A} \sphinxstyleemphasis{admin\_server}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}a} \sphinxstyleemphasis{acl\_file}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{replica\_dumpfile}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{principal\_database}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{kdb5\_util\_prog}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{port}{]} -{[}\sphinxstylestrong{\textendash{}pid\sphinxhyphen{}file}=\sphinxstyleemphasis{pid\_file}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}D}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}d}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{keytab\_file}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/kpropd:description}} -\sphinxAtStartPar -The \sphinxstyleemphasis{kpropd} command runs on the replica KDC server. It listens for -update requests made by the {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} program. If incremental -propagation is enabled, it periodically requests incremental updates -from the primary KDC. - -\sphinxAtStartPar -When the replica receives a kprop request from the primary, kpropd -accepts the dumped KDC database and places it in a file, and then runs -{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} to load the dumped database into the active -database which is used by {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}. This allows the primary -Kerberos server to use {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} to propagate its database to -the replica servers. Upon a successful download of the KDC database -file, the replica Kerberos server will have an up\sphinxhyphen{}to\sphinxhyphen{}date KDC -database. - -\sphinxAtStartPar -Where incremental propagation is not used, kpropd is commonly invoked -out of inetd(8) as a nowait service. This is done by adding a line to -the \sphinxcode{\sphinxupquote{/etc/inetd.conf}} file which looks like this: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kprop} \PYG{n}{stream} \PYG{n}{tcp} \PYG{n}{nowait} \PYG{n}{root} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{sbin}\PYG{o}{/}\PYG{n}{kpropd} \PYG{n}{kpropd} -\end{sphinxVerbatim} - -\sphinxAtStartPar -kpropd can also run as a standalone daemon, backgrounding itself and -waiting for connections on port 754 (or the port specified with the -\sphinxstylestrong{\sphinxhyphen{}P} option if given). Standalone mode is required for incremental -propagation. Starting in release 1.11, kpropd automatically detects -whether it was run from inetd and runs in standalone mode if it is -not. Prior to release 1.11, the \sphinxstylestrong{\sphinxhyphen{}S} option is required to run -kpropd in standalone mode; this option is now accepted for backward -compatibility but does nothing. - -\sphinxAtStartPar -Incremental propagation may be enabled with the \sphinxstylestrong{iprop\_enable} -variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. If incremental propagation is -enabled, the replica periodically polls the primary KDC for updates, at -an interval determined by the \sphinxstylestrong{iprop\_replica\_poll} variable. If the -replica receives updates, kpropd updates its log file with any updates -from the primary. {\hyperref[\detokenize{admin/admin_commands/kproplog:kproplog-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kproplog}}}} can be used to view a summary of -the update entry log on the replica KDC. If incremental propagation -is enabled, the principal \sphinxcode{\sphinxupquote{kiprop/replicahostname@REALM}} (where -\sphinxstyleemphasis{replicahostname} is the name of the replica KDC host, and \sphinxstyleemphasis{REALM} is -the name of the Kerberos realm) must be present in the replica’s -keytab file. - -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kproplog:kproplog-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kproplog}}}} can be used to force full replication when iprop is -enabled. - - -\subsection{OPTIONS} -\label{\detokenize{admin/admin_commands/kpropd:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}} -\sphinxAtStartPar -Specifies the realm of the primary server. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}A} \sphinxstyleemphasis{admin\_server}} -\sphinxAtStartPar -Specifies the server to be contacted for incremental updates; by -default, the primary admin server is contacted. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{file}} -\sphinxAtStartPar -Specifies the filename where the dumped principal database file is -to be stored; by default the dumped database file is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/from\_master}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{kerberos\_db}} -\sphinxAtStartPar -Path to the Kerberos database file, if not the default. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}p}} -\sphinxAtStartPar -Allows the user to specify the pathname to the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} -program; by default the pathname used is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SBINDIR}}}}\sphinxcode{\sphinxupquote{/kdb5\_util}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}D}} -\sphinxAtStartPar -In this mode, kpropd will not detach itself from the current job -and run in the background. Instead, it will run in the -foreground. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}d}} -\sphinxAtStartPar -Turn on debug mode. kpropd will print out debugging messages -during the database propogation and will run in the foreground -(implies \sphinxstylestrong{\sphinxhyphen{}D}). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}P}} -\sphinxAtStartPar -Allow for an alternate port number for kpropd to listen on. This -is only useful in combination with the \sphinxstylestrong{\sphinxhyphen{}S} option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}a} \sphinxstyleemphasis{acl\_file}} -\sphinxAtStartPar -Allows the user to specify the path to the kpropd.acl file; by -default the path used is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kpropd.acl}}. - -\sphinxlineitem{\sphinxstylestrong{\textendash{}pid\sphinxhyphen{}file}=\sphinxstyleemphasis{pid\_file}} -\sphinxAtStartPar -In standalone mode, write the process ID of the daemon into -\sphinxstyleemphasis{pid\_file}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{keytab\_file}} -\sphinxAtStartPar -Path to a keytab to use for acquiring acceptor credentials. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}} -\sphinxAtStartPar -Database\sphinxhyphen{}specific arguments. See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:dboptions}]{\sphinxcrossref{\DUrole{std,std-ref}{Database Options}}}} in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for supported arguments. - -\end{description} - - -\subsection{FILES} -\label{\detokenize{admin/admin_commands/kpropd:files}}\begin{description} -\sphinxlineitem{kpropd.acl} -\sphinxAtStartPar -Access file for kpropd; the default location is -\sphinxcode{\sphinxupquote{/usr/local/var/krb5kdc/kpropd.acl}}. Each entry is a line -containing the principal of a host from which the local machine -will allow Kerberos database propagation via {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}}. - -\end{description} - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/kpropd:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/kpropd:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}}, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}, -\DUrole{xref,std,std-ref}{kerberos(7)}, inetd(8) - -\sphinxstepscope - - -\section{kproplog} -\label{\detokenize{admin/admin_commands/kproplog:kproplog}}\label{\detokenize{admin/admin_commands/kproplog:kproplog-8}}\label{\detokenize{admin/admin_commands/kproplog::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/kproplog:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kproplog} {[}\sphinxstylestrong{\sphinxhyphen{}h}{]} {[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{num}{]} {[}\sphinxhyphen{}v{]} -\sphinxstylestrong{kproplog} {[}\sphinxhyphen{}R{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/kproplog:description}} -\sphinxAtStartPar -The kproplog command displays the contents of the KDC database update -log to standard output. It can be used to keep track of incremental -updates to the principal database. The update log file contains the -update log maintained by the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} process on the primary -KDC server and the {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} process on the replica KDC -servers. When updates occur, they are logged to this file. -Subsequently any KDC replica configured for incremental updates will -request the current data from the primary KDC and update their log -file with any updates returned. - -\sphinxAtStartPar -The kproplog command requires read access to the update log file. It -will display update entries only for the KDC it runs on. - -\sphinxAtStartPar -If no options are specified, kproplog displays a summary of the update -log. If invoked on the primary, kproplog also displays all of the -update entries. If invoked on a replica KDC server, kproplog displays -only a summary of the updates, which includes the serial number of the -last update received and the associated time stamp of the last update. - - -\subsection{OPTIONS} -\label{\detokenize{admin/admin_commands/kproplog:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}R}} -\sphinxAtStartPar -Reset the update log. This forces full resynchronization. If -used on a replica then that replica will request a full resync. -If used on the primary then all replicas will request full -resyncs. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}h}} -\sphinxAtStartPar -Display a summary of the update log. This information includes -the database version number, state of the database, the number of -updates in the log, the time stamp of the first and last update, -and the version number of the first and last update entry. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{num}} -\sphinxAtStartPar -Display the last \sphinxstyleemphasis{num} update entries in the log. This is useful -when debugging synchronization between KDC servers. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}v}} -\sphinxAtStartPar -Display individual attributes per update. An example of the -output generated for one entry: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{Update} \PYG{n}{Entry} - \PYG{n}{Update} \PYG{n}{serial} \PYG{c+c1}{\PYGZsh{} : 4} - \PYG{n}{Update} \PYG{n}{operation} \PYG{p}{:} \PYG{n}{Add} - \PYG{n}{Update} \PYG{n}{principal} \PYG{p}{:} \PYG{n}{test}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} - \PYG{n}{Update} \PYG{n}{size} \PYG{p}{:} \PYG{l+m+mi}{424} - \PYG{n}{Update} \PYG{n}{committed} \PYG{p}{:} \PYG{k+kc}{True} - \PYG{n}{Update} \PYG{n}{time} \PYG{n}{stamp} \PYG{p}{:} \PYG{n}{Fri} \PYG{n}{Feb} \PYG{l+m+mi}{20} \PYG{l+m+mi}{23}\PYG{p}{:}\PYG{l+m+mi}{37}\PYG{p}{:}\PYG{l+m+mi}{42} \PYG{l+m+mi}{2004} - \PYG{n}{Attributes} \PYG{n}{changed} \PYG{p}{:} \PYG{l+m+mi}{6} - \PYG{n}{Principal} - \PYG{n}{Key} \PYG{n}{data} - \PYG{n}{Password} \PYG{n}{last} \PYG{n}{changed} - \PYG{n}{Modifying} \PYG{n}{principal} - \PYG{n}{Modification} \PYG{n}{time} - \PYG{n}{TL} \PYG{n}{data} -\end{sphinxVerbatim} - -\end{description} - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/kproplog:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/kproplog:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{ktutil} -\label{\detokenize{admin/admin_commands/ktutil:ktutil}}\label{\detokenize{admin/admin_commands/ktutil:ktutil-1}}\label{\detokenize{admin/admin_commands/ktutil::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/ktutil:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{ktutil} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/ktutil:description}} -\sphinxAtStartPar -The ktutil command invokes a command interface from which an -administrator can read, write, or edit entries in a keytab. (Kerberos -V4 srvtab files are no longer supported.) - - -\subsection{COMMANDS} -\label{\detokenize{admin/admin_commands/ktutil:commands}} - -\subsubsection{list} -\label{\detokenize{admin/admin_commands/ktutil:list}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{list} {[}\sphinxstylestrong{\sphinxhyphen{}t}{]} {[}\sphinxstylestrong{\sphinxhyphen{}k}{]} {[}\sphinxstylestrong{\sphinxhyphen{}e}{]} -\end{quote} - -\sphinxAtStartPar -Displays the current keylist. If \sphinxstylestrong{\sphinxhyphen{}t}, \sphinxstylestrong{\sphinxhyphen{}k}, and/or \sphinxstylestrong{\sphinxhyphen{}e} are -specified, also display the timestamp, key contents, or enctype -(respectively). - -\sphinxAtStartPar -Alias: \sphinxstylestrong{l} - - -\subsubsection{read\_kt} -\label{\detokenize{admin/admin_commands/ktutil:read-kt}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{read\_kt} \sphinxstyleemphasis{keytab} -\end{quote} - -\sphinxAtStartPar -Read the Kerberos V5 keytab file \sphinxstyleemphasis{keytab} into the current keylist. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{rkt} - - -\subsubsection{write\_kt} -\label{\detokenize{admin/admin_commands/ktutil:write-kt}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{write\_kt} \sphinxstyleemphasis{keytab} -\end{quote} - -\sphinxAtStartPar -Write the current keylist into the Kerberos V5 keytab file \sphinxstyleemphasis{keytab}. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{wkt} - - -\subsubsection{clear\_list} -\label{\detokenize{admin/admin_commands/ktutil:clear-list}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{clear\_list} -\end{quote} - -\sphinxAtStartPar -Clear the current keylist. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{clear} - - -\subsubsection{delete\_entry} -\label{\detokenize{admin/admin_commands/ktutil:delete-entry}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{delete\_entry} \sphinxstyleemphasis{slot} -\end{quote} - -\sphinxAtStartPar -Delete the entry in slot number \sphinxstyleemphasis{slot} from the current keylist. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{delent} - - -\subsubsection{add\_entry} -\label{\detokenize{admin/admin_commands/ktutil:add-entry}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{add\_entry} \{\sphinxstylestrong{\sphinxhyphen{}key}|\sphinxstylestrong{\sphinxhyphen{}password}\} \sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal} -\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{kvno} {[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enctype}{]} {[}\sphinxstylestrong{\sphinxhyphen{}f}|\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{salt}{]} -\end{quote} - -\sphinxAtStartPar -Add \sphinxstyleemphasis{principal} to keylist using key or password. If the \sphinxstylestrong{\sphinxhyphen{}f} flag -is specified, salt information will be fetched from the KDC; in this -case the \sphinxstylestrong{\sphinxhyphen{}e} flag may be omitted, or it may be supplied to force a -particular enctype. If the \sphinxstylestrong{\sphinxhyphen{}f} flag is not specified, the \sphinxstylestrong{\sphinxhyphen{}e} -flag must be specified, and the default salt will be used unless -overridden with the \sphinxstylestrong{\sphinxhyphen{}s} option. - -\sphinxAtStartPar -Alias: \sphinxstylestrong{addent} - - -\subsubsection{list\_requests} -\label{\detokenize{admin/admin_commands/ktutil:list-requests}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{list\_requests} -\end{quote} - -\sphinxAtStartPar -Displays a listing of available commands. - -\sphinxAtStartPar -Aliases: \sphinxstylestrong{lr}, \sphinxstylestrong{?} - - -\subsubsection{quit} -\label{\detokenize{admin/admin_commands/ktutil:quit}}\begin{quote} - -\sphinxAtStartPar -\sphinxstylestrong{quit} -\end{quote} - -\sphinxAtStartPar -Quits ktutil. - -\sphinxAtStartPar -Aliases: \sphinxstylestrong{exit}, \sphinxstylestrong{q} - - -\subsection{EXAMPLE} -\label{\detokenize{admin/admin_commands/ktutil:example}}\begin{quote} - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{ktutil}\PYG{p}{:} \PYG{n}{add\PYGZus{}entry} \PYG{o}{\PYGZhy{}}\PYG{n}{password} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{l+m+mi}{1} \PYG{o}{\PYGZhy{}}\PYG{n}{e} - \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} -\PYG{n}{ktutil}\PYG{p}{:} \PYG{n}{add\PYGZus{}entry} \PYG{o}{\PYGZhy{}}\PYG{n}{password} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{l+m+mi}{1} \PYG{o}{\PYGZhy{}}\PYG{n}{e} - \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} -\PYG{n}{ktutil}\PYG{p}{:} \PYG{n}{write\PYGZus{}kt} \PYG{n}{alice}\PYG{o}{.}\PYG{n}{keytab} -\PYG{n}{ktutil}\PYG{p}{:} -\end{sphinxVerbatim} -\end{quote} - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/ktutil:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/ktutil:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{k5srvutil} -\label{\detokenize{admin/admin_commands/k5srvutil:k5srvutil}}\label{\detokenize{admin/admin_commands/k5srvutil:k5srvutil-1}}\label{\detokenize{admin/admin_commands/k5srvutil::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/k5srvutil:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{k5srvutil} \sphinxstyleemphasis{operation} -{[}\sphinxstylestrong{\sphinxhyphen{}i}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{filename}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{keysalts}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/k5srvutil:description}} -\sphinxAtStartPar -k5srvutil allows an administrator to list keys currently in -a keytab, to obtain new keys for a principal currently in a keytab, -or to delete non\sphinxhyphen{}current keys from a keytab. - -\sphinxAtStartPar -\sphinxstyleemphasis{operation} must be one of the following: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{list}} -\sphinxAtStartPar -Lists the keys in a keytab, showing version number and principal -name. - -\sphinxlineitem{\sphinxstylestrong{change}} -\sphinxAtStartPar -Uses the kadmin protocol to update the keys in the Kerberos -database to new randomly\sphinxhyphen{}generated keys, and updates the keys in -the keytab to match. If a key’s version number doesn’t match the -version number stored in the Kerberos server’s database, then the -operation will fail. If the \sphinxstylestrong{\sphinxhyphen{}i} flag is given, k5srvutil will -prompt for confirmation before changing each key. If the \sphinxstylestrong{\sphinxhyphen{}k} -option is given, the old and new keys will be displayed. -Ordinarily, keys will be generated with the default encryption -types and key salts. This can be overridden with the \sphinxstylestrong{\sphinxhyphen{}e} -option. Old keys are retained in the keytab so that existing -tickets continue to work, but \sphinxstylestrong{delold} should be used after -such tickets expire, to prevent attacks against the old keys. - -\sphinxlineitem{\sphinxstylestrong{delold}} -\sphinxAtStartPar -Deletes keys that are not the most recent version from the keytab. -This operation should be used some time after a change operation -to remove old keys, after existing tickets issued for the service -have expired. If the \sphinxstylestrong{\sphinxhyphen{}i} flag is given, then k5srvutil will -prompt for confirmation for each principal. - -\sphinxlineitem{\sphinxstylestrong{delete}} -\sphinxAtStartPar -Deletes particular keys in the keytab, interactively prompting for -each key. - -\end{description} - -\sphinxAtStartPar -In all cases, the default keytab is used unless this is overridden by -the \sphinxstylestrong{\sphinxhyphen{}f} option. - -\sphinxAtStartPar -k5srvutil uses the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} program to edit the keytab in -place. - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/k5srvutil:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/k5srvutil:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, {\hyperref[\detokenize{admin/admin_commands/ktutil:ktutil-1}]{\sphinxcrossref{\DUrole{std,std-ref}{ktutil}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} - -\sphinxstepscope - - -\section{sserver} -\label{\detokenize{admin/admin_commands/sserver:sserver}}\label{\detokenize{admin/admin_commands/sserver:sserver-8}}\label{\detokenize{admin/admin_commands/sserver::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{admin/admin_commands/sserver:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{sserver} -{[} \sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{port} {]} -{[} \sphinxstylestrong{\sphinxhyphen{}S} \sphinxstyleemphasis{keytab} {]} -{[} \sphinxstyleemphasis{server\_port} {]} - - -\subsection{DESCRIPTION} -\label{\detokenize{admin/admin_commands/sserver:description}} -\sphinxAtStartPar -sserver and \DUrole{xref,std,std-ref}{sclient(1)} are a simple demonstration client/server -application. When sclient connects to sserver, it performs a Kerberos -authentication, and then sserver returns to sclient the Kerberos -principal which was used for the Kerberos authentication. It makes a -good test that Kerberos has been successfully installed on a machine. - -\sphinxAtStartPar -The service name used by sserver and sclient is sample. Hence, -sserver will require that there be a keytab entry for the service -\sphinxcode{\sphinxupquote{sample/hostname.domain.name@REALM.NAME}}. This keytab is generated -using the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} program. The keytab file is usually -installed as {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}S} option allows for a different keytab than the default. - -\sphinxAtStartPar -sserver is normally invoked out of inetd(8), using a line in -\sphinxcode{\sphinxupquote{/etc/inetd.conf}} that looks like this: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{sample} \PYG{n}{stream} \PYG{n}{tcp} \PYG{n}{nowait} \PYG{n}{root} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{sbin}\PYG{o}{/}\PYG{n}{sserver} \PYG{n}{sserver} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Since \sphinxcode{\sphinxupquote{sample}} is normally not a port defined in \sphinxcode{\sphinxupquote{/etc/services}}, -you will usually have to add a line to \sphinxcode{\sphinxupquote{/etc/services}} which looks -like this: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{sample} \PYG{l+m+mi}{13135}\PYG{o}{/}\PYG{n}{tcp} -\end{sphinxVerbatim} - -\sphinxAtStartPar -When using sclient, you will first have to have an entry in the -Kerberos database, by using {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, and then you have to get -Kerberos tickets, by using \DUrole{xref,std,std-ref}{kinit(1)}. Also, if you are running -the sclient program on a different host than the sserver it will be -connecting to, be sure that both hosts have an entry in /etc/services -for the sample tcp port, and that the same port number is in both -files. - -\sphinxAtStartPar -When you run sclient you should see something like this: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{sendauth} \PYG{n}{succeeded}\PYG{p}{,} \PYG{n}{reply} \PYG{o+ow}{is}\PYG{p}{:} -\PYG{n}{reply} \PYG{n+nb}{len} \PYG{l+m+mi}{32}\PYG{p}{,} \PYG{n}{contents}\PYG{p}{:} -\PYG{n}{You} \PYG{n}{are} \PYG{n}{nlgilman}\PYG{n+nd}{@JIMI}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - - -\subsection{COMMON ERROR MESSAGES} -\label{\detokenize{admin/admin_commands/sserver:common-error-messages}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{)}% -\item {} -\sphinxAtStartPar -kinit returns the error: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{kinit}\PYG{p}{:} \PYG{n}{Client} \PYG{o+ow}{not} \PYG{n}{found} \PYG{o+ow}{in} \PYG{n}{Kerberos} \PYG{n}{database} \PYG{k}{while} \PYG{n}{getting} - \PYG{n}{initial} \PYG{n}{credentials} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This means that you didn’t create an entry for your username in the -Kerberos database. - -\item {} -\sphinxAtStartPar -sclient returns the error: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{unknown} \PYG{n}{service} \PYG{n}{sample}\PYG{o}{/}\PYG{n}{tcp}\PYG{p}{;} \PYG{n}{check} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{services} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This means that you don’t have an entry in /etc/services for the -sample tcp port. - -\item {} -\sphinxAtStartPar -sclient returns the error: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{connect}\PYG{p}{:} \PYG{n}{Connection} \PYG{n}{refused} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This probably means you didn’t edit /etc/inetd.conf correctly, or -you didn’t restart inetd after editing inetd.conf. - -\item {} -\sphinxAtStartPar -sclient returns the error: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{sclient}\PYG{p}{:} \PYG{n}{Server} \PYG{o+ow}{not} \PYG{n}{found} \PYG{o+ow}{in} \PYG{n}{Kerberos} \PYG{n}{database} \PYG{k}{while} \PYG{n}{using} - \PYG{n}{sendauth} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This means that the \sphinxcode{\sphinxupquote{sample/hostname@LOCAL.REALM}} service was not -defined in the Kerberos database; it should be created using -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, and a keytab file needs to be generated to make -the key for that service principal available for sclient. - -\item {} -\sphinxAtStartPar -sclient returns the error: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{sendauth} \PYG{n}{rejected}\PYG{p}{,} \PYG{n}{error} \PYG{n}{reply} \PYG{o+ow}{is}\PYG{p}{:} - \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{No such file or directory}\PYG{l+s+s2}{\PYGZdq{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This probably means sserver couldn’t find the keytab file. It was -probably not installed in the proper directory. - -\end{enumerate} - - -\subsection{ENVIRONMENT} -\label{\detokenize{admin/admin_commands/sserver:environment}} -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{admin/admin_commands/sserver:see-also}} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{sclient(1)}, \DUrole{xref,std,std-ref}{kerberos(7)}, services(5), inetd(8) - -\sphinxstepscope - - -\chapter{MIT Kerberos defaults} -\label{\detokenize{mitK5defaults:mit-kerberos-defaults}}\label{\detokenize{mitK5defaults:mitk5defaults}}\label{\detokenize{mitK5defaults::doc}} - -\section{General defaults} -\label{\detokenize{mitK5defaults:general-defaults}} - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TTT} -\sphinxtoprule -\sphinxstyletheadfamily -\sphinxAtStartPar -Description -&\sphinxstyletheadfamily -\sphinxAtStartPar -Default -&\sphinxstyletheadfamily -\sphinxAtStartPar -Environment -\\ -\sphinxmidrule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{keytab\_definition} file -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}} -& -\sphinxAtStartPar -\sphinxstylestrong{KRB5\_KTNAME} -\\ -\sphinxhline -\sphinxAtStartPar -Client \DUrole{xref,std,std-ref}{keytab\_definition} file -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFCKTNAME}}}} -& -\sphinxAtStartPar -\sphinxstylestrong{KRB5\_CLIENT\_KTNAME} -\\ -\sphinxhline -\sphinxAtStartPar -Kerberos config file {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/etc/krb5.conf}}\sphinxcode{\sphinxupquote{:}}{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SYSCONFDIR}}}}\sphinxcode{\sphinxupquote{/krb5.conf}} -& -\sphinxAtStartPar -\sphinxstylestrong{KRB5\_CONFIG} -\\ -\sphinxhline -\sphinxAtStartPar -KDC config file {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kdc.conf}} -& -\sphinxAtStartPar -\sphinxstylestrong{KRB5\_KDC\_PROFILE} -\\ -\sphinxhline -\sphinxAtStartPar -GSS mechanism config file -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SYSCONFDIR}}}}\sphinxcode{\sphinxupquote{/gss/mech}} -& -\sphinxAtStartPar -\sphinxstylestrong{GSS\_MECH\_CONFIG} -\\ -\sphinxhline -\sphinxAtStartPar -KDC database path (DB2) -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/principal}} -&\\ -\sphinxhline -\sphinxAtStartPar -Master key \DUrole{xref,std,std-ref}{stash\_definition} -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/.k5.}}\sphinxstyleemphasis{realm} -&\\ -\sphinxhline -\sphinxAtStartPar -Admin server ACL file {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}} -&\\ -\sphinxhline -\sphinxAtStartPar -OTP socket directory -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{RUNSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}} -&\\ -\sphinxhline -\sphinxAtStartPar -Plugin base directory -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LIBDIR}}}}\sphinxcode{\sphinxupquote{/krb5/plugins}} -&\\ -\sphinxhline -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{rcache\_definition} directory -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/var/tmp}} -& -\sphinxAtStartPar -\sphinxstylestrong{KRB5RCACHEDIR} -\\ -\sphinxhline -\sphinxAtStartPar -Master key default enctype -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96}} -&\\ -\sphinxhline -\sphinxAtStartPar -Default {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{keysalt list}}}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96:normal aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96:normal}} -&\\ -\sphinxhline -\sphinxAtStartPar -Permitted enctypes -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac}} -&\\ -\sphinxhline -\sphinxAtStartPar -KDC default port -& -\sphinxAtStartPar -88 -&\\ -\sphinxhline -\sphinxAtStartPar -Admin server port -& -\sphinxAtStartPar -749 -&\\ -\sphinxhline -\sphinxAtStartPar -Password change port -& -\sphinxAtStartPar -464 -&\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - - -\section{Replica KDC propagation defaults} -\label{\detokenize{mitK5defaults:replica-kdc-propagation-defaults}} -\sphinxAtStartPar -This table shows defaults used by the {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} and -{\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} programs. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TTT} -\sphinxtoprule -\sphinxstyletheadfamily -\sphinxAtStartPar -Description -&\sphinxstyletheadfamily -\sphinxAtStartPar -Default -&\sphinxstyletheadfamily -\sphinxAtStartPar -Environment -\\ -\sphinxmidrule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -kprop database dump file -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/replica\_datatrans}} -&\\ -\sphinxhline -\sphinxAtStartPar -kpropd temporary dump file -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/from\_master}} -&\\ -\sphinxhline -\sphinxAtStartPar -kdb5\_util location -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SBINDIR}}}}\sphinxcode{\sphinxupquote{/kdb5\_util}} -&\\ -\sphinxhline -\sphinxAtStartPar -kprop location -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SBINDIR}}}}\sphinxcode{\sphinxupquote{/kprop}} -&\\ -\sphinxhline -\sphinxAtStartPar -kpropd ACL file -& -\sphinxAtStartPar -{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kpropd.acl}} -&\\ -\sphinxhline -\sphinxAtStartPar -kprop port -& -\sphinxAtStartPar -754 -& -\sphinxAtStartPar -KPROP\_PORT -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - - -\section{Default paths for Unix\sphinxhyphen{}like systems} -\label{\detokenize{mitK5defaults:default-paths-for-unix-like-systems}}\label{\detokenize{mitK5defaults:paths}} -\sphinxAtStartPar -On Unix\sphinxhyphen{}like systems, some paths used by MIT krb5 depend on parameters -chosen at build time. For a custom build, these paths default to -subdirectories of \sphinxcode{\sphinxupquote{/usr/local}}. When MIT krb5 is integrated into an -operating system, the paths are generally chosen to match the -operating system’s filesystem layout. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TTTT} -\sphinxtoprule -\sphinxstyletheadfamily -\sphinxAtStartPar -Description -&\sphinxstyletheadfamily -\sphinxAtStartPar -Symbolic name -&\sphinxstyletheadfamily -\sphinxAtStartPar -Custom build path -&\sphinxstyletheadfamily -\sphinxAtStartPar -Typical OS path -\\ -\sphinxmidrule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -User programs -& -\sphinxAtStartPar -BINDIR -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/local/bin}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/bin}} -\\ -\sphinxhline -\sphinxAtStartPar -Libraries and plugins -& -\sphinxAtStartPar -LIBDIR -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/local/lib}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/lib}} -\\ -\sphinxhline -\sphinxAtStartPar -Parent of KDC state dir -& -\sphinxAtStartPar -LOCALSTATEDIR -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/local/var}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/var}} -\\ -\sphinxhline -\sphinxAtStartPar -Parent of KDC runtime dir -& -\sphinxAtStartPar -RUNSTATEDIR -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/local/var/run}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/run}} -\\ -\sphinxhline -\sphinxAtStartPar -Administrative programs -& -\sphinxAtStartPar -SBINDIR -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/local/sbin}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/sbin}} -\\ -\sphinxhline -\sphinxAtStartPar -Alternate krb5.conf dir -& -\sphinxAtStartPar -SYSCONFDIR -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/usr/local/etc}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{/etc}} -\\ -\sphinxhline -\sphinxAtStartPar -Default ccache name -& -\sphinxAtStartPar -DEFCCNAME -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{FILE:/tmp/krb5cc\_\%\{uid\}}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{FILE:/tmp/krb5cc\_\%\{uid\}}} -\\ -\sphinxhline -\sphinxAtStartPar -Default keytab name -& -\sphinxAtStartPar -DEFKTNAME -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{FILE:/etc/krb5.keytab}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{FILE:/etc/krb5.keytab}} -\\ -\sphinxhline -\sphinxAtStartPar -Default PKCS11 module -& -\sphinxAtStartPar -PKCS11\_MODNAME -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{opensc\sphinxhyphen{}pkcs11.so}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{opensc\sphinxhyphen{}pkcs11.so}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxAtStartPar -The default client keytab name (DEFCKTNAME) typically defaults to -\sphinxcode{\sphinxupquote{FILE:/usr/local/var/krb5/user/\%\{euid\}/client.keytab}} for a custom -build. A native build will typically use a path which will vary -according to the operating system’s layout of \sphinxcode{\sphinxupquote{/var}}. - -\sphinxstepscope - - -\chapter{Environment variables} -\label{\detokenize{admin/env_variables:environment-variables}}\label{\detokenize{admin/env_variables::doc}} -\sphinxAtStartPar -This content has moved to \DUrole{xref,std,std-ref}{kerberos(7)}. - -\sphinxstepscope - - -\chapter{Troubleshooting} -\label{\detokenize{admin/troubleshoot:troubleshooting}}\label{\detokenize{admin/troubleshoot:troubleshoot}}\label{\detokenize{admin/troubleshoot::doc}} - -\section{Trace logging} -\label{\detokenize{admin/troubleshoot:trace-logging}}\label{\detokenize{admin/troubleshoot:id1}} -\sphinxAtStartPar -Most programs using MIT krb5 1.9 or later can be made to provide -information about internal krb5 library operations using trace -logging. To enable this, set the \sphinxstylestrong{KRB5\_TRACE} environment variable -to a filename before running the program. On many operating systems, -the filename \sphinxcode{\sphinxupquote{/dev/stdout}} can be used to send trace logging output -to standard output. - -\sphinxAtStartPar -Some programs do not honor \sphinxstylestrong{KRB5\_TRACE}, either because they use -secure library contexts (this generally applies to setuid programs and -parts of the login system) or because they take direct control of the -trace logging system using the API. - -\sphinxAtStartPar -Here is a short example showing trace logging output for an invocation -of the \DUrole{xref,std,std-ref}{kvno(1)} command: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{env} \PYG{n}{KRB5\PYGZus{}TRACE}\PYG{o}{=}\PYG{o}{/}\PYG{n}{dev}\PYG{o}{/}\PYG{n}{stdout} \PYG{n}{kvno} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM} -\PYG{p}{[}\PYG{l+m+mi}{9138}\PYG{p}{]} \PYG{l+m+mf}{1332348778.823276}\PYG{p}{:} \PYG{n}{Getting} \PYG{n}{credentials} \PYG{n}{user}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}} - \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{using} \PYG{n}{ccache} - \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{me}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{build}\PYG{o}{/}\PYG{n}{testdir}\PYG{o}{/}\PYG{n}{ccache} -\PYG{p}{[}\PYG{l+m+mi}{9138}\PYG{p}{]} \PYG{l+m+mf}{1332348778.823381}\PYG{p}{:} \PYG{n}{Retrieving} \PYG{n}{user}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}} - \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{k+kn}{from} - \PYG{n+nn}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{me}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{build}\PYG{o}{/}\PYG{n}{testdir}\PYG{o}{/}\PYG{n}{ccache} \PYG{k}{with} \PYG{n}{result}\PYG{p}{:} \PYG{l+m+mi}{0}\PYG{o}{/}\PYG{n}{Unknown} \PYG{n}{code} \PYG{l+m+mi}{0} -\PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} \PYG{n}{kvno} \PYG{o}{=} \PYG{l+m+mi}{1} -\end{sphinxVerbatim} - - -\section{List of errors} -\label{\detokenize{admin/troubleshoot:list-of-errors}} - -\subsection{Frequently seen errors} -\label{\detokenize{admin/troubleshoot:frequently-seen-errors}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:init-creds-etype-nosupp}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC has no support for encryption type while getting initial credentials}}}} - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:cert-chain-etype-nosupp}]{\sphinxcrossref{\DUrole{std,std-ref}{credential verification failed: KDC has no support for encryption type}}}} - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:err-cert-chain-cert-expired}]{\sphinxcrossref{\DUrole{std,std-ref}{Cannot create cert chain: certificate has expired}}}} - -\end{enumerate} - - -\subsection{Errors seen by admins} -\label{\detokenize{admin/troubleshoot:errors-seen-by-admins}}\phantomsection\label{\detokenize{admin/troubleshoot:prop-failed-start}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:kprop-no-route}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: No route to host while connecting to server}}}} - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:kprop-con-refused}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: Connection refused while connecting to server}}}} - -\item {} -\sphinxAtStartPar -{\hyperref[\detokenize{admin/troubleshoot:kprop-sendauth-exchange}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: Server rejected authentication (during sendauth exchange) while authenticating to server}}}} - -\end{enumerate} -\phantomsection\label{\detokenize{admin/troubleshoot:prop-failed-end}} - -\bigskip\hrule\bigskip - - - -\subsubsection{KDC has no support for encryption type while getting initial credentials} -\label{\detokenize{admin/troubleshoot:kdc-has-no-support-for-encryption-type-while-getting-initial-credentials}}\label{\detokenize{admin/troubleshoot:init-creds-etype-nosupp}} - -\subsubsection{credential verification failed: KDC has no support for encryption type} -\label{\detokenize{admin/troubleshoot:credential-verification-failed-kdc-has-no-support-for-encryption-type}}\label{\detokenize{admin/troubleshoot:cert-chain-etype-nosupp}} -\sphinxAtStartPar -This most commonly happens when trying to use a principal with only -DES keys, in a release (MIT krb5 1.7 or later) which disables DES by -default. DES encryption is considered weak due to its inadequate key -size. If you cannot migrate away from its use, you can re\sphinxhyphen{}enable DES -by adding \sphinxcode{\sphinxupquote{allow\_weak\_crypto = true}} to the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} -section of {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. - - -\subsubsection{Cannot create cert chain: certificate has expired} -\label{\detokenize{admin/troubleshoot:cannot-create-cert-chain-certificate-has-expired}}\label{\detokenize{admin/troubleshoot:err-cert-chain-cert-expired}} -\sphinxAtStartPar -This error message indicates that PKINIT authentication failed because -the client certificate, KDC certificate, or one of the certificates in -the signing chain above them has expired. - -\sphinxAtStartPar -If the KDC certificate has expired, this message appears in the KDC -log file, and the client will receive a “Preauthentication failed” -error. (Prior to release 1.11, the KDC log file message erroneously -appears as “Out of memory”. Prior to release 1.12, the client will -receive a “Generic error”.) - -\sphinxAtStartPar -If the client or a signing certificate has expired, this message may -appear in {\hyperref[\detokenize{admin/troubleshoot:trace-logging}]{\sphinxcrossref{trace\_logging}}} output from \DUrole{xref,std,std-ref}{kinit(1)} or, starting in -release 1.12, as an error message from kinit or another program which -gets initial tickets. The error message is more likely to appear -properly on the client if the principal entry has no long\sphinxhyphen{}term keys. - - -\subsubsection{kprop: No route to host while connecting to server} -\label{\detokenize{admin/troubleshoot:kprop-no-route-to-host-while-connecting-to-server}}\label{\detokenize{admin/troubleshoot:kprop-no-route}} -\sphinxAtStartPar -Make sure that the hostname of the replica KDC (as given to kprop) is -correct, and that any firewalls between the primary and the replica -allow a connection on port 754. - - -\subsubsection{kprop: Connection refused while connecting to server} -\label{\detokenize{admin/troubleshoot:kprop-connection-refused-while-connecting-to-server}}\label{\detokenize{admin/troubleshoot:kprop-con-refused}} -\sphinxAtStartPar -If the replica KDC is intended to run kpropd out of inetd, make sure -that inetd is configured to accept krb5\_prop connections. inetd may -need to be restarted or sent a SIGHUP to recognize the new -configuration. If the replica is intended to run kpropd in standalone -mode, make sure that it is running. - - -\subsubsection{kprop: Server rejected authentication (during sendauth exchange) while authenticating to server} -\label{\detokenize{admin/troubleshoot:kprop-server-rejected-authentication-during-sendauth-exchange-while-authenticating-to-server}}\label{\detokenize{admin/troubleshoot:kprop-sendauth-exchange}} -\sphinxAtStartPar -Make sure that: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -The time is synchronized between the primary and replica KDCs. - -\item {} -\sphinxAtStartPar -The master stash file was copied from the primary to the expected -location on the replica. - -\item {} -\sphinxAtStartPar -The replica has a keytab file in the default location containing a -\sphinxcode{\sphinxupquote{host}} principal for the replica’s hostname. - -\end{enumerate} - -\sphinxstepscope - - -\chapter{Advanced topics} -\label{\detokenize{admin/advanced/index:advanced-topics}}\label{\detokenize{admin/advanced/index::doc}} -\sphinxstepscope - - -\section{Retiring DES} -\label{\detokenize{admin/advanced/retiring-des:retiring-des}}\label{\detokenize{admin/advanced/retiring-des:id1}}\label{\detokenize{admin/advanced/retiring-des::doc}} -\sphinxAtStartPar -Version 5 of the Kerberos protocol was originally implemented using -the Data Encryption Standard (DES) as a block cipher for encryption. -While it was considered secure at the time, advancements in computational -ability have rendered DES vulnerable to brute force attacks on its 56\sphinxhyphen{}bit -keyspace. As such, it is now considered insecure and should not be -used (\index{RFC@\spxentry{RFC}!RFC 6649@\spxentry{RFC 6649}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc6649.html}{\sphinxstylestrong{RFC 6649}}). - - -\subsection{History} -\label{\detokenize{admin/advanced/retiring-des:history}} -\sphinxAtStartPar -DES was used in the original Kerberos implementation, and was the -only cryptosystem in krb5 1.0. Partial support for triple\sphinxhyphen{}DES (3DES) was -added in version 1.1, with full support following in version 1.2. -The Advanced Encryption Standard (AES), which supersedes DES, gained -partial support in version 1.3.0 of krb5 and full support in version 1.3.2. -However, deployments of krb5 using Kerberos databases created with older -versions of krb5 will not necessarily start using strong crypto for -ordinary operation without administrator intervention. - -\sphinxAtStartPar -MIT krb5 began flagging deprecated encryption types with release 1.17, -and removed DES (single\sphinxhyphen{}DES) support in release 1.18. As a -consequence, a release prior to 1.18 is required to perform these -migrations. - - -\subsection{Types of keys} -\label{\detokenize{admin/advanced/retiring-des:types-of-keys}}\begin{itemize} -\item {} -\sphinxAtStartPar -The database master key: This key is not exposed to user requests, -but is used to encrypt other key material stored in the kerberos -database. The database master key is currently stored as \sphinxcode{\sphinxupquote{K/M}} -by default. - -\item {} -\sphinxAtStartPar -Password\sphinxhyphen{}derived keys: User principals frequently have keys -derived from a password. When a new password is set, the KDC -uses various string2key functions to generate keys in the database -for that principal. - -\item {} -\sphinxAtStartPar -Keytab keys: Application server principals generally use random -keys which are not derived from a password. When the database -entry is created, the KDC generates random keys of various enctypes -to enter in the database, which are conveyed to the application server -and stored in a keytab. - -\item {} -\sphinxAtStartPar -Session keys: These are short\sphinxhyphen{}term keys generated by the KDC while -processing client requests, with an enctype selected by the KDC. - -\end{itemize} - -\sphinxAtStartPar -For details on the various enctypes and how enctypes are selected by the KDC -for session keys and client/server long\sphinxhyphen{}term keys, see {\hyperref[\detokenize{admin/enctypes:enctypes}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}}. -When using the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} interface to generate new long\sphinxhyphen{}term keys, -the \sphinxstylestrong{\sphinxhyphen{}e} argument can be used to force a particular set of enctypes, -overriding the KDC default values. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -When the KDC is selecting a session key, it has no knowledge about the -kerberos installation on the server which will receive the service ticket, -only what keys are in the database for the service principal. -In order to allow uninterrupted operation to -clients while migrating away from DES, care must be taken to ensure that -kerberos installations on application server machines are configured to -support newer encryption types before keys of those new encryption types -are created in the Kerberos database for those server principals. -\end{sphinxadmonition} - - -\subsection{Upgrade procedure} -\label{\detokenize{admin/advanced/retiring-des:upgrade-procedure}} -\sphinxAtStartPar -This procedure assumes that the KDC software has already been upgraded -to a modern version of krb5 that supports non\sphinxhyphen{}DES keys, so that the -only remaining task is to update the actual keys used to service requests. -The realm used for demonstrating this procedure, ZONE.MIT.EDU, -is an example of the worst\sphinxhyphen{}case scenario, where all keys in the realm -are DES. The realm was initially created with a very old version of krb5, -and \sphinxstylestrong{supported\_enctypes} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} was set to a value -appropriate when the KDC was installed, but was not updated as the KDC -was upgraded: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} - \PYG{n}{master\PYGZus{}key\PYGZus{}type} \PYG{o}{=} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} - \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des}\PYG{p}{:}\PYG{n}{v4} \PYG{n}{des}\PYG{p}{:}\PYG{n}{norealm} \PYG{n}{des}\PYG{p}{:}\PYG{n}{onlyrealm} \PYG{n}{des}\PYG{p}{:}\PYG{n}{afs3} - \PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This resulted in the keys for all principals in the realm being forced -to DES\sphinxhyphen{}only, unless specifically requested using {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}. - -\sphinxAtStartPar -Before starting the upgrade, all KDCs were running krb5 1.11, -and the database entries for some “high\sphinxhyphen{}value” principals were: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc krbtgt/ZONE.MIT.EDU\PYGZsq{}} -\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} -\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{1} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{v4} -\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc kadmin/admin\PYGZsq{}} -\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} -\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{1} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{15}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} -\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc kadmin/changepw\PYGZsq{}} -\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} -\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{1} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{14}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} -\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The \sphinxcode{\sphinxupquote{krbtgt/REALM}} key appears to have never been changed since creation -(its kvno is 1), and all three database entries have only a des\sphinxhyphen{}cbc\sphinxhyphen{}crc key. - - -\subsubsection{The krbtgt key and KDC keys} -\label{\detokenize{admin/advanced/retiring-des:the-krbtgt-key-and-kdc-keys}} -\sphinxAtStartPar -Perhaps the biggest single\sphinxhyphen{}step improvement in the security of the cell -is gained by strengthening the key of the ticket\sphinxhyphen{}granting service principal, -\sphinxcode{\sphinxupquote{krbtgt/REALM}}—if this principal’s key is compromised, so is the -entire realm. Since the server that will handle service tickets -for this principal is the KDC itself, it is easy to guarantee that it -will be configured to support any encryption types which might be -selected. However, the default KDC behavior when creating new keys is to -remove the old keys, which would invalidate all existing tickets issued -against that principal, rendering the TGTs cached by clients useless. -Instead, a new key can be created with the old key retained, so that -existing tickets will still function until their scheduled expiry -(see {\hyperref[\detokenize{admin/database:changing-krbtgt-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Changing the krbtgt key}}}}). - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} enctypes=aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96:normal,\PYGZbs{}} -\PYG{o}{\PYGZgt{}} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{normal} -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZdq{}cpw \PYGZhy{}e \PYGZdl{}\PYGZob{}enctypes\PYGZcb{} \PYGZhy{}randkey \PYGZbs{}} -\PYG{o}{\PYGZgt{}} \PYG{o}{\PYGZhy{}}\PYG{n}{keepold} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Key} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{krbtgt/ZONE.MIT.EDU@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{randomized}\PYG{o}{.} -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The new \sphinxcode{\sphinxupquote{krbtgt@REALM}} key should be propagated to replica KDCs -immediately so that TGTs issued by the primary KDC can be used to -issue service tickets on replica KDCs. Replica KDCs will refuse -requests using the new TGT kvno until the new krbtgt entry has -been propagated to them. -\end{sphinxadmonition} - -\sphinxAtStartPar -It is necessary to explicitly specify the enctypes for the new database -entry, since \sphinxstylestrong{supported\_enctypes} has not been changed. Leaving -\sphinxstylestrong{supported\_enctypes} unchanged makes a potential rollback operation -easier, since all new keys of new enctypes are the result of explicit -administrator action and can be easily enumerated. -Upgrading the krbtgt key should have minimal user\sphinxhyphen{}visible disruption other -than that described in the note above, since only clients which list the -new enctypes as supported will use them, per the procedure -in {\hyperref[\detokenize{admin/enctypes:session-key-selection}]{\sphinxcrossref{\DUrole{std,std-ref}{Session key selection}}}}. -Once the krbtgt key is updated, the session and ticket keys for user -TGTs will be strong keys, but subsequent requests -for service tickets will still get DES keys until the service principals -have new keys generated. Application service -remains uninterrupted due to the key\sphinxhyphen{}selection procedure on the KDC. - -\sphinxAtStartPar -After the change, the database entry is now: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc krbtgt/ZONE.MIT.EDU\PYGZsq{}} -\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} -\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{5} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} -\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{v4} -\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Since the expected disruptions from rekeying the krbtgt principal are -minor, after a short testing period, it is -appropriate to rekey the other high\sphinxhyphen{}value principals, \sphinxcode{\sphinxupquote{kadmin/admin@REALM}} -and \sphinxcode{\sphinxupquote{kadmin/changepw@REALM}}. These are the service principals used for -changing user passwords and updating application keytabs. The kadmin -and password\sphinxhyphen{}changing services are regular kerberized services, so the -session\sphinxhyphen{}key\sphinxhyphen{}selection algorithm described in {\hyperref[\detokenize{admin/enctypes:session-key-selection}]{\sphinxcrossref{\DUrole{std,std-ref}{Session key selection}}}} -applies. It is particularly important to have strong session keys for -these services, since user passwords and new long\sphinxhyphen{}term keys are conveyed -over the encrypted channel. - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} enctypes=aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96:normal,\PYGZbs{}} -\PYG{o}{\PYGZgt{}} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZdq{}cpw \PYGZhy{}e \PYGZdl{}\PYGZob{}enctypes\PYGZcb{} \PYGZhy{}randkey \PYGZbs{}} -\PYG{o}{\PYGZgt{}} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{admin}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Key} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{kadmin/admin@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{randomized}\PYG{o}{.} -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZdq{}cpw \PYGZhy{}e \PYGZdl{}\PYGZob{}enctypes\PYGZcb{} \PYGZhy{}randkey \PYGZbs{}} -\PYG{o}{\PYGZgt{}} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{changepw}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Key} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{kadmin/changepw@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{randomized}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -It is not necessary to retain a single\sphinxhyphen{}DES key for these services, since -password changes are not part of normal daily workflow, and disruption -from a client failure is likely to be minimal. Furthermore, if a kerberos -client experiences failure changing a user password or keytab key, -this indicates that that client will become inoperative once services -are rekeyed to non\sphinxhyphen{}DES enctypes. Such problems can be detected early -at this stage, giving more time for corrective action. - - -\subsubsection{Adding strong keys to application servers} -\label{\detokenize{admin/advanced/retiring-des:adding-strong-keys-to-application-servers}} -\sphinxAtStartPar -Before switching the default enctypes for new keys over to strong enctypes, -it may be desired to test upgrading a handful of services with the -new configuration before flipping the switch for the defaults. This -still requires using the \sphinxstylestrong{\sphinxhyphen{}e} argument in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} to get non\sphinxhyphen{}default -enctypes: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} enctypes=aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96:normal,\PYGZbs{}} -\PYG{o}{\PYGZgt{}} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{normal} -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}p zephyr/zephyr@ZONE.MIT.EDU \PYGZhy{}k \PYGZhy{}t \PYGZbs{}} -\PYG{o}{\PYGZgt{}} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{ktadd \PYGZhy{}e \PYGZdl{}}\PYG{l+s+si}{\PYGZob{}enctypes\PYGZcb{}}\PYG{l+s+s2}{ }\PYG{l+s+se}{\PYGZbs{}} -\PYG{l+s+s2}{\PYGZgt{} \PYGZhy{}k /etc/zephyr/krb5.keytab zephyr/zephyr@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{keytab} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{4}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{4}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{4}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{4}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Be sure to remove the old keys from the application keytab, per best -practice. - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} k5srvutil \PYGZhy{}f /etc/zephyr/krb5.keytab delold} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{keytab} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\end{sphinxVerbatim} - - -\subsubsection{Adding strong keys by default} -\label{\detokenize{admin/advanced/retiring-des:adding-strong-keys-by-default}} -\sphinxAtStartPar -Once the high\sphinxhyphen{}visibility services have been rekeyed, it is probably -appropriate to change {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} to generate keys with the new -encryption types by default. This enables server administrators to generate -new enctypes with the \sphinxstylestrong{change} subcommand of {\hyperref[\detokenize{admin/admin_commands/k5srvutil:k5srvutil-1}]{\sphinxcrossref{\DUrole{std,std-ref}{k5srvutil}}}}, -and causes user password -changes to add new encryption types for their entries. It will probably -be necessary to implement administrative controls to cause all user -principal keys to be updated in a reasonable period of time, whether -by forcing password changes or a password synchronization service that -has access to the current password and can add the new keys. - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{normal} -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The krb5kdc process must be restarted for these changes to take effect. -\end{sphinxadmonition} - -\sphinxAtStartPar -At this point, all service administrators can update their services and the -servers behind them to take advantage of strong cryptography. -If necessary, the server’s krb5 installation should be configured and/or -upgraded to a version supporting non\sphinxhyphen{}DES keys. See {\hyperref[\detokenize{admin/enctypes:enctypes}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} for -krb5 version and configuration settings. -Only when the service is configured to accept non\sphinxhyphen{}DES keys should -the key version number be incremented and new keys generated -(\sphinxcode{\sphinxupquote{k5srvutil change \&\& k5srvutil delold}}). - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{root}\PYG{n+nd}{@dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{p}{:}\PYG{o}{\PYGZti{}}\PYG{c+c1}{\PYGZsh{} k5srvutil change} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{keytab} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{AES}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{256} \PYG{n}{CTS} \PYG{n}{mode} \PYG{k}{with} \PYG{l+m+mi}{96}\PYG{o}{\PYGZhy{}}\PYG{n}{bit} \PYG{n}{SHA}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{1} \PYG{n}{HMAC} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{AES}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{128} \PYG{n}{CTS} \PYG{n}{mode} \PYG{k}{with} \PYG{l+m+mi}{96}\PYG{o}{\PYGZhy{}}\PYG{n}{bit} \PYG{n}{SHA}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{1} \PYG{n}{HMAC} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{Triple} \PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{HMAC}\PYG{o}{/}\PYG{n}{sha1} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{CRC}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{32} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{root}\PYG{n+nd}{@dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{p}{:}\PYG{o}{\PYGZti{}}\PYG{c+c1}{\PYGZsh{} klist \PYGZhy{}e \PYGZhy{}k \PYGZhy{}t /etc/krb5.keytab} -\PYG{n}{Keytab} \PYG{n}{name}\PYG{p}{:} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} -\PYG{n}{KVNO} \PYG{n}{Timestamp} \PYG{n}{Principal} -\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} - \PYG{l+m+mi}{2} \PYG{l+m+mi}{10}\PYG{o}{/}\PYG{l+m+mi}{10}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{17}\PYG{p}{:}\PYG{l+m+mi}{03}\PYG{p}{:}\PYG{l+m+mi}{59} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{CRC}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{32}\PYG{p}{)} - \PYG{l+m+mi}{3} \PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{15}\PYG{p}{:}\PYG{l+m+mi}{31}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{AES}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{256} \PYG{n}{CTS} \PYG{n}{mode} \PYG{k}{with} \PYG{l+m+mi}{96}\PYG{o}{\PYGZhy{}}\PYG{n}{bit} \PYG{n}{SHA}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{1} \PYG{n}{HMAC}\PYG{p}{)} - \PYG{l+m+mi}{3} \PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{15}\PYG{p}{:}\PYG{l+m+mi}{31}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{AES}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{128} \PYG{n}{CTS} \PYG{n}{mode} \PYG{k}{with} \PYG{l+m+mi}{96}\PYG{o}{\PYGZhy{}}\PYG{n}{bit} \PYG{n}{SHA}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{1} \PYG{n}{HMAC}\PYG{p}{)} - \PYG{l+m+mi}{3} \PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{15}\PYG{p}{:}\PYG{l+m+mi}{31}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{Triple} \PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{HMAC}\PYG{o}{/}\PYG{n}{sha1}\PYG{p}{)} - \PYG{l+m+mi}{3} \PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{15}\PYG{p}{:}\PYG{l+m+mi}{31}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{CRC}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{32}\PYG{p}{)} -\PYG{n}{root}\PYG{n+nd}{@dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{p}{:}\PYG{o}{\PYGZti{}}\PYG{c+c1}{\PYGZsh{} k5srvutil delold} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{keytab} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -When a single service principal is shared by multiple backend servers in -a load\sphinxhyphen{}balanced environment, it may be necessary to schedule downtime -or adjust the population in the load\sphinxhyphen{}balanced pool in order to propagate -the updated keytab to all hosts in the pool with minimal service interruption. - - -\subsubsection{Removing DES keys from usage} -\label{\detokenize{admin/advanced/retiring-des:removing-des-keys-from-usage}} -\sphinxAtStartPar -This situation remains something of a testing or transitory state, -as new DES keys are still being generated, and will be used if requested -by a client. To make more progress removing DES from the realm, the KDC -should be configured to not generate such keys by default. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -An attacker posing as a client can implement a brute force attack against -a DES key for any principal, if that key is in the current (highest\sphinxhyphen{}kvno) -key list. This attack is only possible if \sphinxstylestrong{allow\_weak\_crypto = true} -is enabled on the KDC. Setting the \sphinxstylestrong{+requires\_preauth} flag on a -principal forces this attack to be an online attack, much slower than -the offline attack otherwise available to the attacker. However, setting -this flag on a service principal is not always advisable; see the entry in -{\hyperref[\detokenize{admin/admin_commands/kadmin_local:add-principal}]{\sphinxcrossref{\DUrole{std,std-ref}{add\_principal}}}} for details. -\end{sphinxadmonition} - -\sphinxAtStartPar -The following KDC configuration will not generate DES keys by default: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} - \PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} - \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -As before, the KDC process must be restarted for this change to take -effect. It is best practice to update kdc.conf on all KDCs, not just the -primary, to avoid unpleasant surprises should the primary fail and a -replica need to be promoted. -\end{sphinxadmonition} - -\sphinxAtStartPar -It is now appropriate to remove the legacy single\sphinxhyphen{}DES key from the -\sphinxcode{\sphinxupquote{krbtgt/REALM}} entry: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZdq{}cpw \PYGZhy{}randkey \PYGZhy{}keepold \PYGZbs{}} -\PYG{o}{\PYGZgt{}} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Key} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{krbtgt/ZONE.MIT.EDU@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{randomized}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -After the maximum ticket lifetime has passed, the old database entry -should be removed. - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}purgekeys krbtgt/ZONE.MIT.EDU\PYGZsq{}} -\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Old} \PYG{n}{keys} \PYG{k}{for} \PYG{n}{principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{krbtgt/ZONE.MIT.EDU@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{purged}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -After the KDC is restarted with the new \sphinxstylestrong{supported\_enctypes}, -all user password changes and application keytab updates will not -generate DES keys by default. - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -contents\PYGZhy{}vnder\PYGZhy{}pressvre:\PYGZti{}\PYGZgt{} kpasswd zonetest@ZONE.MIT.EDU -Password for zonetest@ZONE.MIT.EDU: [enter old password] -Enter new password: [enter new password] -Enter it again: [enter new password] -Password changed. -contents\PYGZhy{}vnder\PYGZhy{}pressvre:\PYGZti{}\PYGZgt{} kadmin \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc zonetest\PYGZsq{} -[...] -Number of keys: 3 -Key: vno 9, aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 -Key: vno 9, aes128\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 -Key: vno 9, des3\PYGZhy{}cbc\PYGZhy{}sha1 -[...] - -[kaduk@glossolalia \PYGZti{}]\PYGZdl{} kadmin \PYGZhy{}p kaduk@ZONE.MIT.EDU \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}k \PYGZbs{} -\PYGZgt{} \PYGZhy{}t kaduk\PYGZhy{}zone.keytab \PYGZhy{}q \PYGZsq{}ktadd \PYGZhy{}k kaduk\PYGZhy{}zone.keytab kaduk@ZONE.MIT.EDU\PYGZsq{} -Authenticating as principal kaduk@ZONE.MIT.EDU with keytab kaduk\PYGZhy{}zone.keytab. -Entry for principal kaduk@ZONE.MIT.EDU with kvno 3, encryption type aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 added to keytab WRFILE:kaduk\PYGZhy{}zone.keytab. -Entry for principal kaduk@ZONE.MIT.EDU with kvno 3, encryption type aes128\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 added to keytab WRFILE:kaduk\PYGZhy{}zone.keytab. -Entry for principal kaduk@ZONE.MIT.EDU with kvno 3, encryption type des3\PYGZhy{}cbc\PYGZhy{}sha1 added to keytab WRFILE:kaduk\PYGZhy{}zone.keytab. -\end{sphinxVerbatim} - -\sphinxAtStartPar -Once all principals have been re\sphinxhyphen{}keyed, DES support can be disabled on the -KDC (\sphinxstylestrong{allow\_weak\_crypto = false}), and client machines can remove -\sphinxstylestrong{allow\_weak\_crypto = true} from their {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} configuration -files, completing the migration. \sphinxstylestrong{allow\_weak\_crypto} takes precedence over -all places where DES enctypes could be explicitly configured. DES keys will -not be used, even if they are present, when \sphinxstylestrong{allow\_weak\_crypto = false}. - - -\subsubsection{Support for legacy services} -\label{\detokenize{admin/advanced/retiring-des:support-for-legacy-services}} -\sphinxAtStartPar -If there remain legacy services which do not support non\sphinxhyphen{}DES enctypes -(such as older versions of AFS), \sphinxstylestrong{allow\_weak\_crypto} must remain -enabled on the KDC. Client machines need not have this setting, -though—applications which require DES can use API calls to allow -weak crypto on a per\sphinxhyphen{}request basis, overriding the system krb5.conf. -However, having \sphinxstylestrong{allow\_weak\_crypto} set on the KDC means that any -principals which have a DES key in the database could still use those -keys. To minimize the use of DES in the realm and restrict it to just -legacy services which require DES, it is necessary to remove all other -DES keys. The realm has been configured such that at password and -keytab change, no DES keys will be generated by default. The task -then reduces to requiring user password changes and having server -administrators update their service keytabs. Administrative outreach -will be necessary, and if the desire to eliminate DES is sufficiently -strong, the KDC administrators may choose to randkey any principals -which have not been rekeyed after some timeout period, forcing the -user to contact the helpdesk for access. - - -\subsection{The Database Master Key} -\label{\detokenize{admin/advanced/retiring-des:the-database-master-key}} -\sphinxAtStartPar -This procedure does not alter \sphinxcode{\sphinxupquote{K/M@REALM}}, the key used to encrypt key -material in the Kerberos database. (This is the key stored in the stash file -on the KDC if stash files are used.) However, the security risk of -a single\sphinxhyphen{}DES key for \sphinxcode{\sphinxupquote{K/M}} is minimal, given that access to material -encrypted in \sphinxcode{\sphinxupquote{K/M}} (the Kerberos database) is generally tightly controlled. -If an attacker can gain access to the encrypted database, they likely -have access to the stash file as well, rendering the weak cryptography -broken by non\sphinxhyphen{}cryptographic means. As such, upgrading \sphinxcode{\sphinxupquote{K/M}} to a stronger -encryption type is unlikely to be a high\sphinxhyphen{}priority task. - -\sphinxAtStartPar -Is is possible to upgrade the master key used for the database, if -desired. Using {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}’s \sphinxstylestrong{add\_mkey}, \sphinxstylestrong{use\_mkey}, and -\sphinxstylestrong{update\_princ\_encryption} commands, a new master key can be added -and activated for use on new key material, and the existing entries -converted to the new master key. - -\sphinxstepscope - - -\chapter{Various links} -\label{\detokenize{admin/various_envs:various-links}}\label{\detokenize{admin/various_envs::doc}} - -\section{Whitepapers} -\label{\detokenize{admin/various_envs:whitepapers}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -\sphinxurl{https://kerberos.org/software/whitepapers.html} - -\end{enumerate} - - -\section{Tutorials} -\label{\detokenize{admin/various_envs:tutorials}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -Fulvio Ricciardi \textless{}\sphinxurl{https://www.kerberos.org/software/tutorial.html}\textgreater{}\_ - -\end{enumerate} - - -\section{Troubleshooting} -\label{\detokenize{admin/various_envs:troubleshooting}}\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -\sphinxurl{https://wiki.ncsa.illinois.edu/display/ITS/Windows+Kerberos+Troubleshooting} - -\item {} -\sphinxAtStartPar -\sphinxurl{https://www.shrubbery.net/solaris9ab/SUNWaadm/SYSADV6/p27.html} - -\item {} -\sphinxAtStartPar -\sphinxurl{https://docs.oracle.com/cd/E19253-01/816-4557/trouble-1/index.html} - -\item {} -\sphinxAtStartPar -\sphinxurl{https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb463167(v=technet.10})\#EBAA - -\item {} -\sphinxAtStartPar -\sphinxurl{https://bugs.launchpad.net/ubuntu/+source/libpam-heimdal/+bug/86528} - -\end{enumerate} - - - -\renewcommand{\indexname}{Index} -\printindex -\end{document}
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/appdev.pdf b/crypto/krb5/doc/pdf/appdev.pdf Binary files differdeleted file mode 100644 index 27525f8d1c8b..000000000000 --- a/crypto/krb5/doc/pdf/appdev.pdf +++ /dev/null diff --git a/crypto/krb5/doc/pdf/appdev.tex b/crypto/krb5/doc/pdf/appdev.tex deleted file mode 100644 index 72522ebe8737..000000000000 --- a/crypto/krb5/doc/pdf/appdev.tex +++ /dev/null @@ -1,36055 +0,0 @@ -%% Generated by Sphinx. -\def\sphinxdocclass{report} -\documentclass[letterpaper,10pt,english]{sphinxmanual} -\ifdefined\pdfpxdimen - \let\sphinxpxdimen\pdfpxdimen\else\newdimen\sphinxpxdimen -\fi \sphinxpxdimen=.75bp\relax -\ifdefined\pdfimageresolution - \pdfimageresolution= \numexpr \dimexpr1in\relax/\sphinxpxdimen\relax -\fi -%% let collapsible pdf bookmarks panel have high depth per default -\PassOptionsToPackage{bookmarksdepth=5}{hyperref} - -\PassOptionsToPackage{booktabs}{sphinx} -\PassOptionsToPackage{colorrows}{sphinx} - -\PassOptionsToPackage{warn}{textcomp} -\usepackage[utf8]{inputenc} -\ifdefined\DeclareUnicodeCharacter -% support both utf8 and utf8x syntaxes - \ifdefined\DeclareUnicodeCharacterAsOptional - \def\sphinxDUC#1{\DeclareUnicodeCharacter{"#1}} - \else - \let\sphinxDUC\DeclareUnicodeCharacter - \fi - \sphinxDUC{00A0}{\nobreakspace} - \sphinxDUC{2500}{\sphinxunichar{2500}} - \sphinxDUC{2502}{\sphinxunichar{2502}} - \sphinxDUC{2514}{\sphinxunichar{2514}} - \sphinxDUC{251C}{\sphinxunichar{251C}} - \sphinxDUC{2572}{\textbackslash} -\fi -\usepackage{cmap} -\usepackage[T1]{fontenc} -\usepackage{amsmath,amssymb,amstext} -\usepackage{babel} - - - -\usepackage{tgtermes} -\usepackage{tgheros} -\renewcommand{\ttdefault}{txtt} - - - -\usepackage[Bjarne]{fncychap} -\usepackage{sphinx} - -\fvset{fontsize=auto} -\usepackage{geometry} - - -% Include hyperref last. -\usepackage{hyperref} -% Fix anchor placement for figures with captions. -\usepackage{hypcap}% it must be loaded after hyperref. -% Set up styles of URL: it should be placed after hyperref. -\urlstyle{same} - - -\usepackage{sphinxmessages} -\setcounter{tocdepth}{0} - - - -\title{Kerberos Application Developer Guide} -\date{ } -\release{1.22\sphinxhyphen{}final} -\author{MIT} -\newcommand{\sphinxlogo}{\vbox{}} -\renewcommand{\releasename}{Release} -\makeindex -\begin{document} - -\ifdefined\shorthandoff - \ifnum\catcode`\=\string=\active\shorthandoff{=}\fi - \ifnum\catcode`\"=\active\shorthandoff{"}\fi -\fi - -\pagestyle{empty} -\sphinxmaketitle -\pagestyle{plain} -\sphinxtableofcontents -\pagestyle{normal} -\phantomsection\label{\detokenize{appdev/index::doc}} - - -\sphinxstepscope - - -\chapter{Developing with GSSAPI} -\label{\detokenize{appdev/gssapi:developing-with-gssapi}}\label{\detokenize{appdev/gssapi::doc}} -\sphinxAtStartPar -The GSSAPI (Generic Security Services API) allows applications to -communicate securely using Kerberos 5 or other security mechanisms. -We recommend using the GSSAPI (or a higher\sphinxhyphen{}level framework which -encompasses GSSAPI, such as SASL) for secure network communication -over using the libkrb5 API directly. - -\sphinxAtStartPar -GSSAPIv2 is specified in \index{RFC@\spxentry{RFC}!RFC 2743@\spxentry{RFC 2743}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc2743.html}{\sphinxstylestrong{RFC 2743}} and \index{RFC@\spxentry{RFC}!RFC 2744@\spxentry{RFC 2744}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc2744.html}{\sphinxstylestrong{RFC 2744}}. Also see -\index{RFC@\spxentry{RFC}!RFC 7546@\spxentry{RFC 7546}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc7546.html}{\sphinxstylestrong{RFC 7546}} for a description of how to use the GSSAPI in a client or -server program. - -\sphinxAtStartPar -This documentation will describe how various ways of using the -GSSAPI will behave with the krb5 mechanism as implemented in MIT krb5, -as well as krb5\sphinxhyphen{}specific extensions to the GSSAPI. - - -\section{Name types} -\label{\detokenize{appdev/gssapi:name-types}} -\sphinxAtStartPar -A GSSAPI application can name a local or remote entity by calling -\sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.16}{gss\_import\_name}, specifying a name type and a value. The following -name types are supported by the krb5 mechanism: -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_NT\_HOSTBASED\_SERVICE}: The value should be a string of the -form \sphinxcode{\sphinxupquote{service}} or \sphinxcode{\sphinxupquote{service@hostname}}. This is the most common -way to name target services when initiating a security context, and -is the most likely name type to work across multiple mechanisms. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_KRB5\_NT\_PRINCIPAL\_NAME}: The value should be a principal name -string. This name type only works with the krb5 mechanism, and is -defined in the \sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_krb5.h\textgreater{}}} header. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_NT\_USER\_NAME} or \sphinxstylestrong{GSS\_C\_NULL\_OID}: The value is treated -as an unparsed principal name string, as above. These name types -may work with mechanisms other than krb5, but will have different -interpretations in those mechanisms. \sphinxstylestrong{GSS\_C\_NT\_USER\_NAME} is -intended to be used with a local username, which will parse into a -single\sphinxhyphen{}component principal in the default realm. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_NT\_ANONYMOUS}: The value is ignored. The anonymous -principal is used, allowing a client to authenticate to a server -without asserting a particular identity (which may or may not be -allowed by a particular server or Kerberos realm). - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_NT\_MACHINE\_UID\_NAME}: The value is uid\_t object. On -Unix\sphinxhyphen{}like systems, the username of the uid is looked up in the -system user database and the resulting username is parsed as a -principal name. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_NT\_STRING\_UID\_NAME}: As above, but the value is a decimal -string representation of the uid. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_NT\_EXPORT\_NAME}: The value must be the result of a -\sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.13}{gss\_export\_name} call. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_KRB5\_NT\_ENTERPRISE\_NAME}: The value should be a krb5 -enterprise name string (see \index{RFC@\spxentry{RFC}!RFC 6806@\spxentry{RFC 6806}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc6806.html}{\sphinxstylestrong{RFC 6806}} section 5), in the form -\sphinxcode{\sphinxupquote{user@suffix}}. This name type is used to convey alias names, and -is defined in the \sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_krb5.h\textgreater{}}} header. (New in -release 1.17.) - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_KRB5\_NT\_X509\_CERT}: The value should be an X.509 certificate -encoded according to \index{RFC@\spxentry{RFC}!RFC 5280@\spxentry{RFC 5280}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc5280.html}{\sphinxstylestrong{RFC 5280}}. This name form can be used for -the desired\_name parameter of gss\_acquire\_cred\_impersonate\_name(), -to identify the S4U2Self user by certificate. (New in release -1.19.) - -\end{itemize} - - -\section{Initiator credentials} -\label{\detokenize{appdev/gssapi:initiator-credentials}} -\sphinxAtStartPar -A GSSAPI client application uses \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.19}{gss\_init\_sec\_context} to establish a -security context. The \sphinxstyleemphasis{initiator\_cred\_handle} parameter determines -what tickets are used to establish the connection. An application can -either pass \sphinxstylestrong{GSS\_C\_NO\_CREDENTIAL} to use the default client -credential, or it can use \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.2}{gss\_acquire\_cred} beforehand to acquire an -initiator credential. The call to \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.2}{gss\_acquire\_cred} may include a -\sphinxstyleemphasis{desired\_name} parameter, or it may pass \sphinxstylestrong{GSS\_C\_NO\_NAME} if it does -not have a specific name preference. - -\sphinxAtStartPar -If the desired name for a krb5 initiator credential is a host\sphinxhyphen{}based -name, it is converted to a principal name of the form -\sphinxcode{\sphinxupquote{service/hostname}} in the local realm, where \sphinxstyleemphasis{hostname} is the local -hostname if not specified. The hostname will be canonicalized using -forward name resolution, and possibly also using reverse name -resolution depending on the value of the \sphinxstylestrong{rdns} variable in -\DUrole{xref,std,std-ref}{libdefaults}. - -\sphinxAtStartPar -If a desired name is specified in the call to \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.2}{gss\_acquire\_cred}, the -krb5 mechanism will attempt to find existing tickets for that client -principal name in the default credential cache or collection. If the -default cache type does not support a collection, and the default -cache contains credentials for a different principal than the desired -name, a \sphinxstylestrong{GSS\_S\_CRED\_UNAVAIL} error will be returned with a minor -code indicating a mismatch. - -\sphinxAtStartPar -If no existing tickets are available for the desired name, but the -name has an entry in the default client \DUrole{xref,std,std-ref}{keytab\_definition}, the -krb5 mechanism will acquire initial tickets for the name using the -default client keytab. - -\sphinxAtStartPar -If no desired name is specified, credential acquisition will be -deferred until the credential is used in a call to -\sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.19}{gss\_init\_sec\_context} or \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.21}{gss\_inquire\_cred}. If the call is to -\sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.19}{gss\_init\_sec\_context}, the target name will be used to choose a client -principal name using the credential cache selection facility. (This -facility might, for instance, try to choose existing tickets for a -client principal in the same realm as the target service). If there -are no existing tickets for the chosen principal, but it is present in -the default client keytab, the krb5 mechanism will acquire initial -tickets using the keytab. - -\sphinxAtStartPar -If the target name cannot be used to select a client principal -(because the credentials are used in a call to \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.21}{gss\_inquire\_cred}), or -if the credential cache selection facility cannot choose a principal -for it, the default credential cache will be selected if it exists and -contains tickets. - -\sphinxAtStartPar -If the default credential cache does not exist, but the default client -keytab does, the krb5 mechanism will try to acquire initial tickets -for the first principal in the default client keytab. - -\sphinxAtStartPar -If the krb5 mechanism acquires initial tickets using the default -client keytab, the resulting tickets will be stored in the default -cache or collection, and will be refreshed by future calls to -\sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.2}{gss\_acquire\_cred} as they approach their expire time. - - -\section{Acceptor names} -\label{\detokenize{appdev/gssapi:acceptor-names}} -\sphinxAtStartPar -A GSSAPI server application uses \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.1}{gss\_accept\_sec\_context} to establish -a security context based on tokens provided by the client. The -\sphinxstyleemphasis{acceptor\_cred\_handle} parameter determines what -\DUrole{xref,std,std-ref}{keytab\_definition} entries may be authenticated to by the -client, if the krb5 mechanism is used. - -\sphinxAtStartPar -The simplest choice is to pass \sphinxstylestrong{GSS\_C\_NO\_CREDENTIAL} as the acceptor -credential. In this case, clients may authenticate to any service -principal in the default keytab (typically \DUrole{xref,std,std-ref}{DEFKTNAME}, or the value of -the \sphinxstylestrong{KRB5\_KTNAME} environment variable). This is the recommended -approach if the server application has no specific requirements to the -contrary. - -\sphinxAtStartPar -A server may acquire an acceptor credential with \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.2}{gss\_acquire\_cred} and -a \sphinxstyleemphasis{cred\_usage} of \sphinxstylestrong{GSS\_C\_ACCEPT} or \sphinxstylestrong{GSS\_C\_BOTH}. If the -\sphinxstyleemphasis{desired\_name} parameter is \sphinxstylestrong{GSS\_C\_NO\_NAME}, then clients will be -allowed to authenticate to any service principal in the default -keytab, just as if no acceptor credential was supplied. - -\sphinxAtStartPar -If a server wishes to specify a \sphinxstyleemphasis{desired\_name} to \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.2}{gss\_acquire\_cred}, -the most common choice is a host\sphinxhyphen{}based name. If the host\sphinxhyphen{}based -\sphinxstyleemphasis{desired\_name} contains just a \sphinxstyleemphasis{service}, then clients will be allowed -to authenticate to any host\sphinxhyphen{}based service principal (that is, a -principal of the form \sphinxcode{\sphinxupquote{service/hostname@REALM}}) for the named -service, regardless of hostname or realm, as long as it is present in -the default keytab. If the input name contains both a \sphinxstyleemphasis{service} and a -\sphinxstyleemphasis{hostname}, clients will be allowed to authenticate to any host\sphinxhyphen{}based -principal for the named service and hostname, regardless of realm. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If a \sphinxstyleemphasis{hostname} is specified, it will be canonicalized -using forward name resolution, and possibly also using -reverse name resolution depending on the value of the -\sphinxstylestrong{rdns} variable in \DUrole{xref,std,std-ref}{libdefaults}. -\end{sphinxadmonition} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If the \sphinxstylestrong{ignore\_acceptor\_hostname} variable in -\DUrole{xref,std,std-ref}{libdefaults} is enabled, then \sphinxstyleemphasis{hostname} will be -ignored even if one is specified in the input name. -\end{sphinxadmonition} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -In MIT krb5 versions prior to 1.10, and in Heimdal’s -implementation of the krb5 mechanism, an input name with -just a \sphinxstyleemphasis{service} is treated like an input name of -\sphinxcode{\sphinxupquote{service@localhostname}}, where \sphinxstyleemphasis{localhostname} is the -string returned by gethostname(). -\end{sphinxadmonition} - -\sphinxAtStartPar -If the \sphinxstyleemphasis{desired\_name} is a krb5 principal name or a local system name -type which is mapped to a krb5 principal name, clients will only be -allowed to authenticate to that principal in the default keytab. - - -\section{Name Attributes} -\label{\detokenize{appdev/gssapi:name-attributes}} -\sphinxAtStartPar -In release 1.8 or later, the \sphinxhref{https://tools.ietf.org/html/rfc6680.txt\#section-7.4}{gss\_inquire\_name} and -\sphinxhref{https://tools.ietf.org/html/6680.html\#section-7.5}{gss\_get\_name\_attribute} functions, specified in \index{RFC@\spxentry{RFC}!RFC 6680@\spxentry{RFC 6680}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc6680.html}{\sphinxstylestrong{RFC 6680}}, can be -used to retrieve name attributes from the \sphinxstyleemphasis{src\_name} returned by -\sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.1}{gss\_accept\_sec\_context}. The following attributes are defined when -the krb5 mechanism is used: - -\phantomsection\label{\detokenize{appdev/gssapi:gssapi-authind-attr}}\begin{itemize} -\item {} -\sphinxAtStartPar -“auth\sphinxhyphen{}indicators” attribute: - -\end{itemize} - -\sphinxAtStartPar -This attribute will be included in the \sphinxhref{https://tools.ietf.org/html/rfc6680.txt\#section-7.4}{gss\_inquire\_name} output if the -ticket contains \DUrole{xref,std,std-ref}{authentication indicators}. -One indicator is returned per invocation of \sphinxhref{https://tools.ietf.org/html/6680.html\#section-7.5}{gss\_get\_name\_attribute}, -so multiple invocations may be necessary to retrieve all of the -indicators from the ticket. (New in release 1.15.) - - -\section{Credential store extensions} -\label{\detokenize{appdev/gssapi:credential-store-extensions}} -\sphinxAtStartPar -Beginning with release 1.11, the following GSSAPI extensions declared -in \sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_ext.h\textgreater{}}} can be used to specify how credentials -are acquired or stored: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{struct} \PYG{n}{gss\PYGZus{}key\PYGZus{}value\PYGZus{}element\PYGZus{}struct} \PYG{p}{\PYGZob{}} - \PYG{n}{const} \PYG{n}{char} \PYG{o}{*}\PYG{n}{key}\PYG{p}{;} - \PYG{n}{const} \PYG{n}{char} \PYG{o}{*}\PYG{n}{value}\PYG{p}{;} -\PYG{p}{\PYGZcb{}}\PYG{p}{;} -\PYG{n}{typedef} \PYG{n}{struct} \PYG{n}{gss\PYGZus{}key\PYGZus{}value\PYGZus{}element\PYGZus{}struct} \PYG{n}{gss\PYGZus{}key\PYGZus{}value\PYGZus{}element\PYGZus{}desc}\PYG{p}{;} - -\PYG{n}{struct} \PYG{n}{gss\PYGZus{}key\PYGZus{}value\PYGZus{}set\PYGZus{}struct} \PYG{p}{\PYGZob{}} - \PYG{n}{OM\PYGZus{}uint32} \PYG{n}{count}\PYG{p}{;} - \PYG{n}{gss\PYGZus{}key\PYGZus{}value\PYGZus{}element\PYGZus{}desc} \PYG{o}{*}\PYG{n}{elements}\PYG{p}{;} -\PYG{p}{\PYGZcb{}}\PYG{p}{;} -\PYG{n}{typedef} \PYG{n}{const} \PYG{n}{struct} \PYG{n}{gss\PYGZus{}key\PYGZus{}value\PYGZus{}set\PYGZus{}struct} \PYG{n}{gss\PYGZus{}key\PYGZus{}value\PYGZus{}set\PYGZus{}desc}\PYG{p}{;} -\PYG{n}{typedef} \PYG{n}{const} \PYG{n}{gss\PYGZus{}key\PYGZus{}value\PYGZus{}set\PYGZus{}desc} \PYG{o}{*}\PYG{n}{gss\PYGZus{}const\PYGZus{}key\PYGZus{}value\PYGZus{}set\PYGZus{}t}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}acquire\PYGZus{}cred\PYGZus{}from}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{const} \PYG{n}{gss\PYGZus{}name\PYGZus{}t} \PYG{n}{desired\PYGZus{}name}\PYG{p}{,} - \PYG{n}{OM\PYGZus{}uint32} \PYG{n}{time\PYGZus{}req}\PYG{p}{,} - \PYG{n}{const} \PYG{n}{gss\PYGZus{}OID\PYGZus{}set} \PYG{n}{desired\PYGZus{}mechs}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}usage\PYGZus{}t} \PYG{n}{cred\PYGZus{}usage}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}const\PYGZus{}key\PYGZus{}value\PYGZus{}set\PYGZus{}t} \PYG{n}{cred\PYGZus{}store}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}id\PYGZus{}t} \PYG{o}{*}\PYG{n}{output\PYGZus{}cred\PYGZus{}handle}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID\PYGZus{}set} \PYG{o}{*}\PYG{n}{actual\PYGZus{}mechs}\PYG{p}{,} - \PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{time\PYGZus{}rec}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}store\PYGZus{}cred\PYGZus{}into}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}id\PYGZus{}t} \PYG{n}{input\PYGZus{}cred\PYGZus{}handle}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}usage\PYGZus{}t} \PYG{n}{cred\PYGZus{}usage}\PYG{p}{,} - \PYG{n}{const} \PYG{n}{gss\PYGZus{}OID} \PYG{n}{desired\PYGZus{}mech}\PYG{p}{,} - \PYG{n}{OM\PYGZus{}uint32} \PYG{n}{overwrite\PYGZus{}cred}\PYG{p}{,} - \PYG{n}{OM\PYGZus{}uint32} \PYG{n}{default\PYGZus{}cred}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}const\PYGZus{}key\PYGZus{}value\PYGZus{}set\PYGZus{}t} \PYG{n}{cred\PYGZus{}store}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID\PYGZus{}set} \PYG{o}{*}\PYG{n}{elements\PYGZus{}stored}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}usage\PYGZus{}t} \PYG{o}{*}\PYG{n}{cred\PYGZus{}usage\PYGZus{}stored}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The additional \sphinxstyleemphasis{cred\_store} parameter allows the caller to specify -information about how the credentials should be obtained and stored. -The following options are supported by the krb5 mechanism: -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxstylestrong{ccache}: For acquiring initiator credentials, the name of the -\DUrole{xref,std,std-ref}{credential cache} to which the handle will -refer. For storing credentials, the name of the cache or collection -where the credentials will be stored (see below). - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{client\_keytab}: For acquiring initiator credentials, the name of -the \DUrole{xref,std,std-ref}{keytab} which will be used, if -necessary, to refresh the credentials in the cache. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{keytab}: For acquiring acceptor credentials, the name of the -\DUrole{xref,std,std-ref}{keytab} to which the handle will refer. -In release 1.19 and later, this option also determines the keytab to -be used for verification when initiator credentials are acquired -using a password and verified. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{password}: For acquiring initiator credentials, this option -instructs the mechanism to acquire fresh credentials into a unique -memory credential cache. This option may not be used with the -\sphinxstylestrong{ccache} or \sphinxstylestrong{client\_keytab} options, and a \sphinxstyleemphasis{desired\_name} must -be specified. (New in release 1.19.) - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{rcache}: For acquiring acceptor credentials, the name of the -\DUrole{xref,std,std-ref}{replay cache} to be used when processing -the initiator tokens. (New in release 1.13.) - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{verify}: For acquiring initiator credentials, this option -instructs the mechanism to verify the credentials by obtaining a -ticket to a service with a known key. The service key is obtained -from the keytab specified with the \sphinxstylestrong{keytab} option or the default -keytab. The value may be the name of a principal in the keytab, or -the empty string. If the empty string is given, any \sphinxcode{\sphinxupquote{host}} -service principal in the keytab may be used. (New in release 1.19.) - -\end{itemize} - -\sphinxAtStartPar -In release 1.20 or later, if a collection name is specified for -\sphinxstylestrong{cache} in a call to gss\_store\_cred\_into(), an existing cache for -the client principal within the collection will be selected, or a new -cache will be created within the collection. If \sphinxstyleemphasis{overwrite\_cred} is -false and the selected credential cache already exists, a -\sphinxstylestrong{GSS\_S\_DUPLICATE\_ELEMENT} error will be returned. If \sphinxstyleemphasis{default\_cred} -is true, the primary cache of the collection will be switched to the -selected cache. - - -\section{Importing and exporting credentials} -\label{\detokenize{appdev/gssapi:importing-and-exporting-credentials}} -\sphinxAtStartPar -The following GSSAPI extensions can be used to import and export -credentials (declared in \sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_ext.h\textgreater{}}}): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}export\PYGZus{}cred}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}id\PYGZus{}t} \PYG{n}{cred\PYGZus{}handle}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{token}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}import\PYGZus{}cred}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{token}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}id\PYGZus{}t} \PYG{o}{*}\PYG{n}{cred\PYGZus{}handle}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The first function serializes a GSSAPI credential handle into a -buffer; the second unseralizes a buffer into a GSSAPI credential -handle. Serializing a credential does not destroy it. If any of the -mechanisms used in \sphinxstyleemphasis{cred\_handle} do not support serialization, -gss\_export\_cred will return \sphinxstylestrong{GSS\_S\_UNAVAILABLE}. As with other -GSSAPI serialization functions, these extensions are only intended to -work with a matching implementation on the other side; they do not -serialize credentials in a standardized format. - -\sphinxAtStartPar -A serialized credential may contain secret information such as ticket -session keys. The serialization format does not protect this -information from eavesdropping or tampering. The calling application -must take care to protect the serialized credential when communicating -it over an insecure channel or to an untrusted party. - -\sphinxAtStartPar -A krb5 GSSAPI credential may contain references to a credential cache, -a client keytab, an acceptor keytab, and a replay cache. These -resources are normally serialized as references to their external -locations (such as the filename of the credential cache). Because of -this, a serialized krb5 credential can only be imported by a process -with similar privileges to the exporter. A serialized credential -should not be trusted if it originates from a source with lower -privileges than the importer, as it may contain references to external -credential cache, keytab, or replay cache resources not accessible to -the originator. - -\sphinxAtStartPar -An exception to the above rule applies when a krb5 GSSAPI credential -refers to a memory credential cache, as is normally the case for -delegated credentials received by \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.1}{gss\_accept\_sec\_context}. In this -case, the contents of the credential cache are serialized, so that the -resulting token may be imported even if the original memory credential -cache no longer exists. - - -\section{Constrained delegation (S4U)} -\label{\detokenize{appdev/gssapi:constrained-delegation-s4u}} -\sphinxAtStartPar -The Microsoft S4U2Self and S4U2Proxy Kerberos protocol extensions -allow an intermediate service to acquire credentials from a client to -a target service without requiring the client to delegate a -ticket\sphinxhyphen{}granting ticket, if the KDC is configured to allow it. - -\sphinxAtStartPar -To perform a constrained delegation operation, the intermediate -service must submit to the KDC an “evidence ticket” from the client to -the intermediate service. An evidence ticket can be acquired when the -client authenticates to the intermediate service with Kerberos, or -with an S4U2Self request if the KDC allows it. The MIT krb5 GSSAPI -library represents an evidence ticket using a “proxy credential”, -which is a special kind of gss\_cred\_id\_t object whose underlying -credential cache contains the evidence ticket and a krbtgt ticket for -the intermediate service. - -\sphinxAtStartPar -To acquire a proxy credential during client authentication, the -service should first create an acceptor credential using the -\sphinxstylestrong{GSS\_C\_BOTH} usage. The application should then pass this -credential as the \sphinxstyleemphasis{acceptor\_cred\_handle} to \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.1}{gss\_accept\_sec\_context}, -and also pass a \sphinxstyleemphasis{delegated\_cred\_handle} output parameter to receive a -proxy credential containing the evidence ticket. The output value of -\sphinxstyleemphasis{delegated\_cred\_handle} may be a delegated ticket\sphinxhyphen{}granting ticket if -the client sent one, or a proxy credential if not. If the library can -determine that the client’s ticket is not a valid evidence ticket, it -will place \sphinxstylestrong{GSS\_C\_NO\_CREDENTIAL} in \sphinxstyleemphasis{delegated\_cred\_handle}. - -\sphinxAtStartPar -To acquire a proxy credential using an S4U2Self request, the service -can use the following GSSAPI extension: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}acquire\PYGZus{}cred\PYGZus{}impersonate\PYGZus{}name}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}id\PYGZus{}t} \PYG{n}{icred}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}name\PYGZus{}t} \PYG{n}{desired\PYGZus{}name}\PYG{p}{,} - \PYG{n}{OM\PYGZus{}uint32} \PYG{n}{time\PYGZus{}req}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID\PYGZus{}set} \PYG{n}{desired\PYGZus{}mechs}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}usage\PYGZus{}t} \PYG{n}{cred\PYGZus{}usage}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}id\PYGZus{}t} \PYG{o}{*}\PYG{n}{output\PYGZus{}cred}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID\PYGZus{}set} \PYG{o}{*}\PYG{n}{actual\PYGZus{}mechs}\PYG{p}{,} - \PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{time\PYGZus{}rec}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The parameters to this function are similar to those of -\sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.2}{gss\_acquire\_cred}, except that \sphinxstyleemphasis{icred} is used to make an S4U2Self -request to the KDC for a ticket from \sphinxstyleemphasis{desired\_name} to the -intermediate service. Both \sphinxstyleemphasis{icred} and \sphinxstyleemphasis{desired\_name} are required -for this function; passing \sphinxstylestrong{GSS\_C\_NO\_CREDENTIAL} or -\sphinxstylestrong{GSS\_C\_NO\_NAME} will cause the call to fail. \sphinxstyleemphasis{icred} must contain a -krbtgt ticket for the intermediate service. The result of this -operation is a proxy credential. (Prior to release 1.18, the result -of this operation may be a regular credential for \sphinxstyleemphasis{desired\_name}, if -the KDC issues a non\sphinxhyphen{}forwardable ticket.) - -\sphinxAtStartPar -Once the intermediate service has a proxy credential, it can simply -pass it to \sphinxhref{https://tools.ietf.org/html/rfc2744.html\#section-5.19}{gss\_init\_sec\_context} as the \sphinxstyleemphasis{initiator\_cred\_handle} -parameter, and the desired service as the \sphinxstyleemphasis{target\_name} parameter. -The GSSAPI library will present the krbtgt ticket and evidence ticket -in the proxy credential to the KDC in an S4U2Proxy request; if the -intermediate service has the appropriate permissions, the KDC will -issue a ticket from the client to the target service. The GSSAPI -library will then use this ticket to authenticate to the target -service. - -\sphinxAtStartPar -If an application needs to find out whether a credential it holds is a -proxy credential and the name of the intermediate service, it can -query the credential with the \sphinxstylestrong{GSS\_KRB5\_GET\_CRED\_IMPERSONATOR} OID -(new in release 1.16, declared in \sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_krb5.h\textgreater{}}}) using -the gss\_inquire\_cred\_by\_oid extension (declared in -\sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_ext.h\textgreater{}}}): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}inquire\PYGZus{}cred\PYGZus{}by\PYGZus{}oid}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{const} \PYG{n}{gss\PYGZus{}cred\PYGZus{}id\PYGZus{}t} \PYG{n}{cred\PYGZus{}handle}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID} \PYG{n}{desired\PYGZus{}object}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}set\PYGZus{}t} \PYG{o}{*}\PYG{n}{data\PYGZus{}set}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the call succeeds and \sphinxstyleemphasis{cred\_handle} is a proxy credential, -\sphinxstyleemphasis{data\_set} will be set to a single\sphinxhyphen{}element buffer set containing the -unparsed principal name of the intermediate service. If \sphinxstyleemphasis{cred\_handle} -is not a proxy credential, \sphinxstyleemphasis{data\_set} will be set to an empty buffer -set. If the library does not support the query, -gss\_inquire\_cred\_by\_oid will return \sphinxstylestrong{GSS\_S\_UNAVAILABLE}. - - -\section{Channel binding behavior and GSS\_C\_CHANNEL\_BOUND\_FLAG} -\label{\detokenize{appdev/gssapi:channel-binding-behavior-and-gss-c-channel-bound-flag}} -\sphinxAtStartPar -GSSAPI channel bindings can be used to limit the scope of a context -establishment token to a particular protected channel or endpoint, -such as a TLS channel or server certificate. Channel bindings can be -supplied via the \sphinxstyleemphasis{input\_chan\_bindings} parameter to either -gss\_init\_sec\_context() or gss\_accept\_sec\_context(). - -\sphinxAtStartPar -If both the initiator and acceptor of a GSSAPI exchange supply -matching channel bindings, \sphinxstylestrong{GSS\_C\_CHANNEL\_BOUND\_FLAG} will be -included in the gss\_accept\_sec\_context() \sphinxstyleemphasis{ret\_flags} result. If -either the initiator or acceptor (or both) do not supply channel -bindings, the exchange will succeed, but \sphinxstylestrong{GSS\_C\_CHANNEL\_BOUND\_FLAG} -will not be included in the return flags. If the acceptor and -initiator both inlude channel bindings but they do not match, the -exchange will fail. - -\sphinxAtStartPar -If \sphinxstylestrong{GSS\_C\_CHANNEL\_BOUND\_FLAG} is included in the \sphinxstyleemphasis{req\_flags} -parameter of gss\_init\_sec\_context(), the initiator will add the -Microsoft KERB\_AP\_OPTIONS\_CBT extension to the Kerberos authenticator. -This extension requests that the acceptor strictly enforce channel -bindings, causing the exchange to fail if the acceptor supplies -channel bindings and the initiator does not. The KERB\_AP\_OPTIONS\_CBT -extension will also be included if the -\sphinxstylestrong{client\_aware\_channel\_bindings} variable is set to \sphinxcode{\sphinxupquote{true}} in -\DUrole{xref,std,std-ref}{libdefaults}. - -\sphinxAtStartPar -Prior to release 1.19, \sphinxstylestrong{GSS\_C\_CHANNEL\_BOUND\_FLAG} is not -implemented, and the exchange will fail if the acceptor supply channel -bindings and the initiator does not (but not vice versa). Between -releases 1.19 and 1.21, \sphinxstylestrong{GSS\_C\_CHANNEL\_BOUND\_FLAG} is not recognized -as an initiator flag, so \sphinxstylestrong{client\_aware\_channel\_bindings} is the only -way to cause KERB\_AP\_OPTIONS\_CBT to be included. - - -\section{AEAD message wrapping} -\label{\detokenize{appdev/gssapi:aead-message-wrapping}} -\sphinxAtStartPar -The following GSSAPI extensions (declared in -\sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_ext.h\textgreater{}}}) can be used to wrap and unwrap messages -with additional “associated data” which is integrity\sphinxhyphen{}checked but is -not included in the output buffer: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}wrap\PYGZus{}aead}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{n}{context\PYGZus{}handle}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{conf\PYGZus{}req\PYGZus{}flag}\PYG{p}{,} \PYG{n}{gss\PYGZus{}qop\PYGZus{}t} \PYG{n}{qop\PYGZus{}req}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{input\PYGZus{}assoc\PYGZus{}buffer}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{input\PYGZus{}payload\PYGZus{}buffer}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{o}{*}\PYG{n}{conf\PYGZus{}state}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{output\PYGZus{}message\PYGZus{}buffer}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}unwrap\PYGZus{}aead}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{n}{context\PYGZus{}handle}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{input\PYGZus{}message\PYGZus{}buffer}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{input\PYGZus{}assoc\PYGZus{}buffer}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{output\PYGZus{}payload\PYGZus{}buffer}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{o}{*}\PYG{n}{conf\PYGZus{}state}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}qop\PYGZus{}t} \PYG{o}{*}\PYG{n}{qop\PYGZus{}state}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Wrap tokens created with gss\_wrap\_aead will successfully unwrap only -if the same \sphinxstyleemphasis{input\_assoc\_buffer} contents are presented to -gss\_unwrap\_aead. - - -\section{IOV message wrapping} -\label{\detokenize{appdev/gssapi:iov-message-wrapping}} -\sphinxAtStartPar -The following extensions (declared in \sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_ext.h\textgreater{}}}) can -be used for in\sphinxhyphen{}place encryption, fine\sphinxhyphen{}grained control over wrap token -layout, and for constructing wrap tokens compatible with Microsoft DCE -RPC: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{typedef} \PYG{n}{struct} \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc\PYGZus{}struct} \PYG{p}{\PYGZob{}} - \PYG{n}{OM\PYGZus{}uint32} \PYG{n+nb}{type}\PYG{p}{;} - \PYG{n}{gss\PYGZus{}buffer\PYGZus{}desc} \PYG{n}{buffer}\PYG{p}{;} -\PYG{p}{\PYGZcb{}} \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc}\PYG{p}{,} \PYG{o}{*}\PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}t}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}wrap\PYGZus{}iov}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{n}{context\PYGZus{}handle}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{conf\PYGZus{}req\PYGZus{}flag}\PYG{p}{,} \PYG{n}{gss\PYGZus{}qop\PYGZus{}t} \PYG{n}{qop\PYGZus{}req}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{o}{*}\PYG{n}{conf\PYGZus{}state}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{o}{*}\PYG{n}{iov}\PYG{p}{,} \PYG{n+nb}{int} \PYG{n}{iov\PYGZus{}count}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}unwrap\PYGZus{}iov}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{n}{context\PYGZus{}handle}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{o}{*}\PYG{n}{conf\PYGZus{}state}\PYG{p}{,} \PYG{n}{gss\PYGZus{}qop\PYGZus{}t} \PYG{o}{*}\PYG{n}{qop\PYGZus{}state}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{o}{*}\PYG{n}{iov}\PYG{p}{,} \PYG{n+nb}{int} \PYG{n}{iov\PYGZus{}count}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}wrap\PYGZus{}iov\PYGZus{}length}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{n}{context\PYGZus{}handle}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{conf\PYGZus{}req\PYGZus{}flag}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}qop\PYGZus{}t} \PYG{n}{qop\PYGZus{}req}\PYG{p}{,} \PYG{n+nb}{int} \PYG{o}{*}\PYG{n}{conf\PYGZus{}state}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{o}{*}\PYG{n}{iov}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{iov\PYGZus{}count}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}release\PYGZus{}iov\PYGZus{}buffer}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{o}{*}\PYG{n}{iov}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{iov\PYGZus{}count}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The caller of gss\_wrap\_iov provides an array of gss\_iov\_buffer\_desc -structures, each containing a type and a gss\_buffer\_desc structure. -Valid types include: -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_DATA}: A data buffer to be included in the -token, and to be encrypted or decrypted in\sphinxhyphen{}place if the token is -confidentiality\sphinxhyphen{}protected. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_HEADER}: The GSSAPI wrap token header and -underlying cryptographic header. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_TRAILER}: The cryptographic trailer, if one is -required. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_PADDING}: Padding to be combined with the data -during encryption and decryption. (The implementation may choose to -place padding in the trailer buffer, in which case it will set the -padding buffer length to 0.) - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_STREAM}: For unwrapping only, a buffer -containing a complete wrap token in standard format to be unwrapped. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_SIGN\_ONLY}: A buffer to be included in the -token’s integrity protection checksum, but not to be encrypted or -included in the token itself. - -\end{itemize} - -\sphinxAtStartPar -For gss\_wrap\_iov, the IOV list should contain one HEADER buffer, -followed by zero or more SIGN\_ONLY buffers, followed by one or more -DATA buffers, followed by a TRAILER buffer. The memory pointed to by -the buffers is not required to be contiguous or in any particular -order. If \sphinxstyleemphasis{conf\_req\_flag} is true, DATA buffers will be encrypted -in\sphinxhyphen{}place, while SIGN\_ONLY buffers will not be modified. - -\sphinxAtStartPar -The type of an output buffer may be combined with -\sphinxstylestrong{GSS\_C\_BUFFER\_FLAG\_ALLOCATE} to request that gss\_wrap\_iov allocate -the buffer contents. If gss\_wrap\_iov allocates a buffer, it sets the -\sphinxstylestrong{GSS\_C\_BUFFER\_FLAG\_ALLOCATED} flag on the buffer type. -gss\_release\_iov\_buffer can be used to release all allocated buffers -within an iov list and unset their allocated flags. Here is an -example of how gss\_wrap\_iov can be used with allocation requested -(\sphinxstyleemphasis{ctx} is assumed to be a previously established gss\_ctx\_id\_t): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{;} -\PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{4}\PYG{p}{]}\PYG{p}{;} -\PYG{n}{char} \PYG{n+nb}{str}\PYG{p}{[}\PYG{p}{]} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{message}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} - -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}HEADER} \PYG{o}{|} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}FLAG\PYGZus{}ALLOCATE}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}DATA}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{n+nb}{str}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{=} \PYG{n}{strlen}\PYG{p}{(}\PYG{n+nb}{str}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}PADDING} \PYG{o}{|} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}FLAG\PYGZus{}ALLOCATE}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{3}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}TRAILER} \PYG{o}{|} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}FLAG\PYGZus{}ALLOCATE}\PYG{p}{;} - -\PYG{n}{major} \PYG{o}{=} \PYG{n}{gss\PYGZus{}wrap\PYGZus{}iov}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{ctx}\PYG{p}{,} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{GSS\PYGZus{}C\PYGZus{}QOP\PYGZus{}DEFAULT}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} - \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{4}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{GSS\PYGZus{}ERROR}\PYG{p}{(}\PYG{n}{major}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}error}\PYG{p}{(}\PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{)}\PYG{p}{;} - -\PYG{o}{/}\PYG{o}{*} \PYG{n}{Transmit} \PYG{o+ow}{or} \PYG{n}{otherwise} \PYG{n}{use} \PYG{n}{resulting} \PYG{n}{buffers}\PYG{o}{.} \PYG{o}{*}\PYG{o}{/} - -\PYG{p}{(}\PYG{n}{void}\PYG{p}{)}\PYG{n}{gss\PYGZus{}release\PYGZus{}iov\PYGZus{}buffer}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{4}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the caller does not choose to request buffer allocation by -gss\_wrap\_iov, it should first call gss\_wrap\_iov\_length to query the -lengths of the HEADER, PADDING, and TRAILER buffers. DATA buffers -must be provided in the iov list so that padding length can be -computed correctly, but the output buffers need not be initialized. -Here is an example of using gss\_wrap\_iov\_length and gss\_wrap\_iov: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{;} -\PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{4}\PYG{p}{]}\PYG{p}{;} -\PYG{n}{char} \PYG{n+nb}{str}\PYG{p}{[}\PYG{l+m+mi}{1024}\PYG{p}{]} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{message}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{,} \PYG{o}{*}\PYG{n}{ptr}\PYG{p}{;} - -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}HEADER}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}DATA}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{n+nb}{str}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{=} \PYG{n}{strlen}\PYG{p}{(}\PYG{n+nb}{str}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}PADDING}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{3}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}TRAILER}\PYG{p}{;} - -\PYG{n}{major} \PYG{o}{=} \PYG{n}{gss\PYGZus{}wrap\PYGZus{}iov\PYGZus{}length}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{ctx}\PYG{p}{,} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{GSS\PYGZus{}C\PYGZus{}QOP\PYGZus{}DEFAULT}\PYG{p}{,} - \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{4}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{GSS\PYGZus{}ERROR}\PYG{p}{(}\PYG{n}{major}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}error}\PYG{p}{(}\PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{strlen}\PYG{p}{(}\PYG{n+nb}{str}\PYG{p}{)} \PYG{o}{+} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{+} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{+} - \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{3}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{\PYGZgt{}} \PYG{n}{sizeof}\PYG{p}{(}\PYG{n+nb}{str}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}out\PYGZus{}of\PYGZus{}space\PYGZus{}error}\PYG{p}{(}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{ptr} \PYG{o}{=} \PYG{n+nb}{str} \PYG{o}{+} \PYG{n}{strlen}\PYG{p}{(}\PYG{n+nb}{str}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{n}{ptr}\PYG{p}{;} -\PYG{n}{ptr} \PYG{o}{+}\PYG{o}{=} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{n}{ptr}\PYG{p}{;} -\PYG{n}{ptr} \PYG{o}{+}\PYG{o}{=} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{3}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{n}{ptr}\PYG{p}{;} - -\PYG{n}{major} \PYG{o}{=} \PYG{n}{gss\PYGZus{}wrap\PYGZus{}iov}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{ctx}\PYG{p}{,} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{GSS\PYGZus{}C\PYGZus{}QOP\PYGZus{}DEFAULT}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} - \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{4}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{GSS\PYGZus{}ERROR}\PYG{p}{(}\PYG{n}{major}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}error}\PYG{p}{(}\PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the context was established using the \sphinxstylestrong{GSS\_C\_DCE\_STYLE} flag -(described in \index{RFC@\spxentry{RFC}!RFC 4757@\spxentry{RFC 4757}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc4757.html}{\sphinxstylestrong{RFC 4757}}), wrap tokens compatible with Microsoft DCE -RPC can be constructed. In this case, the IOV list must include a -SIGN\_ONLY buffer, a DATA buffer, a second SIGN\_ONLY buffer, and a -HEADER buffer in that order (the order of the buffer contents remains -arbitrary). The application must pad the DATA buffer to a multiple of -16 bytes as no padding or trailer buffer is used. - -\sphinxAtStartPar -gss\_unwrap\_iov may be called with an IOV list just like one which -would be provided to gss\_wrap\_iov. DATA buffers will be decrypted -in\sphinxhyphen{}place if they were encrypted, and SIGN\_ONLY buffers will not be -modified. - -\sphinxAtStartPar -Alternatively, gss\_unwrap\_iov may be called with a single STREAM -buffer, zero or more SIGN\_ONLY buffers, and a single DATA buffer. The -STREAM buffer is interpreted as a complete wrap token. The STREAM -buffer will be modified in\sphinxhyphen{}place to decrypt its contents. The DATA -buffer will be initialized to point to the decrypted data within the -STREAM buffer, unless it has the \sphinxstylestrong{GSS\_C\_BUFFER\_FLAG\_ALLOCATE} flag -set, in which case it will be initialized with a copy of the decrypted -data. Here is an example (\sphinxstyleemphasis{token} and \sphinxstyleemphasis{token\_len} are assumed to be a -pre\sphinxhyphen{}existing pointer and length for a modifiable region of data): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{;} -\PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{p}{;} - -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}STREAM}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{n}{token}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{=} \PYG{n}{token\PYGZus{}len}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}DATA}\PYG{p}{;} -\PYG{n}{major} \PYG{o}{=} \PYG{n}{gss\PYGZus{}unwrap\PYGZus{}iov}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{ctx}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{2}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{GSS\PYGZus{}ERROR}\PYG{p}{(}\PYG{n}{major}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}error}\PYG{p}{(}\PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{)}\PYG{p}{;} - -\PYG{o}{/}\PYG{o}{*} \PYG{n}{Decrypted} \PYG{n}{data} \PYG{o+ow}{is} \PYG{o+ow}{in} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{p}{,} \PYG{n}{pointing} \PYG{n}{to} \PYG{n}{a} \PYG{n}{subregion} \PYG{n}{of} - \PYG{o}{*} \PYG{n}{token}\PYG{o}{.} \PYG{o}{*}\PYG{o}{/} -\end{sphinxVerbatim} - - -\section{IOV MIC tokens} -\label{\detokenize{appdev/gssapi:iov-mic-tokens}}\label{\detokenize{appdev/gssapi:gssapi-mic-token}} -\sphinxAtStartPar -The following extensions (declared in \sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_ext.h\textgreater{}}}) can -be used in release 1.12 or later to construct and verify MIC tokens -using an IOV list: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}get\PYGZus{}mic\PYGZus{}iov}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{n}{context\PYGZus{}handle}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}qop\PYGZus{}t} \PYG{n}{qop\PYGZus{}req}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{o}{*}\PYG{n}{iov}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{iov\PYGZus{}count}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}get\PYGZus{}mic\PYGZus{}iov\PYGZus{}length}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{n}{context\PYGZus{}handle}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}qop\PYGZus{}t} \PYG{n}{qop\PYGZus{}req}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{o}{*}\PYG{n}{iov}\PYG{p}{,} - \PYG{n}{iov\PYGZus{}count}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gss\PYGZus{}verify\PYGZus{}mic\PYGZus{}iov}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{n}{context\PYGZus{}handle}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}qop\PYGZus{}t} \PYG{o}{*}\PYG{n}{qop\PYGZus{}state}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{o}{*}\PYG{n}{iov}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{iov\PYGZus{}count}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The caller of gss\_get\_mic\_iov provides an array of gss\_iov\_buffer\_desc -structures, each containing a type and a gss\_buffer\_desc structure. -Valid types include: -\begin{itemize} -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_DATA} and \sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_SIGN\_ONLY}: The -corresponding buffer for each of these types will be signed for the -MIC token, in the order provided. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{GSS\_C\_BUFFER\_TYPE\_MIC\_TOKEN}: The GSSAPI MIC token. - -\end{itemize} - -\sphinxAtStartPar -The type of the MIC\_TOKEN buffer may be combined with -\sphinxstylestrong{GSS\_C\_BUFFER\_FLAG\_ALLOCATE} to request that gss\_get\_mic\_iov -allocate the buffer contents. If gss\_get\_mic\_iov allocates the -buffer, it sets the \sphinxstylestrong{GSS\_C\_BUFFER\_FLAG\_ALLOCATED} flag on the buffer -type. gss\_release\_iov\_buffer can be used to release all allocated -buffers within an iov list and unset their allocated flags. Here is -an example of how gss\_get\_mic\_iov can be used with allocation -requested (\sphinxstyleemphasis{ctx} is assumed to be a previously established -gss\_ctx\_id\_t): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{;} -\PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{3}\PYG{p}{]}\PYG{p}{;} - -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}DATA}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{sign1}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{=} \PYG{l+m+mi}{5}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}SIGN\PYGZus{}ONLY}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{sign2}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{=} \PYG{l+m+mi}{5}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}MIC\PYGZus{}TOKEN} \PYG{o}{|} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}FLAG\PYGZus{}ALLOCATE}\PYG{p}{;} - -\PYG{n}{major} \PYG{o}{=} \PYG{n}{gss\PYGZus{}get\PYGZus{}mic\PYGZus{}iov}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{ctx}\PYG{p}{,} \PYG{n}{GSS\PYGZus{}C\PYGZus{}QOP\PYGZus{}DEFAULT}\PYG{p}{,} \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{3}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{GSS\PYGZus{}ERROR}\PYG{p}{(}\PYG{n}{major}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}error}\PYG{p}{(}\PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{)}\PYG{p}{;} - -\PYG{o}{/}\PYG{o}{*} \PYG{n}{Transmit} \PYG{o+ow}{or} \PYG{n}{otherwise} \PYG{n}{use} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.} \PYG{o}{*}\PYG{o}{/} - -\PYG{p}{(}\PYG{n}{void}\PYG{p}{)}\PYG{n}{gss\PYGZus{}release\PYGZus{}iov\PYGZus{}buffer}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{3}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If the caller does not choose to request buffer allocation by -gss\_get\_mic\_iov, it should first call gss\_get\_mic\_iov\_length to query -the length of the MIC\_TOKEN buffer. Here is an example of using -gss\_get\_mic\_iov\_length and gss\_get\_mic\_iov: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{;} -\PYG{n}{gss\PYGZus{}iov\PYGZus{}buffer\PYGZus{}desc} \PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{2}\PYG{p}{]}\PYG{p}{;} -\PYG{n}{char} \PYG{n}{data}\PYG{p}{[}\PYG{l+m+mi}{1024}\PYG{p}{]}\PYG{p}{;} - -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}MIC\PYGZus{}TOKEN}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{type} \PYG{o}{=} \PYG{n}{GSS\PYGZus{}IOV\PYGZus{}BUFFER\PYGZus{}TYPE\PYGZus{}DATA}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{message}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{=} \PYG{l+m+mi}{7}\PYG{p}{;} - -\PYG{n}{major} \PYG{o}{=} \PYG{n}{gss\PYGZus{}get\PYGZus{}mic\PYGZus{}iov\PYGZus{}length}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{ctx}\PYG{p}{,} \PYG{n}{GSS\PYGZus{}C\PYGZus{}QOP\PYGZus{}DEFAULT}\PYG{p}{,} \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{2}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{GSS\PYGZus{}ERROR}\PYG{p}{(}\PYG{n}{major}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}error}\PYG{p}{(}\PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{length} \PYG{o}{\PYGZgt{}} \PYG{n}{sizeof}\PYG{p}{(}\PYG{n}{data}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}out\PYGZus{}of\PYGZus{}space\PYGZus{}error}\PYG{p}{(}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{iov}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{o}{.}\PYG{n}{buffer}\PYG{o}{.}\PYG{n}{value} \PYG{o}{=} \PYG{n}{data}\PYG{p}{;} - -\PYG{n}{major} \PYG{o}{=} \PYG{n}{gss\PYGZus{}get\PYGZus{}mic\PYGZus{}iov}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{minor}\PYG{p}{,} \PYG{n}{ctx}\PYG{p}{,} \PYG{n}{GSS\PYGZus{}C\PYGZus{}QOP\PYGZus{}DEFAULT}\PYG{p}{,} \PYG{n}{iov}\PYG{p}{,} \PYG{l+m+mi}{2}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{GSS\PYGZus{}ERROR}\PYG{p}{(}\PYG{n}{major}\PYG{p}{)}\PYG{p}{)} - \PYG{n}{handle\PYGZus{}error}\PYG{p}{(}\PYG{n}{major}\PYG{p}{,} \PYG{n}{minor}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxstepscope - - -\chapter{Year 2038 considerations for uses of krb5\_timestamp} -\label{\detokenize{appdev/y2038:year-2038-considerations-for-uses-of-krb5-timestamp}}\label{\detokenize{appdev/y2038::doc}} -\sphinxAtStartPar -POSIX time values, which measure the number of seconds since January 1 -1970, will exceed the maximum value representable in a signed 32\sphinxhyphen{}bit -integer in January 2038. This documentation describes considerations -for consumers of the MIT krb5 libraries. - -\sphinxAtStartPar -Applications or libraries which use libkrb5 and consume the timestamps -included in credentials or other structures make use of the -{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_timestamp}}}}} type. For historical reasons, krb5\_timestamp -is a signed 32\sphinxhyphen{}bit integer, even on platforms where a larger type is -natively used to represent time values. To behave properly for time -values after January 2038, calling code should cast krb5\_timestamp -values to uint32\_t, and then to time\_t: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{(}\PYG{n}{time\PYGZus{}t}\PYG{p}{)}\PYG{p}{(}\PYG{n}{uint32\PYGZus{}t}\PYG{p}{)}\PYG{n}{timestamp} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Used in this way, krb5\_timestamp values can represent time values up -until February 2106, provided that the platform uses a 64\sphinxhyphen{}bit or -larger time\_t type. This usage will also remain safe if a later -version of MIT krb5 changes krb5\_timestamp to an unsigned 32\sphinxhyphen{}bit -integer. - -\sphinxAtStartPar -The GSSAPI only uses representations of time intervals, not absolute -times. Callers of the GSSAPI should require no changes to behave -correctly after January 2038, provided that they use MIT krb5 release -1.16 or later. - -\sphinxstepscope - - -\chapter{Differences between Heimdal and MIT Kerberos API} -\label{\detokenize{appdev/h5l_mit_apidiff:differences-between-heimdal-and-mit-kerberos-api}}\label{\detokenize{appdev/h5l_mit_apidiff::doc}} - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\sphinxthistablewithvlinesstyle -\centering -\begin{tabulary}{\linewidth}[t]{|l|l|} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_auth_con_getaddrs:c.krb5_auth_con_getaddrs}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_auth\_con\_getaddrs()}}}}} -& -\sphinxAtStartPar -H5l: If either of the pointers to local\_addr -and remote\_addr is not NULL, it is freed -first and then reallocated before being -populated with the content of corresponding -address from authentication context. -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_auth_con_setaddrs:c.krb5_auth_con_setaddrs}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_auth\_con\_setaddrs()}}}}} -& -\sphinxAtStartPar -H5l: If either address is NULL, the previous -address remains in place -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_auth_con_setports:c.krb5_auth_con_setports}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_auth\_con\_setports()}}}}} -& -\sphinxAtStartPar -H5l: Not implemented as of version 1.3.3 -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_auth_con_setrecvsubkey:c.krb5_auth_con_setrecvsubkey}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_auth\_con\_setrecvsubkey()}}}}} -& -\sphinxAtStartPar -H5l: If either port is NULL, the previous -port remains in place -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_auth_con_setsendsubkey:c.krb5_auth_con_setsendsubkey}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_auth\_con\_setsendsubkey()}}}}} -& -\sphinxAtStartPar -H5l: Not implemented as of version 1.3.3 -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_cc_set_config:c.krb5_cc_set_config}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_cc\_set\_config()}}}}} -& -\sphinxAtStartPar -MIT: Before version 1.10 it was assumed that -the last argument \sphinxstyleemphasis{data} is ALWAYS non\sphinxhyphen{}zero. -\\ -\sphinxhline -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_cccol\_last\_change\_time()}} -& -\sphinxAtStartPar -MIT: not implemented -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_set_default_realm:c.krb5_set_default_realm}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_set\_default\_realm()}}}}} -& -\sphinxAtStartPar -H5l: Caches the computed default realm context -field. If the second argument is NULL, -it tries to retrieve it from libdefaults or DNS. -MIT: Computes the default realm each time -if it wasn’t explicitly set in the context -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\chapter{Initial credentials} -\label{\detokenize{appdev/init_creds:initial-credentials}}\label{\detokenize{appdev/init_creds::doc}} -\sphinxAtStartPar -Software that performs tasks such as logging users into a computer -when they type their Kerberos password needs to get initial -credentials (usually ticket granting tickets) from Kerberos. Such -software shares some behavior with the \DUrole{xref,std,std-ref}{kinit(1)} program. - -\sphinxAtStartPar -Whenever a program grants access to a resource (such as a local login -session on a desktop computer) based on a user successfully getting -initial Kerberos credentials, it must verify those credentials against -a secure shared secret (e.g., a host keytab) to ensure that the user -credentials actually originate from a legitimate KDC. Failure to -perform this verification is a critical vulnerability, because a -malicious user can execute the “Zanarotti attack”: the user constructs -a fake response that appears to come from the legitimate KDC, but -whose contents come from an attacker\sphinxhyphen{}controlled KDC. - -\sphinxAtStartPar -Some applications read a Kerberos password over the network (ideally -over a secure channel), which they then verify against the KDC. While -this technique may be the only practical way to integrate Kerberos -into some existing legacy systems, its use is contrary to the original -design goals of Kerberos. - -\sphinxAtStartPar -The function {\hyperref[\detokenize{appdev/refs/api/krb5_get_init_creds_password:c.krb5_get_init_creds_password}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_init\_creds\_password()}}}}} will get initial -credentials for a client using a password. An application that needs -to verify the credentials can call {\hyperref[\detokenize{appdev/refs/api/krb5_verify_init_creds:c.krb5_verify_init_creds}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_verify\_init\_creds()}}}}}. -Here is an example of code to obtain and verify TGT credentials, given -strings \sphinxstyleemphasis{princname} and \sphinxstyleemphasis{password} for the client principal name and -password: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5\PYGZus{}error\PYGZus{}code} \PYG{n}{ret}\PYG{p}{;} -\PYG{n}{krb5\PYGZus{}creds} \PYG{n}{creds}\PYG{p}{;} -\PYG{n}{krb5\PYGZus{}principal} \PYG{n}{client\PYGZus{}princ} \PYG{o}{=} \PYG{n}{NULL}\PYG{p}{;} - -\PYG{n}{memset}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{n}{sizeof}\PYG{p}{(}\PYG{n}{creds}\PYG{p}{)}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}parse\PYGZus{}name}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{princname}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{client\PYGZus{}princ}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{n}{goto} \PYG{n}{cleanup}\PYG{p}{;} -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}password}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{n}{client\PYGZus{}princ}\PYG{p}{,} - \PYG{n}{password}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{n}{goto} \PYG{n}{cleanup}\PYG{p}{;} -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}verify\PYGZus{}init\PYGZus{}creds}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{cleanup}\PYG{p}{:} -\PYG{n}{krb5\PYGZus{}free\PYGZus{}principal}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{client\PYGZus{}princ}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{krb5\PYGZus{}free\PYGZus{}cred\PYGZus{}contents}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{return} \PYG{n}{ret}\PYG{p}{;} -\end{sphinxVerbatim} - - -\section{Options for get\_init\_creds} -\label{\detokenize{appdev/init_creds:options-for-get-init-creds}} -\sphinxAtStartPar -The function {\hyperref[\detokenize{appdev/refs/api/krb5_get_init_creds_password:c.krb5_get_init_creds_password}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_init\_creds\_password()}}}}} takes an options -parameter (which can be a null pointer). Use the function -{\hyperref[\detokenize{appdev/refs/api/krb5_get_init_creds_opt_alloc:c.krb5_get_init_creds_opt_alloc}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_init\_creds\_opt\_alloc()}}}}} to allocate an options -structure, and {\hyperref[\detokenize{appdev/refs/api/krb5_get_init_creds_opt_free:c.krb5_get_init_creds_opt_free}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_init\_creds\_opt\_free()}}}}} to free it. For -example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5\PYGZus{}error\PYGZus{}code} \PYG{n}{ret}\PYG{p}{;} -\PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt} \PYG{o}{*}\PYG{n}{opt} \PYG{o}{=} \PYG{n}{NULL}\PYG{p}{;} -\PYG{n}{krb5\PYGZus{}creds} \PYG{n}{creds}\PYG{p}{;} - -\PYG{n}{memset}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{n}{sizeof}\PYG{p}{(}\PYG{n}{creds}\PYG{p}{)}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}alloc}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{opt}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{n}{goto} \PYG{n}{cleanup}\PYG{p}{;} -\PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}set\PYGZus{}tkt\PYGZus{}life}\PYG{p}{(}\PYG{n}{opt}\PYG{p}{,} \PYG{l+m+mi}{24} \PYG{o}{*} \PYG{l+m+mi}{60} \PYG{o}{*} \PYG{l+m+mi}{60}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}password}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{n}{client\PYGZus{}princ}\PYG{p}{,} - \PYG{n}{password}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{opt}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{n}{goto} \PYG{n}{cleanup}\PYG{p}{;} - -\PYG{n}{cleanup}\PYG{p}{:} -\PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}free}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{opt}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{krb5\PYGZus{}free\PYGZus{}cred\PYGZus{}contents}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{return} \PYG{n}{ret}\PYG{p}{;} -\end{sphinxVerbatim} - - -\section{Getting anonymous credentials} -\label{\detokenize{appdev/init_creds:getting-anonymous-credentials}} -\sphinxAtStartPar -As of release 1.8, it is possible to obtain fully anonymous or -partially anonymous (realm\sphinxhyphen{}exposed) credentials, if the KDC supports -it. The MIT KDC supports issuing fully anonymous credentials as of -release 1.8 if configured appropriately (see \DUrole{xref,std,std-ref}{anonymous\_pkinit}), -but does not support issuing realm\sphinxhyphen{}exposed anonymous credentials at -this time. - -\sphinxAtStartPar -To obtain fully anonymous credentials, call -{\hyperref[\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_anonymous:c.krb5_get_init_creds_opt_set_anonymous}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_init\_creds\_opt\_set\_anonymous()}}}}} on the options -structure to set the anonymous flag, and specify a client principal -with the KDC’s realm and a single empty data component (the principal -obtained by parsing \sphinxcode{\sphinxupquote{@}}\sphinxstyleemphasis{realmname}). Authentication will take -place using anonymous PKINIT; if successful, the client principal of -the resulting tickets will be -\sphinxcode{\sphinxupquote{WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS}}. Here is an example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}set\PYGZus{}anonymous}\PYG{p}{(}\PYG{n}{opt}\PYG{p}{,} \PYG{l+m+mi}{1}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}build\PYGZus{}principal}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{client\PYGZus{}princ}\PYG{p}{,} \PYG{n}{strlen}\PYG{p}{(}\PYG{n}{myrealm}\PYG{p}{)}\PYG{p}{,} - \PYG{n}{myrealm}\PYG{p}{,} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{,} \PYG{p}{(}\PYG{n}{char} \PYG{o}{*}\PYG{p}{)}\PYG{n}{NULL}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{n}{goto} \PYG{n}{cleanup}\PYG{p}{;} -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}password}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{n}{client\PYGZus{}princ}\PYG{p}{,} - \PYG{n}{password}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{opt}\PYG{p}{)}\PYG{p}{;} -\PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{n}{goto} \PYG{n}{cleanup}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -To obtain realm\sphinxhyphen{}exposed anonymous credentials, set the anonymous flag -on the options structure as above, but specify a normal client -principal in order to prove membership in the realm. Authentication -will take place as it normally does; if successful, the client -principal of the resulting tickets will be \sphinxcode{\sphinxupquote{WELLKNOWN/ANONYMOUS@}}\sphinxstyleemphasis{realmname}. - - -\section{User interaction} -\label{\detokenize{appdev/init_creds:user-interaction}} -\sphinxAtStartPar -Authenticating a user usually requires the entry of secret -information, such as a password. A password can be supplied directly -to {\hyperref[\detokenize{appdev/refs/api/krb5_get_init_creds_password:c.krb5_get_init_creds_password}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_init\_creds\_password()}}}}} via the \sphinxstyleemphasis{password} -parameter, or the application can supply prompter and/or responder -callbacks instead. If callbacks are used, the user can also be -queried for other secret information such as a PIN, informed of -impending password expiration, or prompted to change a password which -has expired. - - -\subsection{Prompter callback} -\label{\detokenize{appdev/init_creds:prompter-callback}} -\sphinxAtStartPar -A prompter callback can be specified via the \sphinxstyleemphasis{prompter} and \sphinxstyleemphasis{data} -parameters to {\hyperref[\detokenize{appdev/refs/api/krb5_get_init_creds_password:c.krb5_get_init_creds_password}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_init\_creds\_password()}}}}}. The prompter -will be invoked each time the krb5 library has a question to ask or -information to present. When the prompter callback is invoked, the -\sphinxstyleemphasis{banner} argument (if not null) is intended to be displayed to the -user, and the questions to be answered are specified in the \sphinxstyleemphasis{prompts} -array. Each prompt contains a text question in the \sphinxstyleemphasis{prompt} field, a -\sphinxstyleemphasis{hidden} bit to indicate whether the answer should be hidden from -display, and a storage area for the answer in the \sphinxstyleemphasis{reply} field. The -callback should fill in each question’s \sphinxcode{\sphinxupquote{reply\sphinxhyphen{}\textgreater{}data}} with the -answer, up to a maximum number of \sphinxcode{\sphinxupquote{reply\sphinxhyphen{}\textgreater{}length}} bytes, and then -reset \sphinxcode{\sphinxupquote{reply\sphinxhyphen{}\textgreater{}length}} to the length of the answer. - -\sphinxAtStartPar -A prompter callback can call {\hyperref[\detokenize{appdev/refs/api/krb5_get_prompt_types:c.krb5_get_prompt_types}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_prompt\_types()}}}}} to get an -array of type constants corresponding to the prompts, to get -programmatic information about the semantic meaning of the questions. -{\hyperref[\detokenize{appdev/refs/api/krb5_get_prompt_types:c.krb5_get_prompt_types}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_prompt\_types()}}}}} may return a null pointer if no prompt -type information is available. - -\sphinxAtStartPar -Text\sphinxhyphen{}based applications can use a built\sphinxhyphen{}in text prompter -implementation by supplying {\hyperref[\detokenize{appdev/refs/api/krb5_prompter_posix:c.krb5_prompter_posix}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_prompter\_posix()}}}}} as the -\sphinxstyleemphasis{prompter} parameter and a null pointer as the \sphinxstyleemphasis{data} parameter. For -example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}password}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{n}{client\PYGZus{}princ}\PYG{p}{,} - \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{krb5\PYGZus{}prompter\PYGZus{}posix}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} - \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - - -\subsection{Responder callback} -\label{\detokenize{appdev/init_creds:responder-callback}} -\sphinxAtStartPar -A responder callback can be specified through the init\_creds options -using the {\hyperref[\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_responder:c.krb5_get_init_creds_opt_set_responder}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_get\_init\_creds\_opt\_set\_responder()}}}}} function. -Responder callbacks can present a more sophisticated user interface -for authentication secrets. The responder callback is usually invoked -only once per authentication, with a list of questions produced by all -of the allowed preauthentication mechanisms. - -\sphinxAtStartPar -When the responder callback is invoked, the \sphinxstyleemphasis{rctx} argument can be -accessed to obtain the list of questions and to answer them. The -{\hyperref[\detokenize{appdev/refs/api/krb5_responder_list_questions:c.krb5_responder_list_questions}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_responder\_list\_questions()}}}}} function retrieves an array of -question types. For each question type, the -{\hyperref[\detokenize{appdev/refs/api/krb5_responder_get_challenge:c.krb5_responder_get_challenge}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_responder\_get\_challenge()}}}}} function retrieves additional -information about the question, if applicable, and the -{\hyperref[\detokenize{appdev/refs/api/krb5_responder_set_answer:c.krb5_responder_set_answer}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_responder\_set\_answer()}}}}} function sets the answer. - -\sphinxAtStartPar -Responder question types, challenges, and answers are UTF\sphinxhyphen{}8 strings. -The question type is a well\sphinxhyphen{}known string; the meaning of the challenge -and answer depend on the question type. If an application does not -understand a question type, it cannot interpret the challenge or -provide an answer. Failing to answer a question typically results in -the prompter callback being used as a fallback. - - -\subsubsection{Password question} -\label{\detokenize{appdev/init_creds:password-question}} -\sphinxAtStartPar -The \sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_PASSWORD}} (or \sphinxcode{\sphinxupquote{"password"}}) -question type requests the user’s password. This question does not -have a challenge, and the response is simply the password string. - - -\subsubsection{One\sphinxhyphen{}time password question} -\label{\detokenize{appdev/init_creds:one-time-password-question}} -\sphinxAtStartPar -The \sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_OTP}} (or \sphinxcode{\sphinxupquote{"otp"}}) question -type requests a choice among one\sphinxhyphen{}time password tokens and the PIN and -value for the chosen token. The challenge and answer are JSON\sphinxhyphen{}encoded -strings, but an application can use convenience functions to avoid -doing any JSON processing itself. - -\sphinxAtStartPar -The {\hyperref[\detokenize{appdev/refs/api/krb5_responder_otp_get_challenge:c.krb5_responder_otp_get_challenge}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_responder\_otp\_get\_challenge()}}}}} function decodes the -challenge into a krb5\_responder\_otp\_challenge structure. The -{\hyperref[\detokenize{appdev/refs/api/krb5_responder_otp_set_answer:c.krb5_responder_otp_set_answer}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_responder\_otp\_set\_answer()}}}}} function selects one of the -token information elements from the challenge and supplies the value -and pin for that token. - - -\subsubsection{PKINIT password or PIN question} -\label{\detokenize{appdev/init_creds:pkinit-password-or-pin-question}} -\sphinxAtStartPar -The \sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_PKINIT}} (or \sphinxcode{\sphinxupquote{"pkinit"}}) question -type requests PINs for hardware devices and/or passwords for encrypted -credentials which are stored on disk, potentially also supplying -information about the state of the hardware devices. The challenge and -answer are JSON\sphinxhyphen{}encoded strings, but an application can use convenience -functions to avoid doing any JSON processing itself. - -\sphinxAtStartPar -The {\hyperref[\detokenize{appdev/refs/api/krb5_responder_pkinit_get_challenge:c.krb5_responder_pkinit_get_challenge}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_responder\_pkinit\_get\_challenge()}}}}} function decodes the -challenges into a krb5\_responder\_pkinit\_challenge structure. The -{\hyperref[\detokenize{appdev/refs/api/krb5_responder_pkinit_set_answer:c.krb5_responder_pkinit_set_answer}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_responder\_pkinit\_set\_answer()}}}}} function can be used to -supply the PIN or password for a particular client credential, and can -be called multiple times. - - -\subsubsection{Example} -\label{\detokenize{appdev/init_creds:example}} -\sphinxAtStartPar -Here is an example of using a responder callback: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{static} \PYG{n}{krb5\PYGZus{}error\PYGZus{}code} -\PYG{n}{my\PYGZus{}responder}\PYG{p}{(}\PYG{n}{krb5\PYGZus{}context} \PYG{n}{context}\PYG{p}{,} \PYG{n}{void} \PYG{o}{*}\PYG{n}{data}\PYG{p}{,} - \PYG{n}{krb5\PYGZus{}responder\PYGZus{}context} \PYG{n}{rctx}\PYG{p}{)} -\PYG{p}{\PYGZob{}} - \PYG{n}{krb5\PYGZus{}error\PYGZus{}code} \PYG{n}{ret}\PYG{p}{;} - \PYG{n}{krb5\PYGZus{}responder\PYGZus{}otp\PYGZus{}challenge} \PYG{o}{*}\PYG{n}{chl}\PYG{p}{;} - - \PYG{k}{if} \PYG{p}{(}\PYG{n}{krb5\PYGZus{}responder\PYGZus{}get\PYGZus{}challenge}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{rctx}\PYG{p}{,} - \PYG{n}{KRB5\PYGZus{}RESPONDER\PYGZus{}QUESTION\PYGZus{}PASSWORD}\PYG{p}{)}\PYG{p}{)} \PYG{p}{\PYGZob{}} - \PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}responder\PYGZus{}set\PYGZus{}answer}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{rctx}\PYG{p}{,} - \PYG{n}{KRB5\PYGZus{}RESPONDER\PYGZus{}QUESTION\PYGZus{}PASSWORD}\PYG{p}{,} - \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{open sesame}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{)}\PYG{p}{;} - \PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{k}{return} \PYG{n}{ret}\PYG{p}{;} - \PYG{p}{\PYGZcb{}} - \PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}responder\PYGZus{}otp\PYGZus{}get\PYGZus{}challenge}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{rctx}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{chl}\PYG{p}{)}\PYG{p}{;} - \PYG{k}{if} \PYG{p}{(}\PYG{n}{ret} \PYG{o}{==} \PYG{l+m+mi}{0} \PYG{o}{\PYGZam{}}\PYG{o}{\PYGZam{}} \PYG{n}{chl} \PYG{o}{!=} \PYG{n}{NULL}\PYG{p}{)} \PYG{p}{\PYGZob{}} - \PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}responder\PYGZus{}otp\PYGZus{}set\PYGZus{}answer}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{rctx}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{1234}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{,} - \PYG{n}{NULL}\PYG{p}{)}\PYG{p}{;} - \PYG{n}{krb5\PYGZus{}responder\PYGZus{}otp\PYGZus{}challenge\PYGZus{}free}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{rctx}\PYG{p}{,} \PYG{n}{chl}\PYG{p}{)}\PYG{p}{;} - \PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{k}{return} \PYG{n}{ret}\PYG{p}{;} - \PYG{p}{\PYGZcb{}} - \PYG{k}{return} \PYG{l+m+mi}{0}\PYG{p}{;} -\PYG{p}{\PYGZcb{}} - -\PYG{n}{static} \PYG{n}{krb5\PYGZus{}error\PYGZus{}code} -\PYG{n}{get\PYGZus{}creds}\PYG{p}{(}\PYG{n}{krb5\PYGZus{}context} \PYG{n}{context}\PYG{p}{,} \PYG{n}{krb5\PYGZus{}principal} \PYG{n}{client\PYGZus{}princ}\PYG{p}{)} -\PYG{p}{\PYGZob{}} - \PYG{n}{krb5\PYGZus{}error\PYGZus{}code} \PYG{n}{ret}\PYG{p}{;} - \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt} \PYG{o}{*}\PYG{n}{opt} \PYG{o}{=} \PYG{n}{NULL}\PYG{p}{;} - \PYG{n}{krb5\PYGZus{}creds} \PYG{n}{creds}\PYG{p}{;} - - \PYG{n}{memset}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{n}{sizeof}\PYG{p}{(}\PYG{n}{creds}\PYG{p}{)}\PYG{p}{)}\PYG{p}{;} - \PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}alloc}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{opt}\PYG{p}{)}\PYG{p}{;} - \PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{n}{goto} \PYG{n}{cleanup}\PYG{p}{;} - \PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}set\PYGZus{}responder}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{opt}\PYG{p}{,} \PYG{n}{my\PYGZus{}responder}\PYG{p}{,} - \PYG{n}{NULL}\PYG{p}{)}\PYG{p}{;} - \PYG{k}{if} \PYG{p}{(}\PYG{n}{ret}\PYG{p}{)} - \PYG{n}{goto} \PYG{n}{cleanup}\PYG{p}{;} - \PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}password}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{n}{client\PYGZus{}princ}\PYG{p}{,} - \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{opt}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{cleanup}\PYG{p}{:} - \PYG{n}{krb5\PYGZus{}get\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}free}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{n}{opt}\PYG{p}{)}\PYG{p}{;} - \PYG{n}{krb5\PYGZus{}free\PYGZus{}cred\PYGZus{}contents}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{)}\PYG{p}{;} - \PYG{k}{return} \PYG{n}{ret}\PYG{p}{;} -\PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - - -\section{Verifying initial credentials} -\label{\detokenize{appdev/init_creds:verifying-initial-credentials}} -\sphinxAtStartPar -Use the function {\hyperref[\detokenize{appdev/refs/api/krb5_verify_init_creds:c.krb5_verify_init_creds}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_verify\_init\_creds()}}}}} to verify initial -credentials. It takes an options structure (which can be a null -pointer). Use {\hyperref[\detokenize{appdev/refs/api/krb5_verify_init_creds_opt_init:c.krb5_verify_init_creds_opt_init}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_verify\_init\_creds\_opt\_init()}}}}} to initialize -the caller\sphinxhyphen{}allocated options structure, and -{\hyperref[\detokenize{appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail:c.krb5_verify_init_creds_opt_set_ap_req_nofail}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail()}}}}} to set the -“nofail” option. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5\PYGZus{}verify\PYGZus{}init\PYGZus{}creds\PYGZus{}opt} \PYG{n}{vopt}\PYG{p}{;} - -\PYG{n}{krb5\PYGZus{}verify\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}init}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{vopt}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{krb5\PYGZus{}verify\PYGZus{}init\PYGZus{}creds\PYGZus{}opt\PYGZus{}set\PYGZus{}ap\PYGZus{}req\PYGZus{}nofail}\PYG{p}{(}\PYG{o}{\PYGZam{}}\PYG{n}{vopt}\PYG{p}{,} \PYG{l+m+mi}{1}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{ret} \PYG{o}{=} \PYG{n}{krb5\PYGZus{}verify\PYGZus{}init\PYGZus{}creds}\PYG{p}{(}\PYG{n}{context}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{creds}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{n}{NULL}\PYG{p}{,} \PYG{o}{\PYGZam{}}\PYG{n}{vopt}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The confusingly named “nofail” option, when set, means that the -verification must actually succeed in order for -{\hyperref[\detokenize{appdev/refs/api/krb5_verify_init_creds:c.krb5_verify_init_creds}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_verify\_init\_creds()}}}}} to indicate success. The default -state of this option (cleared) means that if there is no key material -available to verify the user credentials, the verification will -succeed anyway. (The default can be changed by a configuration file -setting.) - -\sphinxAtStartPar -This accommodates a use case where a large number of unkeyed shared -desktop workstations need to allow users to log in using Kerberos. -The security risks from this practice are mitigated by the absence of -valuable state on the shared workstations—any valuable resources -that the users would access reside on networked servers. - -\sphinxstepscope - - -\chapter{Principal manipulation and parsing} -\label{\detokenize{appdev/princ_handle:principal-manipulation-and-parsing}}\label{\detokenize{appdev/princ_handle::doc}} -\sphinxAtStartPar -Kerberos principal structure - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_principal\_data}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_principal}}}}} - -\sphinxAtStartPar -Create and free principal - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_build_principal:c.krb5_build_principal}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_build\_principal()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_build_principal_alloc_va:c.krb5_build_principal_alloc_va}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_build\_principal\_alloc\_va()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_build_principal_ext:c.krb5_build_principal_ext}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_build\_principal\_ext()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_copy_principal:c.krb5_copy_principal}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_copy\_principal()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_free_principal:c.krb5_free_principal}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_free\_principal()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_cc_get_principal:c.krb5_cc_get_principal}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_cc\_get\_principal()}}}}} - -\sphinxAtStartPar -Comparing - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_principal_compare:c.krb5_principal_compare}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_principal\_compare()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_principal_compare_flags:c.krb5_principal_compare_flags}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_principal\_compare\_flags()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_principal_compare_any_realm:c.krb5_principal_compare_any_realm}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_principal\_compare\_any\_realm()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_sname_match:c.krb5_sname_match}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_sname\_match()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_sname_to_principal:c.krb5_sname_to_principal}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_sname\_to\_principal()}}}}} - -\sphinxAtStartPar -Parsing: - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_parse_name:c.krb5_parse_name}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_parse\_name()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_parse_name_flags:c.krb5_parse_name_flags}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_parse\_name\_flags()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_unparse_name:c.krb5_unparse_name}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_unparse\_name()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_unparse_name_flags:c.krb5_unparse_name_flags}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_unparse\_name\_flags()}}}}} - -\sphinxAtStartPar -Utilities: - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_is_config_principal:c.krb5_is_config_principal}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_is\_config\_principal()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_kuserok:c.krb5_kuserok}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_kuserok()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_set_password:c.krb5_set_password}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_set\_password()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_set_password_using_ccache:c.krb5_set_password_using_ccache}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_set\_password\_using\_ccache()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_set_principal_realm:c.krb5_set_principal_realm}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_set\_principal\_realm()}}}}} - -\sphinxAtStartPar -{\hyperref[\detokenize{appdev/refs/api/krb5_realm_compare:c.krb5_realm_compare}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_realm\_compare()}}}}} - -\sphinxstepscope - - -\chapter{Complete reference \sphinxhyphen{} API and datatypes} -\label{\detokenize{appdev/refs/index:complete-reference-api-and-datatypes}}\label{\detokenize{appdev/refs/index::doc}} -\sphinxstepscope - - -\section{krb5 API} -\label{\detokenize{appdev/refs/api/index:krb5-api}}\label{\detokenize{appdev/refs/api/index::doc}} - -\subsection{Frequently used public interfaces} -\label{\detokenize{appdev/refs/api/index:frequently-used-public-interfaces}} -\sphinxstepscope - - -\subsubsection{krb5\_build\_principal \sphinxhyphen{} Build a principal name using null\sphinxhyphen{}terminated strings.} -\label{\detokenize{appdev/refs/api/krb5_build_principal:krb5-build-principal-build-a-principal-name-using-null-terminated-strings}}\label{\detokenize{appdev/refs/api/krb5_build_principal::doc}}\index{krb5\_build\_principal (C function)@\spxentry{krb5\_build\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_build_principal:c.krb5_build_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_build\_principal}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{princ}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{rlen}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma \DUrole{p}{...}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{princ} \sphinxhyphen{} Principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rlen} \sphinxhyphen{} Realm name length - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Call krb5\_free\_principal() to free \sphinxstyleemphasis{princ} when it is no longer needed. - -\sphinxAtStartPar -Beginning with release 1.20, the name type of the principal will be inferred as \sphinxstylestrong{KRB5\_NT\_SRV\_INST} or \sphinxstylestrong{KRB5\_NT\_WELLKNOWN} based on the principal name. The type will be \sphinxstylestrong{KRB5\_NT\_PRINCIPAL} if a type cannot be inferred. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -krb5\_build\_principal() and krb5\_build\_principal\_alloc\_va() perform the same task. krb5\_build\_principal() takes variadic arguments. krb5\_build\_principal\_alloc\_va() takes a pre\sphinxhyphen{}computed \sphinxstyleemphasis{varargs} pointer. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_build\_principal\_alloc\_va \sphinxhyphen{} Build a principal name, using a precomputed variable argument list.} -\label{\detokenize{appdev/refs/api/krb5_build_principal_alloc_va:krb5-build-principal-alloc-va-build-a-principal-name-using-a-precomputed-variable-argument-list}}\label{\detokenize{appdev/refs/api/krb5_build_principal_alloc_va::doc}}\index{krb5\_build\_principal\_alloc\_va (C function)@\spxentry{krb5\_build\_principal\_alloc\_va}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_build_principal_alloc_va:c.krb5_build_principal_alloc_va}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_build\_principal\_alloc\_va}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{princ}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{rlen}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma \DUrole{n}{va\_list}\DUrole{w}{ }\DUrole{n}{ap}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{princ} \sphinxhyphen{} Principal structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rlen} \sphinxhyphen{} Realm name length - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ap} \sphinxhyphen{} List of char * components, ending with NULL - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Similar to krb5\_build\_principal(), this function builds a principal name, but its name components are specified as a va\_list. - -\sphinxAtStartPar -Use krb5\_free\_principal() to deallocate \sphinxstyleemphasis{princ} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_build\_principal\_ext \sphinxhyphen{} Build a principal name using length\sphinxhyphen{}counted strings.} -\label{\detokenize{appdev/refs/api/krb5_build_principal_ext:krb5-build-principal-ext-build-a-principal-name-using-length-counted-strings}}\label{\detokenize{appdev/refs/api/krb5_build_principal_ext::doc}}\index{krb5\_build\_principal\_ext (C function)@\spxentry{krb5\_build\_principal\_ext}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_build_principal_ext:c.krb5_build_principal_ext}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_build\_principal\_ext}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{princ}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{rlen}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma \DUrole{p}{...}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{princ} \sphinxhyphen{} Principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rlen} \sphinxhyphen{} Realm name length - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a principal from a length\sphinxhyphen{}counted string and a variable\sphinxhyphen{}length list of length\sphinxhyphen{}counted components. The list of components ends with the first 0 length argument (so it is not possible to specify an empty component with this function). Call krb5\_free\_principal() to free allocated memory for principal when it is no longer needed. - -\sphinxAtStartPar -Beginning with release 1.20, the name type of the principal will be inferred as \sphinxstylestrong{KRB5\_NT\_SRV\_INST} or \sphinxstylestrong{KRB5\_NT\_WELLKNOWN} based on the principal name. The type will be \sphinxstylestrong{KRB5\_NT\_PRINCIPAL} if a type cannot be inferred. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_close \sphinxhyphen{} Close a credential cache handle.} -\label{\detokenize{appdev/refs/api/krb5_cc_close:krb5-cc-close-close-a-credential-cache-handle}}\label{\detokenize{appdev/refs/api/krb5_cc_close::doc}}\index{krb5\_cc\_close (C function)@\spxentry{krb5\_cc\_close}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_close:c.krb5_cc_close}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_close}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function closes a credential cache handle \sphinxstyleemphasis{cache} without affecting the contents of the cache. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_default \sphinxhyphen{} Resolve the default credential cache name.} -\label{\detokenize{appdev/refs/api/krb5_cc_default:krb5-cc-default-resolve-the-default-credential-cache-name}}\label{\detokenize{appdev/refs/api/krb5_cc_default::doc}}\index{krb5\_cc\_default (C function)@\spxentry{krb5\_cc\_default}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_default:c.krb5_cc_default}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_default}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ccache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Pointer to credential cache name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KV5M\_CONTEXT Bad magic number for \_krb5\_context structure - -\item {} -\sphinxAtStartPar -KRB5\_FCC\_INTERNAL The name of the default credential cache cannot be obtained - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Create a handle to the default credential cache as given by krb5\_cc\_default\_name(). - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_default\_name \sphinxhyphen{} Return the name of the default credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_default_name:krb5-cc-default-name-return-the-name-of-the-default-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_default_name::doc}}\index{krb5\_cc\_default\_name (C function)@\spxentry{krb5\_cc\_default\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_default_name:c.krb5_cc_default_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_default\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Name of default credential cache for the current user. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Return a pointer to the default credential cache name for \sphinxstyleemphasis{context} , as determined by a prior call to krb5\_cc\_set\_default\_name(), by the KRB5CCNAME environment variable, by the default\_ccache\_name profile variable, or by the operating system or build\sphinxhyphen{}time default value. The returned value must not be modified or freed by the caller. The returned value becomes invalid when \sphinxstyleemphasis{context} is destroyed krb5\_free\_context() or if a subsequent call to krb5\_cc\_set\_default\_name() is made on \sphinxstyleemphasis{context} . - -\sphinxAtStartPar -The default credential cache name is cached in \sphinxstyleemphasis{context} between calls to this function, so if the value of KRB5CCNAME changes in the process environment after the first call to this function on, that change will not be reflected in later calls with the same context. The caller can invoke krb5\_cc\_set\_default\_name() with a NULL value of \sphinxstyleemphasis{name} to clear the cached value and force the default name to be recomputed. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_destroy \sphinxhyphen{} Destroy a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_destroy:krb5-cc-destroy-destroy-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_destroy::doc}}\index{krb5\_cc\_destroy (C function)@\spxentry{krb5\_cc\_destroy}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_destroy:c.krb5_cc_destroy}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_destroy}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Permission errors - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function destroys any existing contents of \sphinxstyleemphasis{cache} and closes the handle to it. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_dup \sphinxhyphen{} Duplicate ccache handle.} -\label{\detokenize{appdev/refs/api/krb5_cc_dup:krb5-cc-dup-duplicate-ccache-handle}}\label{\detokenize{appdev/refs/api/krb5_cc_dup::doc}}\index{krb5\_cc\_dup (C function)@\spxentry{krb5\_cc\_dup}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_dup:c.krb5_cc_dup}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_dup}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{in}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in} \sphinxhyphen{} Credential cache handle to be duplicated - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} - -\sphinxAtStartPar -Create a new handle referring to the same cache as \sphinxstyleemphasis{in} . The new handle and \sphinxstyleemphasis{in} can be closed independently. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_get\_name \sphinxhyphen{} Retrieve the name, but not type of a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_get_name:krb5-cc-get-name-retrieve-the-name-but-not-type-of-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_get_name::doc}}\index{krb5\_cc\_get\_name (C function)@\spxentry{krb5\_cc\_get\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_get_name:c.krb5_cc_get_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_get\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -On success \sphinxhyphen{} the name of the credential cache. - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{warning}{Warning:} -\sphinxAtStartPar -Returns the name of the credential cache. The result is an alias into \sphinxstyleemphasis{cache} and should not be freed or modified by the caller. This name does not include the cache type, so should not be used as input to krb5\_cc\_resolve(). -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_get\_principal \sphinxhyphen{} Get the default principal of a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_get_principal:krb5-cc-get-principal-get-the-default-principal-of-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_get_principal::doc}}\index{krb5\_cc\_get\_principal (C function)@\spxentry{krb5\_cc\_get\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_get_principal:c.krb5_cc_get_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_get\_principal}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{principal}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Primary principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Returns the default client principal of a credential cache as set by krb5\_cc\_initialize(). - -\sphinxAtStartPar -Use krb5\_free\_principal() to free \sphinxstyleemphasis{principal} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_get\_type \sphinxhyphen{} Retrieve the type of a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_get_type:krb5-cc-get-type-retrieve-the-type-of-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_get_type::doc}}\index{krb5\_cc\_get\_type (C function)@\spxentry{krb5\_cc\_get\_type}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_get_type:c.krb5_cc_get_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_get\_type}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -The type of a credential cache as an alias that must not be modified or freed by the caller. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_initialize \sphinxhyphen{} Initialize a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_initialize:krb5-cc-initialize-initialize-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_initialize::doc}}\index{krb5\_cc\_initialize (C function)@\spxentry{krb5\_cc\_initialize}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_initialize:c.krb5_cc_initialize}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_initialize}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Default principal name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -System errors; Permission errors; Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Destroy any existing contents of \sphinxstyleemphasis{cache} and initialize it for the default principal \sphinxstyleemphasis{principal} . - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_new\_unique \sphinxhyphen{} Create a new credential cache of the specified type with a unique name.} -\label{\detokenize{appdev/refs/api/krb5_cc_new_unique:krb5-cc-new-unique-create-a-new-credential-cache-of-the-specified-type-with-a-unique-name}}\label{\detokenize{appdev/refs/api/krb5_cc_new_unique::doc}}\index{krb5\_cc\_new\_unique (C function)@\spxentry{krb5\_cc\_new\_unique}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_new_unique:c.krb5_cc_new_unique}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_new\_unique}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{type}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{hint}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{id}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{type} \sphinxhyphen{} Credential cache type name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{hint} \sphinxhyphen{} Unused - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{id} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_resolve \sphinxhyphen{} Resolve a credential cache name.} -\label{\detokenize{appdev/refs/api/krb5_cc_resolve:krb5-cc-resolve-resolve-a-credential-cache-name}}\label{\detokenize{appdev/refs/api/krb5_cc_resolve::doc}}\index{krb5\_cc\_resolve (C function)@\spxentry{krb5\_cc\_resolve}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_resolve:c.krb5_cc_resolve}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_resolve}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{name} \sphinxhyphen{} Credential cache name to be resolved - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Fills in \sphinxstyleemphasis{cache} with a \sphinxstyleemphasis{cache} handle that corresponds to the name in \sphinxstyleemphasis{name} . \sphinxstyleemphasis{name} should be of the form \sphinxstylestrong{type:residual} , and \sphinxstyleemphasis{type} must be a type known to the library. If the \sphinxstyleemphasis{name} does not contain a colon, interpret it as a file name. - -\sphinxstepscope - - -\subsubsection{krb5\_change\_password \sphinxhyphen{} Change a password for an existing Kerberos account.} -\label{\detokenize{appdev/refs/api/krb5_change_password:krb5-change-password-change-a-password-for-an-existing-kerberos-account}}\label{\detokenize{appdev/refs/api/krb5_change_password::doc}}\index{krb5\_change\_password (C function)@\spxentry{krb5\_change\_password}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_change_password:c.krb5_change_password}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_change\_password}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{newpw}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_code}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_code\_string}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_string}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Credentials for kadmin/changepw service - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{newpw} \sphinxhyphen{} New password - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_code} \sphinxhyphen{} Numeric error code from server - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_code\_string} \sphinxhyphen{} String equivalent to \sphinxstyleemphasis{result\_code} - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_string} \sphinxhyphen{} Change password response from the KDC - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Change the password for the existing principal identified by \sphinxstyleemphasis{creds} . - -\sphinxAtStartPar -The possible values of the output \sphinxstyleemphasis{result\_code} are: -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_KPASSWD\_SUCCESS (0) \sphinxhyphen{} success - -\item {} -\sphinxAtStartPar -KRB5\_KPASSWD\_MALFORMED (1) \sphinxhyphen{} Malformed request error - -\item {} -\sphinxAtStartPar -KRB5\_KPASSWD\_HARDERROR (2) \sphinxhyphen{} Server error - -\item {} -\sphinxAtStartPar -KRB5\_KPASSWD\_AUTHERROR (3) \sphinxhyphen{} Authentication error - -\item {} -\sphinxAtStartPar -KRB5\_KPASSWD\_SOFTERROR (4) \sphinxhyphen{} Password change rejected - -\end{itemize} - -\sphinxstepscope - - -\subsubsection{krb5\_chpw\_message \sphinxhyphen{} Get a result message for changing or setting a password.} -\label{\detokenize{appdev/refs/api/krb5_chpw_message:krb5-chpw-message-get-a-result-message-for-changing-or-setting-a-password}}\label{\detokenize{appdev/refs/api/krb5_chpw_message::doc}}\index{krb5\_chpw\_message (C function)@\spxentry{krb5\_chpw\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_chpw_message:c.krb5_chpw_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_chpw\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{server\_string}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{message\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server\_string} \sphinxhyphen{} Data returned from the remote system - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{message\_out} \sphinxhyphen{} A message displayable to the user - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function processes the \sphinxstyleemphasis{server\_string} returned in the \sphinxstyleemphasis{result\_string} parameter of krb5\_change\_password(), krb5\_set\_password(), and related functions, and returns a displayable string. If \sphinxstyleemphasis{server\_string} contains Active Directory structured policy information, it will be converted into human\sphinxhyphen{}readable text. - -\sphinxAtStartPar -Use krb5\_free\_string() to free \sphinxstyleemphasis{message\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_expand\_hostname \sphinxhyphen{} Canonicalize a hostname, possibly using name service.} -\label{\detokenize{appdev/refs/api/krb5_expand_hostname:krb5-expand-hostname-canonicalize-a-hostname-possibly-using-name-service}}\label{\detokenize{appdev/refs/api/krb5_expand_hostname::doc}}\index{krb5\_expand\_hostname (C function)@\spxentry{krb5\_expand\_hostname}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_expand_hostname:c.krb5_expand_hostname}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_expand\_hostname}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{host}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{canonhost\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{host} \sphinxhyphen{} Input hostname - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{canonhost\_out} \sphinxhyphen{} Canonicalized hostname - -\end{description}\end{quote} - -\sphinxAtStartPar -This function canonicalizes orig\_hostname, possibly using name service lookups if configuration permits. Use krb5\_free\_string() to free \sphinxstyleemphasis{canonhost\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.15 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_config\_files \sphinxhyphen{} Free a list allocated by krb5\_get\_default\_config\_files()} -\label{\detokenize{appdev/refs/api/krb5_free_config_files:krb5-free-config-files-free-a-list-allocated-by-krb5-get-default-config-files}}\label{\detokenize{appdev/refs/api/krb5_free_config_files::doc}}\index{krb5\_free\_config\_files (C function)@\spxentry{krb5\_free\_config\_files}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_config_files:c.krb5_free_config_files}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_config\_files}}}}{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{filenames}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{filenames} \sphinxhyphen{} Configuration filename list - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.22 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_context \sphinxhyphen{} Free a krb5 library context.} -\label{\detokenize{appdev/refs/api/krb5_free_context:krb5-free-context-free-a-krb5-library-context}}\label{\detokenize{appdev/refs/api/krb5_free_context::doc}}\index{krb5\_free\_context (C function)@\spxentry{krb5\_free\_context}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_context:c.krb5_free_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_context}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees a \sphinxstyleemphasis{context} that was created by krb5\_init\_context() or krb5\_init\_secure\_context(). - -\sphinxstepscope - - -\subsubsection{krb5\_free\_error\_message \sphinxhyphen{} Free an error message generated by krb5\_get\_error\_message().} -\label{\detokenize{appdev/refs/api/krb5_free_error_message:krb5-free-error-message-free-an-error-message-generated-by-krb5-get-error-message}}\label{\detokenize{appdev/refs/api/krb5_free_error_message::doc}}\index{krb5\_free\_error\_message (C function)@\spxentry{krb5\_free\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_error_message:c.krb5_free_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{msg}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{msg} \sphinxhyphen{} Pointer to error message - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_principal \sphinxhyphen{} Free the storage assigned to a principal.} -\label{\detokenize{appdev/refs/api/krb5_free_principal:krb5-free-principal-free-the-storage-assigned-to-a-principal}}\label{\detokenize{appdev/refs/api/krb5_free_principal::doc}}\index{krb5\_free\_principal (C function)@\spxentry{krb5\_free\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_principal:c.krb5_free_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_principal}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Principal to be freed - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_fwd\_tgt\_creds \sphinxhyphen{} Get a forwarded TGT and format a KRB\sphinxhyphen{}CRED message.} -\label{\detokenize{appdev/refs/api/krb5_fwd_tgt_creds:krb5-fwd-tgt-creds-get-a-forwarded-tgt-and-format-a-krb-cred-message}}\label{\detokenize{appdev/refs/api/krb5_fwd_tgt_creds::doc}}\index{krb5\_fwd\_tgt\_creds (C function)@\spxentry{krb5\_fwd\_tgt\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_fwd_tgt_creds:c.krb5_fwd_tgt_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_fwd\_tgt\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rhost}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{client}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{server}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cc}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{forwardable}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{outbuf}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rhost} \sphinxhyphen{} Remote host - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client} \sphinxhyphen{} Client principal of TGT - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Principal of server to receive TGT - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cc} \sphinxhyphen{} Credential cache handle (NULL to use default) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{forwardable} \sphinxhyphen{} Whether TGT should be forwardable - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outbuf} \sphinxhyphen{} KRB\sphinxhyphen{}CRED message - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -ENOMEM Insufficient memory - -\item {} -\sphinxAtStartPar -KRB5\_PRINC\_NOMATCH Requested principal and ticket do not match - -\item {} -\sphinxAtStartPar -KRB5\_NO\_TKT\_SUPPLIED Request did not supply a ticket - -\item {} -\sphinxAtStartPar -KRB5\_CC\_BADNAME Credential cache name or principal name malformed - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Get a TGT for use at the remote host \sphinxstyleemphasis{rhost} and format it into a KRB\sphinxhyphen{}CRED message. If \sphinxstyleemphasis{rhost} is NULL and \sphinxstyleemphasis{server} is of type KRB5\_NT\_SRV\_HST, the second component of \sphinxstyleemphasis{server} will be used. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_default\_realm \sphinxhyphen{} Retrieve the default realm.} -\label{\detokenize{appdev/refs/api/krb5_get_default_realm:krb5-get-default-realm-retrieve-the-default-realm}}\label{\detokenize{appdev/refs/api/krb5_get_default_realm::doc}}\index{krb5\_get\_default\_realm (C function)@\spxentry{krb5\_get\_default\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_default_realm:c.krb5_get_default_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_default\_realm}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{lrealm}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{lrealm} \sphinxhyphen{} Default realm name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Retrieves the default realm to be used if no user\sphinxhyphen{}specified realm is available. - -\sphinxAtStartPar -Use krb5\_free\_default\_realm() to free \sphinxstyleemphasis{lrealm} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_error\_message \sphinxhyphen{} Get the (possibly extended) error message for a code.} -\label{\detokenize{appdev/refs/api/krb5_get_error_message:krb5-get-error-message-get-the-possibly-extended-error-message-for-a-code}}\label{\detokenize{appdev/refs/api/krb5_get_error_message::doc}}\index{krb5\_get\_error\_message (C function)@\spxentry{krb5\_get\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_error_message:c.krb5_get_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{code}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{code} \sphinxhyphen{} Error code - -\end{description}\end{quote} - -\sphinxAtStartPar -The behavior of krb5\_get\_error\_message() is only defined the first time it is called after a failed call to a krb5 function using the same context, and only when the error code passed in is the same as that returned by the krb5 function. - -\sphinxAtStartPar -This function never returns NULL, so its result may be used unconditionally as a C string. - -\sphinxAtStartPar -The string returned by this function must be freed using krb5\_free\_error\_message() - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Future versions may return the same string for the second and following calls. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_host\_realm \sphinxhyphen{} Get the Kerberos realm names for a host.} -\label{\detokenize{appdev/refs/api/krb5_get_host_realm:krb5-get-host-realm-get-the-kerberos-realm-names-for-a-host}}\label{\detokenize{appdev/refs/api/krb5_get_host_realm::doc}}\index{krb5\_get\_host\_realm (C function)@\spxentry{krb5\_get\_host\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_host_realm:c.krb5_get_host_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_host\_realm}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{host}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{realmsp}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{host} \sphinxhyphen{} Host name (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{realmsp} \sphinxhyphen{} Null\sphinxhyphen{}terminated list of realm names - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -ENOMEM Insufficient memory - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Fill in \sphinxstyleemphasis{realmsp} with a pointer to a null\sphinxhyphen{}terminated list of realm names. If there are no known realms for the host, a list containing the referral (empty) realm is returned. - -\sphinxAtStartPar -If \sphinxstyleemphasis{host} is NULL, the local host’s realms are determined. - -\sphinxAtStartPar -Use krb5\_free\_host\_realm() to release \sphinxstyleemphasis{realmsp} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_credentials \sphinxhyphen{} Get an additional ticket.} -\label{\detokenize{appdev/refs/api/krb5_get_credentials:krb5-get-credentials-get-an-additional-ticket}}\label{\detokenize{appdev/refs/api/krb5_get_credentials::doc}}\index{krb5\_get\_credentials (C function)@\spxentry{krb5\_get\_credentials}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_credentials:c.krb5_get_credentials}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_credentials}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{out\_creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{options} \sphinxhyphen{} Options - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_creds} \sphinxhyphen{} Input credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out\_creds} \sphinxhyphen{} Output updated credentials - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use \sphinxstyleemphasis{ccache} or a TGS exchange to get a service ticket matching \sphinxstyleemphasis{in\_creds} . - -\sphinxAtStartPar -Valid values for \sphinxstyleemphasis{options} are: -\begin{quote} -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_GC\_CACHED Search only credential cache for the ticket - -\item {} -\sphinxAtStartPar -KRB5\_GC\_USER\_USER Return a user to user authentication ticket - -\end{itemize} - -\sphinxAtStartPar -\sphinxstyleemphasis{in\_creds} must be non\sphinxhyphen{}null. \sphinxstyleemphasis{in\_creds\sphinxhyphen{}\textgreater{}client} and \sphinxstyleemphasis{in\_creds\sphinxhyphen{}\textgreater{}server} must be filled in to specify the client and the server respectively. If any authorization data needs to be requested for the service ticket (such as restrictions on how the ticket can be used), specify it in \sphinxstyleemphasis{in\_creds\sphinxhyphen{}\textgreater{}authdata} ; otherwise set \sphinxstyleemphasis{in\_creds\sphinxhyphen{}\textgreater{}authdata} to NULL. The session key type is specified in \sphinxstyleemphasis{in\_creds\sphinxhyphen{}\textgreater{}keyblock.enctype} , if it is nonzero. -\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{in\_creds\sphinxhyphen{}\textgreater{}times.endtime} is specified, it is used as the requested expiration date if a TGS request is made. If \sphinxstyleemphasis{in\_creds\sphinxhyphen{}\textgreater{}times.endtime} is set to 0, the latest possible expiration date will be requested. The KDC or cache may return a ticket with an earlier expiration date. - -\sphinxAtStartPar -Any returned ticket and intermediate ticket\sphinxhyphen{}granting tickets are stored in \sphinxstyleemphasis{ccache} . - -\sphinxAtStartPar -Use krb5\_free\_creds() to free \sphinxstyleemphasis{out\_creds} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_default\_config\_files \sphinxhyphen{} Return a list of default configuration filenames.} -\label{\detokenize{appdev/refs/api/krb5_get_default_config_files:krb5-get-default-config-files-return-a-list-of-default-configuration-filenames}}\label{\detokenize{appdev/refs/api/krb5_get_default_config_files::doc}}\index{krb5\_get\_default\_config\_files (C function)@\spxentry{krb5\_get\_default\_config\_files}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_default_config_files:c.krb5_get_default_config_files}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_default\_config\_files}}}}{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{filenames}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{filenames} \sphinxhyphen{} Configuration filename list - -\end{description}\end{quote} - -\sphinxAtStartPar -Fill in \sphinxstyleemphasis{filenames} with a null\sphinxhyphen{}terminated list of configuration files which will be read by krb5\_init\_context() in the current process environment. - -\sphinxAtStartPar -Use krb5\_free\_config\_files() to free \sphinxstyleemphasis{filenames} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.22 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_fallback\_host\_realm} -\label{\detokenize{appdev/refs/api/krb5_get_fallback_host_realm:krb5-get-fallback-host-realm}}\label{\detokenize{appdev/refs/api/krb5_get_fallback_host_realm::doc}}\index{krb5\_get\_fallback\_host\_realm (C function)@\spxentry{krb5\_get\_fallback\_host\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_fallback_host_realm:c.krb5_get_fallback_host_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_fallback\_host\_realm}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{hdata}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{realmsp}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{hdata} \sphinxhyphen{} Host name (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{realmsp} \sphinxhyphen{} Null\sphinxhyphen{}terminated list of realm names - -\end{description}\end{quote} - -\sphinxAtStartPar -Fill in \sphinxstyleemphasis{realmsp} with a pointer to a null\sphinxhyphen{}terminated list of realm names obtained through heuristics or insecure resolution methods which have lower priority than KDC referrals. - -\sphinxAtStartPar -If \sphinxstyleemphasis{host} is NULL, the local host’s realms are determined. - -\sphinxAtStartPar -Use krb5\_free\_host\_realm() to release \sphinxstyleemphasis{realmsp} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_keytab \sphinxhyphen{} Get initial credentials using a key table.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_keytab:krb5-get-init-creds-keytab-get-initial-credentials-using-a-key-table}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_keytab::doc}}\index{krb5\_get\_init\_creds\_keytab (C function)@\spxentry{krb5\_get\_init\_creds\_keytab}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_keytab:c.krb5_get_init_creds_keytab}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_keytab}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{client}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{arg\_keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\DUrole{n}{start\_time}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_tkt\_service}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k5\_gic\_options}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds} \sphinxhyphen{} New credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client} \sphinxhyphen{} Client principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{arg\_keytab} \sphinxhyphen{} Key table handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{start\_time} \sphinxhyphen{} Time when ticket becomes valid (0 for now) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_tkt\_service} \sphinxhyphen{} Service name of initial credentials (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{k5\_gic\_options} \sphinxhyphen{} Initial credential options - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function requests KDC for an initial credentials for \sphinxstyleemphasis{client} using a client key stored in \sphinxstyleemphasis{arg\_keytab} . If \sphinxstyleemphasis{in\_tkt\_service} is specified, it is parsed as a principal name (with the realm ignored) and used as the service principal for the request; otherwise the ticket\sphinxhyphen{}granting service is used. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_alloc \sphinxhyphen{} Allocate a new initial credential options structure.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_alloc:krb5-get-init-creds-opt-alloc-allocate-a-new-initial-credential-options-structure}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_alloc::doc}}\index{krb5\_get\_init\_creds\_opt\_alloc (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_alloc}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_alloc:c.krb5_get_init_creds_opt_alloc}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_alloc}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{opt}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{opt} \sphinxhyphen{} New options structure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 \sphinxhyphen{} Success; Kerberos errors otherwise. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is the preferred way to create an options structure for getting initial credentials, and is required to make use of certain options. Use krb5\_get\_init\_creds\_opt\_free() to free \sphinxstyleemphasis{opt} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_free \sphinxhyphen{} Free initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_free:krb5-get-init-creds-opt-free-free-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_free::doc}}\index{krb5\_get\_init\_creds\_opt\_free (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_free}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_free:c.krb5_get_init_creds_opt_free}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_free}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure to free - -\end{description}\end{quote} - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_get\_init\_creds\_opt\_alloc() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_get\_fast\_flags \sphinxhyphen{} Retrieve FAST flags from initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags:krb5-get-init-creds-opt-get-fast-flags-retrieve-fast-flags-from-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags::doc}}\index{krb5\_get\_init\_creds\_opt\_get\_fast\_flags (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_get\_fast\_flags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_get_fast_flags:c.krb5_get_init_creds_opt_get_fast_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_get\_fast\_flags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{out\_flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out\_flags} \sphinxhyphen{} FAST flags - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 \sphinxhyphen{} Success; Kerberos errors otherwise. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_address\_list \sphinxhyphen{} Set address restrictions in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_address_list:krb5-get-init-creds-opt-set-address-list-set-address-restrictions-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_address_list::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_address\_list (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_address\_list}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_address_list:c.krb5_get_init_creds_opt_set_address_list}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_address\_list}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{addresses}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{addresses} \sphinxhyphen{} Null\sphinxhyphen{}terminated array of addresses - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_anonymous \sphinxhyphen{} Set or unset the anonymous flag in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_anonymous:krb5-get-init-creds-opt-set-anonymous-set-or-unset-the-anonymous-flag-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_anonymous::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_anonymous (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_anonymous}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_anonymous:c.krb5_get_init_creds_opt_set_anonymous}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_anonymous}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{anonymous}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{anonymous} \sphinxhyphen{} Whether to make an anonymous request - -\end{description}\end{quote} - -\sphinxAtStartPar -This function may be used to request anonymous credentials from the KDC by setting \sphinxstyleemphasis{anonymous} to non\sphinxhyphen{}zero. Note that anonymous credentials are only a request; clients must verify that credentials are anonymous if that is a requirement. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_canonicalize \sphinxhyphen{} Set or unset the canonicalize flag in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize:krb5-get-init-creds-opt-set-canonicalize-set-or-unset-the-canonicalize-flag-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_canonicalize (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_canonicalize}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_canonicalize:c.krb5_get_init_creds_opt_set_canonicalize}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_canonicalize}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{canonicalize}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{canonicalize} \sphinxhyphen{} Whether to canonicalize client principal - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_change\_password\_prompt \sphinxhyphen{} Set or unset change\sphinxhyphen{}password\sphinxhyphen{}prompt flag in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt:krb5-get-init-creds-opt-set-change-password-prompt-set-or-unset-change-password-prompt-flag-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_change\_password\_prompt (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_change\_password\_prompt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_change_password_prompt:c.krb5_get_init_creds_opt_set_change_password_prompt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_change\_password\_prompt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{prompt}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{prompt} \sphinxhyphen{} Whether to prompt to change password - -\end{description}\end{quote} - -\sphinxAtStartPar -This flag is on by default. It controls whether krb5\_get\_init\_creds\_password() will react to an expired\sphinxhyphen{}password error by prompting for a new password and attempting to change the old one. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_etype\_list \sphinxhyphen{} Set allowable encryption types in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_etype_list:krb5-get-init-creds-opt-set-etype-list-set-allowable-encryption-types-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_etype_list::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_etype\_list (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_etype\_list}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_etype_list:c.krb5_get_init_creds_opt_set_etype_list}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_etype\_list}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{etype\_list}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{etype\_list\_length}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{etype\_list} \sphinxhyphen{} Array of encryption types - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{etype\_list\_length} \sphinxhyphen{} Length of \sphinxstyleemphasis{etype\_list} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_expire\_callback \sphinxhyphen{} Set an expiration callback in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback:krb5-get-init-creds-opt-set-expire-callback-set-an-expiration-callback-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_expire\_callback (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_expire\_callback}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_expire_callback:c.krb5_get_init_creds_opt_set_expire_callback}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_expire\_callback}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_expire_callback_func:c.krb5_expire_callback_func}]{\sphinxcrossref{\DUrole{n}{krb5\_expire\_callback\_func}}}}\DUrole{w}{ }\DUrole{n}{cb}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cb} \sphinxhyphen{} Callback function - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Callback argument - -\end{description}\end{quote} - -\sphinxAtStartPar -Set a callback to receive password and account expiration times. -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{cb} will be invoked if and only if credentials are successfully acquired. The callback will receive the \sphinxstyleemphasis{context} from the calling function and the \sphinxstyleemphasis{data} argument supplied with this API. The remaining arguments should be interpreted as follows: -\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{is\_last\_req} is true, then the KDC reply contained last\sphinxhyphen{}req entries which unambiguously indicated the password expiration, account expiration, or both. (If either value was not present, the corresponding argument will be 0.) Furthermore, a non\sphinxhyphen{}zero \sphinxstyleemphasis{password\_expiration} should be taken as a suggestion from the KDC that a warning be displayed. - -\sphinxAtStartPar -If \sphinxstyleemphasis{is\_last\_req} is false, then \sphinxstyleemphasis{account\_expiration} will be 0 and \sphinxstyleemphasis{password\_expiration} will contain the expiration time of either the password or account, or 0 if no expiration time was indicated in the KDC reply. The callback should independently decide whether to display a password expiration warning. - -\sphinxAtStartPar -Note that \sphinxstyleemphasis{cb} may be invoked even if credentials are being acquired for the kadmin/changepw service in order to change the password. It is the caller’s responsibility to avoid displaying a password expiry warning in this case. - -\begin{sphinxadmonition}{warning}{Warning:} -\sphinxAtStartPar -Setting an expire callback with this API will cause krb5\_get\_init\_creds\_password() not to send password expiry warnings to the prompter, as it ordinarily may. -\end{sphinxadmonition} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_fast\_ccache \sphinxhyphen{} Set FAST armor cache in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache:krb5-get-init-creds-opt-set-fast-ccache-set-fast-armor-cache-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_fast\_ccache (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_fast\_ccache}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache:c.krb5_get_init_creds_opt_set_fast_ccache}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_fast\_ccache}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_get\_init\_creds\_opt\_set\_fast\_ccache\_name(), but uses a credential cache handle instead of a name. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_fast\_ccache\_name \sphinxhyphen{} Set location of FAST armor ccache in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name:krb5-get-init-creds-opt-set-fast-ccache-name-set-location-of-fast-armor-ccache-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_fast\_ccache\_name (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_fast\_ccache\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_ccache_name:c.krb5_get_init_creds_opt_set_fast_ccache_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_fast\_ccache\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{fast\_ccache\_name}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fast\_ccache\_name} \sphinxhyphen{} Credential cache name - -\end{description}\end{quote} - -\sphinxAtStartPar -Sets the location of a credential cache containing an armor ticket to protect an initial credential exchange using the FAST protocol extension. - -\sphinxAtStartPar -In version 1.7, setting an armor ccache requires that FAST be used for the exchange. In version 1.8 or later, setting the armor ccache causes FAST to be used if the KDC supports it; krb5\_get\_init\_creds\_opt\_set\_fast\_flags() must be used to require that FAST be used. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_fast\_flags \sphinxhyphen{} Set FAST flags in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags:krb5-get-init-creds-opt-set-fast-flags-set-fast-flags-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_fast\_flags (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_fast\_flags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_fast_flags:c.krb5_get_init_creds_opt_set_fast_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_fast\_flags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} FAST flags - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 \sphinxhyphen{} Success; Kerberos errors otherwise. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The following flag values are valid: -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_FAST\_REQUIRED \sphinxhyphen{} Require FAST to be used - -\end{itemize} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_forwardable \sphinxhyphen{} Set or unset the forwardable flag in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_forwardable:krb5-get-init-creds-opt-set-forwardable-set-or-unset-the-forwardable-flag-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_forwardable::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_forwardable (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_forwardable}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_forwardable:c.krb5_get_init_creds_opt_set_forwardable}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_forwardable}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{forwardable}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{forwardable} \sphinxhyphen{} Whether credentials should be forwardable - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_in\_ccache \sphinxhyphen{} Set an input credential cache in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache:krb5-get-init-creds-opt-set-in-ccache-set-an-input-credential-cache-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_in\_ccache (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_in\_ccache}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_in_ccache:c.krb5_get_init_creds_opt_set_in_ccache}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_in\_ccache}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} - -\sphinxAtStartPar -If an input credential cache is set, then the krb5\_get\_init\_creds family of APIs will read settings from it. Setting an input ccache is desirable when the application wishes to perform authentication in the same way (using the same preauthentication mechanisms, and making the same non\sphinxhyphen{}security\sphinxhyphen{} sensitive choices) as the previous authentication attempt, which stored information in the passed\sphinxhyphen{}in ccache. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_out\_ccache \sphinxhyphen{} Set an output credential cache in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache:krb5-get-init-creds-opt-set-out-ccache-set-an-output-credential-cache-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_out\_ccache (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_out\_ccache}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_out_ccache:c.krb5_get_init_creds_opt_set_out_ccache}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_out\_ccache}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} - -\sphinxAtStartPar -If an output credential cache is set, then the krb5\_get\_init\_creds family of APIs will write credentials to it. Setting an output ccache is desirable both because it simplifies calling code and because it permits the krb5\_get\_init\_creds APIs to write out configuration information about the realm to the ccache. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_pa \sphinxhyphen{} Supply options for preauthentication in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_pa:krb5-get-init-creds-opt-set-pa-supply-options-for-preauthentication-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_pa::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_pa (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_pa}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_pa:c.krb5_get_init_creds_opt_set_pa}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_pa}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{attr}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{value}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{attr} \sphinxhyphen{} Preauthentication option name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{value} \sphinxhyphen{} Preauthentication option value - -\end{description}\end{quote} - -\sphinxAtStartPar -This function allows the caller to supply options for preauthentication. The values of \sphinxstyleemphasis{attr} and \sphinxstyleemphasis{value} are supplied to each preauthentication module available within \sphinxstyleemphasis{context} . - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_pac\_request \sphinxhyphen{} Ask the KDC to include or not include a PAC in the ticket.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_pac_request:krb5-get-init-creds-opt-set-pac-request-ask-the-kdc-to-include-or-not-include-a-pac-in-the-ticket}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_pac_request::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_pac\_request (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_pac\_request}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_pac_request:c.krb5_get_init_creds_opt_set_pac_request}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_pac\_request}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{n}{req\_pac}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{req\_pac} \sphinxhyphen{} Whether to request a PAC or not - -\end{description}\end{quote} - -\sphinxAtStartPar -If this option is set, the AS request will include a PAC\sphinxhyphen{}REQUEST pa\sphinxhyphen{}data item explicitly asking the KDC to either include or not include a privilege attribute certificate in the ticket authorization data. By default, no request is made; typically the KDC will default to including a PAC if it supports them. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.15 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_preauth\_list \sphinxhyphen{} Set preauthentication types in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list:krb5-get-init-creds-opt-set-preauth-list-set-preauthentication-types-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_preauth\_list (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_preauth\_list}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_preauth_list:c.krb5_get_init_creds_opt_set_preauth_list}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_preauth\_list}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_preauthtype:c.krb5_preauthtype}]{\sphinxcrossref{\DUrole{n}{krb5\_preauthtype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{preauth\_list}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{preauth\_list\_length}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{preauth\_list} \sphinxhyphen{} Array of preauthentication types - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{preauth\_list\_length} \sphinxhyphen{} Length of \sphinxstyleemphasis{preauth\_list} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function can be used to perform optimistic preauthentication when getting initial credentials, in combination with krb5\_get\_init\_creds\_opt\_set\_salt() and krb5\_get\_init\_creds\_opt\_set\_pa(). - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_proxiable \sphinxhyphen{} Set or unset the proxiable flag in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_proxiable:krb5-get-init-creds-opt-set-proxiable-set-or-unset-the-proxiable-flag-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_proxiable::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_proxiable (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_proxiable}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_proxiable:c.krb5_get_init_creds_opt_set_proxiable}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_proxiable}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{proxiable}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{proxiable} \sphinxhyphen{} Whether credentials should be proxiable - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_renew\_life \sphinxhyphen{} Set the ticket renewal lifetime in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_renew_life:krb5-get-init-creds-opt-set-renew-life-set-the-ticket-renewal-lifetime-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_renew_life::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_renew\_life (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_renew\_life}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_renew_life:c.krb5_get_init_creds_opt_set_renew_life}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_renew\_life}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\DUrole{n}{renew\_life}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Pointer to \sphinxstyleemphasis{options} field - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{renew\_life} \sphinxhyphen{} Ticket renewal lifetime - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_responder \sphinxhyphen{} Set the responder function in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_responder:krb5-get-init-creds-opt-set-responder-set-the-responder-function-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_responder::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_responder (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_responder}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_responder:c.krb5_get_init_creds_opt_set_responder}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_responder}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_fn:c.krb5_responder_fn}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_fn}}}}\DUrole{w}{ }\DUrole{n}{responder}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{responder} \sphinxhyphen{} Responder function - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Responder data argument - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_salt \sphinxhyphen{} Set salt for optimistic preauthentication in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_salt:krb5-get-init-creds-opt-set-salt-set-salt-for-optimistic-preauthentication-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_salt::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_salt (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_salt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_salt:c.krb5_get_init_creds_opt_set_salt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_salt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{salt}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{salt} \sphinxhyphen{} Salt data - -\end{description}\end{quote} - -\sphinxAtStartPar -When getting initial credentials with a password, a salt string it used to convert the password to a key. Normally this salt is obtained from the first KDC reply, but when performing optimistic preauthentication, the client may need to supply the salt string with this function. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_set\_tkt\_life \sphinxhyphen{} Set the ticket lifetime in initial credential options.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life:krb5-get-init-creds-opt-set-tkt-life-set-the-ticket-lifetime-in-initial-credential-options}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life::doc}}\index{krb5\_get\_init\_creds\_opt\_set\_tkt\_life (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_set\_tkt\_life}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_set_tkt_life:c.krb5_get_init_creds_opt_set_tkt_life}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_set\_tkt\_life}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\DUrole{n}{tkt\_life}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{tkt\_life} \sphinxhyphen{} Ticket lifetime - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_password \sphinxhyphen{} Get initial credentials using a password.} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_password:krb5-get-init-creds-password-get-initial-credentials-using-a-password}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_password::doc}}\index{krb5\_get\_init\_creds\_password (C function)@\spxentry{krb5\_get\_init\_creds\_password}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_password:c.krb5_get_init_creds_password}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_password}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{client}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{password}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_prompter_fct:c.krb5_prompter_fct}]{\sphinxcrossref{\DUrole{n}{krb5\_prompter\_fct}}}}\DUrole{w}{ }\DUrole{n}{prompter}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\DUrole{n}{start\_time}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_tkt\_service}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k5\_gic\_options}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds} \sphinxhyphen{} New credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client} \sphinxhyphen{} Client principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{password} \sphinxhyphen{} Password (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{prompter} \sphinxhyphen{} Prompter function - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Prompter callback data - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{start\_time} \sphinxhyphen{} Time when ticket becomes valid (0 for now) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_tkt\_service} \sphinxhyphen{} Service name of initial credentials (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{k5\_gic\_options} \sphinxhyphen{} Initial credential options - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -EINVAL Invalid argument - -\item {} -\sphinxAtStartPar -KRB5\_KDC\_UNREACH Cannot contact any KDC for requested realm - -\item {} -\sphinxAtStartPar -KRB5\_PREAUTH\_FAILED Generic Pre\sphinxhyphen{}athentication failure - -\item {} -\sphinxAtStartPar -KRB5\_LIBOS\_PWDINTR Password read interrupted - -\item {} -\sphinxAtStartPar -KRB5\_REALM\_CANT\_RESOLVE Cannot resolve network address for KDC in requested realm - -\item {} -\sphinxAtStartPar -KRB5KDC\_ERR\_KEY\_EXP Password has expired - -\item {} -\sphinxAtStartPar -KRB5\_LIBOS\_BADPWDMATCH Password mismatch - -\item {} -\sphinxAtStartPar -KRB5\_CHPW\_PWDNULL New password cannot be zero length - -\item {} -\sphinxAtStartPar -KRB5\_CHPW\_FAIL Password change failed - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function requests KDC for an initial credentials for \sphinxstyleemphasis{client} using \sphinxstyleemphasis{password} . If \sphinxstyleemphasis{password} is NULL, a password will be prompted for using \sphinxstyleemphasis{prompter} if necessary. If \sphinxstyleemphasis{in\_tkt\_service} is specified, it is parsed as a principal name (with the realm ignored) and used as the service principal for the request; otherwise the ticket\sphinxhyphen{}granting service is used. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_profile \sphinxhyphen{} Retrieve configuration profile from the context.} -\label{\detokenize{appdev/refs/api/krb5_get_profile:krb5-get-profile-retrieve-configuration-profile-from-the-context}}\label{\detokenize{appdev/refs/api/krb5_get_profile::doc}}\index{krb5\_get\_profile (C function)@\spxentry{krb5\_get\_profile}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_profile:c.krb5_get_profile}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_profile}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{struct}\DUrole{w}{ }\DUrole{n}{\_profile\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{profile}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{profile} \sphinxhyphen{} Pointer to data read from a configuration file - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new \sphinxstyleemphasis{profile} object that reflects profile in the supplied \sphinxstyleemphasis{context} . - -\sphinxAtStartPar -The \sphinxstyleemphasis{profile} object may be freed with profile\_release() function. See profile.h and profile API for more details. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_prompt\_types \sphinxhyphen{} Get prompt types array from a context.} -\label{\detokenize{appdev/refs/api/krb5_get_prompt_types:krb5-get-prompt-types-get-prompt-types-array-from-a-context}}\label{\detokenize{appdev/refs/api/krb5_get_prompt_types::doc}}\index{krb5\_get\_prompt\_types (C function)@\spxentry{krb5\_get\_prompt\_types}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_prompt_types:c.krb5_get_prompt_types}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_prompt_type:c.krb5_prompt_type}]{\sphinxcrossref{\DUrole{n}{krb5\_prompt\_type}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_prompt\_types}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Pointer to an array of prompt types corresponding to the prompter’s prompts arguments. Each type has one of the following values: KRB5\_PROMPT\_TYPE\_PASSWORD KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD\_AGAIN KRB5\_PROMPT\_TYPE\_PREAUTH - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_renewed\_creds \sphinxhyphen{} Get renewed credential from KDC using an existing credential.} -\label{\detokenize{appdev/refs/api/krb5_get_renewed_creds:krb5-get-renewed-creds-get-renewed-credential-from-kdc-using-an-existing-credential}}\label{\detokenize{appdev/refs/api/krb5_get_renewed_creds::doc}}\index{krb5\_get\_renewed\_creds (C function)@\spxentry{krb5\_get\_renewed\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_renewed_creds:c.krb5_get_renewed_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_renewed\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{client}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_tkt\_service}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Renewed credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client} \sphinxhyphen{} Client principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_tkt\_service} \sphinxhyphen{} Server principal string (or NULL) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function gets a renewed credential using an existing one from \sphinxstyleemphasis{ccache} . If \sphinxstyleemphasis{in\_tkt\_service} is specified, it is parsed (with the realm part ignored) and used as the server principal of the credential; otherwise, the ticket\sphinxhyphen{}granting service is used. - -\sphinxAtStartPar -If successful, the renewed credential is placed in \sphinxstyleemphasis{creds} . - -\sphinxstepscope - - -\subsubsection{krb5\_get\_validated\_creds \sphinxhyphen{} Get validated credentials from the KDC.} -\label{\detokenize{appdev/refs/api/krb5_get_validated_creds:krb5-get-validated-creds-get-validated-credentials-from-the-kdc}}\label{\detokenize{appdev/refs/api/krb5_get_validated_creds::doc}}\index{krb5\_get\_validated\_creds (C function)@\spxentry{krb5\_get\_validated\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_validated_creds:c.krb5_get_validated_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_validated\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{client}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_tkt\_service}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Validated credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client} \sphinxhyphen{} Client principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_tkt\_service} \sphinxhyphen{} Server principal string (or NULL) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5\_NO\_2ND\_TKT Request missing second ticket - -\item {} -\sphinxAtStartPar -KRB5\_NO\_TKT\_SUPPLIED Request did not supply a ticket - -\item {} -\sphinxAtStartPar -KRB5\_PRINC\_NOMATCH Requested principal and ticket do not match - -\item {} -\sphinxAtStartPar -KRB5\_KDCREP\_MODIFIED KDC reply did not match expectations - -\item {} -\sphinxAtStartPar -KRB5\_KDCREP\_SKEW Clock skew too great in KDC reply - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function gets a validated credential using a postdated credential from \sphinxstyleemphasis{ccache} . If \sphinxstyleemphasis{in\_tkt\_service} is specified, it is parsed (with the realm part ignored) and used as the server principal of the credential; otherwise, the ticket\sphinxhyphen{}granting service is used. - -\sphinxAtStartPar -If successful, the validated credential is placed in \sphinxstyleemphasis{creds} . - -\sphinxstepscope - - -\subsubsection{krb5\_init\_context \sphinxhyphen{} Create a krb5 library context.} -\label{\detokenize{appdev/refs/api/krb5_init_context:krb5-init-context-create-a-krb5-library-context}}\label{\detokenize{appdev/refs/api/krb5_init_context::doc}}\index{krb5\_init\_context (C function)@\spxentry{krb5\_init\_context}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_context:c.krb5_init_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_context}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The \sphinxstyleemphasis{context} must be released by calling krb5\_free\_context() when it is no longer needed. - -\begin{sphinxadmonition}{warning}{Warning:} -\sphinxAtStartPar -Any program or module that needs the Kerberos code to not trust the environment must use krb5\_init\_secure\_context(), or clean out the environment. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_init\_secure\_context \sphinxhyphen{} Create a krb5 library context using only configuration files.} -\label{\detokenize{appdev/refs/api/krb5_init_secure_context:krb5-init-secure-context-create-a-krb5-library-context-using-only-configuration-files}}\label{\detokenize{appdev/refs/api/krb5_init_secure_context::doc}}\index{krb5\_init\_secure\_context (C function)@\spxentry{krb5\_init\_secure\_context}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_secure_context:c.krb5_init_secure_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_secure\_context}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Create a context structure, using only system configuration files. All information passed through the environment variables is ignored. - -\sphinxAtStartPar -The \sphinxstyleemphasis{context} must be released by calling krb5\_free\_context() when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_is\_config\_principal \sphinxhyphen{} Test whether a principal is a configuration principal.} -\label{\detokenize{appdev/refs/api/krb5_is_config_principal:krb5-is-config-principal-test-whether-a-principal-is-a-configuration-principal}}\label{\detokenize{appdev/refs/api/krb5_is_config_principal::doc}}\index{krb5\_is\_config\_principal (C function)@\spxentry{krb5\_is\_config\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_is_config_principal:c.krb5_is_config_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_is\_config\_principal}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal to check - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if the principal is a configuration principal (generated part of krb5\_cc\_set\_config()); FALSE otherwise. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_is\_thread\_safe \sphinxhyphen{} Test whether the Kerberos library was built with multithread support.} -\label{\detokenize{appdev/refs/api/krb5_is_thread_safe:krb5-is-thread-safe-test-whether-the-kerberos-library-was-built-with-multithread-support}}\label{\detokenize{appdev/refs/api/krb5_is_thread_safe::doc}}\index{krb5\_is\_thread\_safe (C function)@\spxentry{krb5\_is\_thread\_safe}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_is_thread_safe:c.krb5_is_thread_safe}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_is\_thread\_safe}}}}{\DUrole{kt}{void}\DUrole{w}{ }\DUrole{n}{None}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{None} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if the library is threadsafe; FALSE otherwise - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_close \sphinxhyphen{} Close a key table handle.} -\label{\detokenize{appdev/refs/api/krb5_kt_close:krb5-kt-close-close-a-key-table-handle}}\label{\detokenize{appdev/refs/api/krb5_kt_close::doc}}\index{krb5\_kt\_close (C function)@\spxentry{krb5\_kt\_close}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_close:c.krb5_kt_close}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_close}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 None - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_client\_default \sphinxhyphen{} Resolve the default client key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_client_default:krb5-kt-client-default-resolve-the-default-client-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_client_default::doc}}\index{krb5\_kt\_client\_default (C function)@\spxentry{krb5\_kt\_client\_default}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_client_default:c.krb5_kt_client_default}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_client\_default}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keytab\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{keytab\_out} \sphinxhyphen{} Key table handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Fill \sphinxstyleemphasis{keytab\_out} with a handle to the default client key table. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_default \sphinxhyphen{} Resolve the default key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_default:krb5-kt-default-resolve-the-default-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_default::doc}}\index{krb5\_kt\_default (C function)@\spxentry{krb5\_kt\_default}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_default:c.krb5_kt_default}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_default}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{id}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{id} \sphinxhyphen{} Key table handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Set \sphinxstyleemphasis{id} to a handle to the default key table. The key table is not opened. - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_default\_name \sphinxhyphen{} Get the default key table name.} -\label{\detokenize{appdev/refs/api/krb5_kt_default_name:krb5-kt-default-name-get-the-default-key-table-name}}\label{\detokenize{appdev/refs/api/krb5_kt_default_name::doc}}\index{krb5\_kt\_default\_name (C function)@\spxentry{krb5\_kt\_default\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_default_name:c.krb5_kt_default_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_default\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{name\_size}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{name} \sphinxhyphen{} Default key table name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{name\_size} \sphinxhyphen{} Space available in \sphinxstyleemphasis{name} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5\_CONFIG\_NOTENUFSPACE Buffer is too short - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Fill \sphinxstyleemphasis{name} with the name of the default key table for \sphinxstyleemphasis{context} . - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_dup \sphinxhyphen{} Duplicate keytab handle.} -\label{\detokenize{appdev/refs/api/krb5_kt_dup:krb5-kt-dup-duplicate-keytab-handle}}\label{\detokenize{appdev/refs/api/krb5_kt_dup::doc}}\index{krb5\_kt\_dup (C function)@\spxentry{krb5\_kt\_dup}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_dup:c.krb5_kt_dup}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_dup}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{in}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in} \sphinxhyphen{} Key table handle to be duplicated - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} Key table handle - -\end{description}\end{quote} - -\sphinxAtStartPar -Create a new handle referring to the same key table as \sphinxstyleemphasis{in} . The new handle and \sphinxstyleemphasis{in} can be closed independently. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.12 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_get\_name \sphinxhyphen{} Get a key table name.} -\label{\detokenize{appdev/refs/api/krb5_kt_get_name:krb5-kt-get-name-get-a-key-table-name}}\label{\detokenize{appdev/refs/api/krb5_kt_get_name::doc}}\index{krb5\_kt\_get\_name (C function)@\spxentry{krb5\_kt\_get\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_get_name:c.krb5_kt_get_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_get\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{namelen}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{name} \sphinxhyphen{} Key table name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{namelen} \sphinxhyphen{} Maximum length to fill in name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5\_KT\_NAME\_TOOLONG Key table name does not fit in namelen bytes - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Fill \sphinxstyleemphasis{name} with the name of \sphinxstyleemphasis{keytab} including the type and delimiter. - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_get\_type \sphinxhyphen{} Return the type of a key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_get_type:krb5-kt-get-type-return-the-type-of-a-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_get_type::doc}}\index{krb5\_kt\_get\_type (C function)@\spxentry{krb5\_kt\_get\_type}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_get_type:c.krb5_kt_get_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_get\_type}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -The type of a key table as an alias that must not be modified or freed by the caller. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_resolve \sphinxhyphen{} Get a handle for a key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_resolve:krb5-kt-resolve-get-a-handle-for-a-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_resolve::doc}}\index{krb5\_kt\_resolve (C function)@\spxentry{krb5\_kt\_resolve}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_resolve:c.krb5_kt_resolve}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_resolve}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ktid}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{name} \sphinxhyphen{} Name of the key table - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ktid} \sphinxhyphen{} Key table handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Resolve the key table name \sphinxstyleemphasis{name} and set \sphinxstyleemphasis{ktid} to a handle identifying the key table. Use krb5\_kt\_close() to free \sphinxstyleemphasis{ktid} when it is no longer needed. -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{name} must be of the form \sphinxstylestrong{type:residual} , where \sphinxstyleemphasis{type} must be a type known to the library and \sphinxstyleemphasis{residual} portion should be specific to the particular keytab type. If no \sphinxstyleemphasis{type} is given, the default is \sphinxstylestrong{FILE} . -\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{name} is of type \sphinxstylestrong{FILE} , the keytab file is not opened by this call. - -\sphinxstepscope - - -\subsubsection{krb5\_kuserok \sphinxhyphen{} Determine if a principal is authorized to log in as a local user.} -\label{\detokenize{appdev/refs/api/krb5_kuserok:krb5-kuserok-determine-if-a-principal-is-authorized-to-log-in-as-a-local-user}}\label{\detokenize{appdev/refs/api/krb5_kuserok::doc}}\index{krb5\_kuserok (C function)@\spxentry{krb5\_kuserok}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kuserok:c.krb5_kuserok}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kuserok}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{luser}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{luser} \sphinxhyphen{} Local username - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE Principal is authorized to log in as user; FALSE otherwise. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Determine whether \sphinxstyleemphasis{principal} is authorized to log in as a local user \sphinxstyleemphasis{luser} . - -\sphinxstepscope - - -\subsubsection{krb5\_parse\_name \sphinxhyphen{} Convert a string principal name to a krb5\_principal structure.} -\label{\detokenize{appdev/refs/api/krb5_parse_name:krb5-parse-name-convert-a-string-principal-name-to-a-krb5-principal-structure}}\label{\detokenize{appdev/refs/api/krb5_parse_name::doc}}\index{krb5\_parse\_name (C function)@\spxentry{krb5\_parse\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_parse_name:c.krb5_parse_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_parse\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{principal\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{name} \sphinxhyphen{} String representation of a principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{principal\_out} \sphinxhyphen{} New principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Convert a string representation of a principal name to a krb5\_principal structure. - -\sphinxAtStartPar -A string representation of a Kerberos name consists of one or more principal name components, separated by slashes, optionally followed by the @ character and a realm name. If the realm name is not specified, the local realm is used. - -\sphinxAtStartPar -To use the slash and @ symbols as part of a component (quoted) instead of using them as a component separator or as a realm prefix), put a backslash () character in front of the symbol. Similarly, newline, tab, backspace, and NULL characters can be included in a component by using \sphinxstylestrong{n} , \sphinxstylestrong{t} , \sphinxstylestrong{b} or \sphinxstylestrong{0} , respectively. - -\sphinxAtStartPar -Beginning with release 1.20, the name type of the principal will be inferred as \sphinxstylestrong{KRB5\_NT\_SRV\_INST} or \sphinxstylestrong{KRB5\_NT\_WELLKNOWN} based on the principal name. The type will be \sphinxstylestrong{KRB5\_NT\_PRINCIPAL} if a type cannot be inferred. - -\sphinxAtStartPar -Use krb5\_free\_principal() to free \sphinxstyleemphasis{principal\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The realm in a Kerberos \sphinxstyleemphasis{name} cannot contain slash, colon, or NULL characters. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_parse\_name\_flags \sphinxhyphen{} Convert a string principal name to a krb5\_principal with flags.} -\label{\detokenize{appdev/refs/api/krb5_parse_name_flags:krb5-parse-name-flags-convert-a-string-principal-name-to-a-krb5-principal-with-flags}}\label{\detokenize{appdev/refs/api/krb5_parse_name_flags::doc}}\index{krb5\_parse\_name\_flags (C function)@\spxentry{krb5\_parse\_name\_flags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_parse_name_flags:c.krb5_parse_name_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_parse\_name\_flags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{flags}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{principal\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{name} \sphinxhyphen{} String representation of a principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flag - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{principal\_out} \sphinxhyphen{} New principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Similar to krb5\_parse\_name(), this function converts a single\sphinxhyphen{}string representation of a principal name to a krb5\_principal structure. - -\sphinxAtStartPar -The following flags are valid: -\begin{quote} -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_PARSE\_NO\_REALM \sphinxhyphen{} no realm must be present in \sphinxstyleemphasis{name} - -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_PARSE\_REQUIRE\_REALM \sphinxhyphen{} realm must be present in \sphinxstyleemphasis{name} - -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_PARSE\_ENTERPRISE \sphinxhyphen{} create single\sphinxhyphen{}component enterprise principal - -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_PARSE\_IGNORE\_REALM \sphinxhyphen{} ignore realm if present in \sphinxstyleemphasis{name} - -\end{itemize} - -\sphinxAtStartPar -If \sphinxstylestrong{KRB5\_PRINCIPAL\_PARSE\_NO\_REALM} or \sphinxstylestrong{KRB5\_PRINCIPAL\_PARSE\_IGNORE\_REALM} is specified in \sphinxstyleemphasis{flags} , the realm of the new principal will be empty. Otherwise, the default realm for \sphinxstyleemphasis{context} will be used if \sphinxstyleemphasis{name} does not specify a realm. -\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_principal() to free \sphinxstyleemphasis{principal\_out} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_principal\_compare \sphinxhyphen{} Compare two principals.} -\label{\detokenize{appdev/refs/api/krb5_principal_compare:krb5-principal-compare-compare-two-principals}}\label{\detokenize{appdev/refs/api/krb5_principal_compare::doc}}\index{krb5\_principal\_compare (C function)@\spxentry{krb5\_principal\_compare}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_principal_compare:c.krb5_principal_compare}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_principal\_compare}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ1}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ2}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ1} \sphinxhyphen{} First principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ2} \sphinxhyphen{} Second principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if the principals are the same; FALSE otherwise - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_principal\_compare\_any\_realm \sphinxhyphen{} Compare two principals ignoring realm components.} -\label{\detokenize{appdev/refs/api/krb5_principal_compare_any_realm:krb5-principal-compare-any-realm-compare-two-principals-ignoring-realm-components}}\label{\detokenize{appdev/refs/api/krb5_principal_compare_any_realm::doc}}\index{krb5\_principal\_compare\_any\_realm (C function)@\spxentry{krb5\_principal\_compare\_any\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_principal_compare_any_realm:c.krb5_principal_compare_any_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_principal\_compare\_any\_realm}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ1}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ2}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ1} \sphinxhyphen{} First principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ2} \sphinxhyphen{} Second principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if the principals are the same; FALSE otherwise - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Similar to krb5\_principal\_compare(), but do not compare the realm components of the principals. - -\sphinxstepscope - - -\subsubsection{krb5\_principal\_compare\_flags \sphinxhyphen{} Compare two principals with additional flags.} -\label{\detokenize{appdev/refs/api/krb5_principal_compare_flags:krb5-principal-compare-flags-compare-two-principals-with-additional-flags}}\label{\detokenize{appdev/refs/api/krb5_principal_compare_flags::doc}}\index{krb5\_principal\_compare\_flags (C function)@\spxentry{krb5\_principal\_compare\_flags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_principal_compare_flags:c.krb5_principal_compare_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_principal\_compare\_flags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ1}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ2}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ1} \sphinxhyphen{} First principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ2} \sphinxhyphen{} Second principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flags - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if the principal names are the same; FALSE otherwise - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Valid flags are: -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_COMPARE\_IGNORE\_REALM \sphinxhyphen{} ignore realm component - -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_COMPARE\_ENTERPRISE \sphinxhyphen{} UPNs as real principals - -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_COMPARE\_CASEFOLD case\sphinxhyphen{}insensitive - -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_COMPARE\_UTF8 \sphinxhyphen{} treat principals as UTF\sphinxhyphen{}8 - -\end{itemize} - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_principal\_compare() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_prompter\_posix \sphinxhyphen{} Prompt user for password.} -\label{\detokenize{appdev/refs/api/krb5_prompter_posix:krb5-prompter-posix-prompt-user-for-password}}\label{\detokenize{appdev/refs/api/krb5_prompter_posix::doc}}\index{krb5\_prompter\_posix (C function)@\spxentry{krb5\_prompter\_posix}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_prompter_posix:c.krb5_prompter_posix}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_prompter\_posix}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{banner}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{num\_prompts}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_prompt:c.krb5_prompt}]{\sphinxcrossref{\DUrole{n}{krb5\_prompt}}}}\DUrole{w}{ }\DUrole{n}{prompts}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{data} \sphinxhyphen{} Unused (callback argument) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{name} \sphinxhyphen{} Name to output during prompt - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{banner} \sphinxhyphen{} Banner to output during prompt - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_prompts} \sphinxhyphen{} Number of prompts in \sphinxstyleemphasis{prompts} - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{prompts} \sphinxhyphen{} Array of prompts and replies - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is intended to be used as a prompter callback for krb5\_get\_init\_creds\_password() or krb5\_init\_creds\_init(). - -\sphinxAtStartPar -Writes \sphinxstyleemphasis{name} and \sphinxstyleemphasis{banner} to stdout, each followed by a newline, then writes each prompt field in the \sphinxstyleemphasis{prompts} array, followed by”:”, and sets the reply field of the entry to a line of input read from stdin. If the hidden flag is set for a prompt, then terminal echoing is turned off when input is read. - -\sphinxstepscope - - -\subsubsection{krb5\_realm\_compare \sphinxhyphen{} Compare the realms of two principals.} -\label{\detokenize{appdev/refs/api/krb5_realm_compare:krb5-realm-compare-compare-the-realms-of-two-principals}}\label{\detokenize{appdev/refs/api/krb5_realm_compare::doc}}\index{krb5\_realm\_compare (C function)@\spxentry{krb5\_realm\_compare}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_realm_compare:c.krb5_realm_compare}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_realm\_compare}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ1}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ2}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ1} \sphinxhyphen{} First principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ2} \sphinxhyphen{} Second principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if the realm names are the same; FALSE otherwise - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_get\_challenge \sphinxhyphen{} Retrieve the challenge data for a given question in the responder context.} -\label{\detokenize{appdev/refs/api/krb5_responder_get_challenge:krb5-responder-get-challenge-retrieve-the-challenge-data-for-a-given-question-in-the-responder-context}}\label{\detokenize{appdev/refs/api/krb5_responder_get_challenge::doc}}\index{krb5\_responder\_get\_challenge (C function)@\spxentry{krb5\_responder\_get\_challenge}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_get_challenge:c.krb5_responder_get_challenge}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_get\_challenge}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{question}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{question} \sphinxhyphen{} Question name - -\end{description}\end{quote} - -\sphinxAtStartPar -Return a pointer to a C string containing the challenge for \sphinxstyleemphasis{question} within \sphinxstyleemphasis{rctx} , or NULL if the question is not present in \sphinxstyleemphasis{rctx} . The structure of the question depends on the question name, but will always be printable UTF\sphinxhyphen{}8 text. The returned pointer is an alias, valid only as long as the lifetime of \sphinxstyleemphasis{rctx} , and should not be modified or freed by the caller. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_list\_questions \sphinxhyphen{} List the question names contained in the responder context.} -\label{\detokenize{appdev/refs/api/krb5_responder_list_questions:krb5-responder-list-questions-list-the-question-names-contained-in-the-responder-context}}\label{\detokenize{appdev/refs/api/krb5_responder_list_questions::doc}}\index{krb5\_responder\_list\_questions (C function)@\spxentry{krb5\_responder\_list\_questions}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_list_questions:c.krb5_responder_list_questions}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_list\_questions}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\end{description}\end{quote} - -\sphinxAtStartPar -Return a pointer to a null\sphinxhyphen{}terminated list of question names which are present in \sphinxstyleemphasis{rctx} . The pointer is an alias, valid only as long as the lifetime of \sphinxstyleemphasis{rctx} , and should not be modified or freed by the caller. A question’s challenge can be retrieved using krb5\_responder\_get\_challenge() and answered using krb5\_responder\_set\_answer(). - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_set\_answer \sphinxhyphen{} Answer a named question in the responder context.} -\label{\detokenize{appdev/refs/api/krb5_responder_set_answer:krb5-responder-set-answer-answer-a-named-question-in-the-responder-context}}\label{\detokenize{appdev/refs/api/krb5_responder_set_answer::doc}}\index{krb5\_responder\_set\_answer (C function)@\spxentry{krb5\_responder\_set\_answer}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_set_answer:c.krb5_responder_set_answer}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_set\_answer}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{question}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{answer}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{question} \sphinxhyphen{} Question name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{answer} \sphinxhyphen{} The string to set (MUST be printable UTF\sphinxhyphen{}8) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -EINVAL question is not present within rctx - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function supplies an answer to \sphinxstyleemphasis{question} within \sphinxstyleemphasis{rctx} . The appropriate form of the answer depends on the question name. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_otp\_get\_challenge \sphinxhyphen{} Decode the KRB5\_RESPONDER\_QUESTION\_OTP to a C struct.} -\label{\detokenize{appdev/refs/api/krb5_responder_otp_get_challenge:krb5-responder-otp-get-challenge-decode-the-krb5-responder-question-otp-to-a-c-struct}}\label{\detokenize{appdev/refs/api/krb5_responder_otp_get_challenge::doc}}\index{krb5\_responder\_otp\_get\_challenge (C function)@\spxentry{krb5\_responder\_otp\_get\_challenge}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_otp_get_challenge:c.krb5_responder_otp_get_challenge}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_otp\_get\_challenge}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_challenge:c.krb5_responder_otp_challenge}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_challenge}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{chl}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{chl} \sphinxhyphen{} Challenge structure - -\end{description}\end{quote} - -\sphinxAtStartPar -A convenience function which parses the KRB5\_RESPONDER\_QUESTION\_OTP question challenge data, making it available in native C. The main feature of this function is the ability to interact with OTP tokens without parsing the JSON. - -\sphinxAtStartPar -The returned value must be passed to krb5\_responder\_otp\_challenge\_free() to be freed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_otp\_set\_answer \sphinxhyphen{} Answer the KRB5\_RESPONDER\_QUESTION\_OTP question.} -\label{\detokenize{appdev/refs/api/krb5_responder_otp_set_answer:krb5-responder-otp-set-answer-answer-the-krb5-responder-question-otp-question}}\label{\detokenize{appdev/refs/api/krb5_responder_otp_set_answer::doc}}\index{krb5\_responder\_otp\_set\_answer (C function)@\spxentry{krb5\_responder\_otp\_set\_answer}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_otp_set_answer:c.krb5_responder_otp_set_answer}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_otp\_set\_answer}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{ti}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{value}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pin}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ti} \sphinxhyphen{} The index of the tokeninfo selected - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{value} \sphinxhyphen{} The value to set, or NULL for none - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pin} \sphinxhyphen{} The pin to set, or NULL for none - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_otp\_challenge\_free \sphinxhyphen{} Free the value returned by krb5\_responder\_otp\_get\_challenge().} -\label{\detokenize{appdev/refs/api/krb5_responder_otp_challenge_free:krb5-responder-otp-challenge-free-free-the-value-returned-by-krb5-responder-otp-get-challenge}}\label{\detokenize{appdev/refs/api/krb5_responder_otp_challenge_free::doc}}\index{krb5\_responder\_otp\_challenge\_free (C function)@\spxentry{krb5\_responder\_otp\_challenge\_free}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_otp_challenge_free:c.krb5_responder_otp_challenge_free}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_otp\_challenge\_free}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_challenge:c.krb5_responder_otp_challenge}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_challenge}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{chl}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{chl} \sphinxhyphen{} The challenge to free - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_pkinit\_get\_challenge \sphinxhyphen{} Decode the KRB5\_RESPONDER\_QUESTION\_PKINIT to a C struct.} -\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_get_challenge:krb5-responder-pkinit-get-challenge-decode-the-krb5-responder-question-pkinit-to-a-c-struct}}\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_get_challenge::doc}}\index{krb5\_responder\_pkinit\_get\_challenge (C function)@\spxentry{krb5\_responder\_pkinit\_get\_challenge}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_get_challenge:c.krb5_responder_pkinit_get_challenge}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_pkinit\_get\_challenge}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:c.krb5_responder_pkinit_challenge}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_pkinit\_challenge}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{chl\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{chl\_out} \sphinxhyphen{} Challenge structure - -\end{description}\end{quote} - -\sphinxAtStartPar -A convenience function which parses the KRB5\_RESPONDER\_QUESTION\_PKINIT question challenge data, making it available in native C. The main feature of this function is the ability to read the challenge without parsing the JSON. - -\sphinxAtStartPar -The returned value must be passed to krb5\_responder\_pkinit\_challenge\_free() to be freed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.12 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_pkinit\_set\_answer \sphinxhyphen{} Answer the KRB5\_RESPONDER\_QUESTION\_PKINIT question for one identity.} -\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_set_answer:krb5-responder-pkinit-set-answer-answer-the-krb5-responder-question-pkinit-question-for-one-identity}}\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_set_answer::doc}}\index{krb5\_responder\_pkinit\_set\_answer (C function)@\spxentry{krb5\_responder\_pkinit\_set\_answer}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_set_answer:c.krb5_responder_pkinit_set_answer}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_pkinit\_set\_answer}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{identity}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pin}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{identity} \sphinxhyphen{} The identity for which a PIN is being supplied - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pin} \sphinxhyphen{} The provided PIN, or NULL for none - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.12 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_pkinit\_challenge\_free \sphinxhyphen{} Free the value returned by krb5\_responder\_pkinit\_get\_challenge().} -\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_challenge_free:krb5-responder-pkinit-challenge-free-free-the-value-returned-by-krb5-responder-pkinit-get-challenge}}\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_challenge_free::doc}}\index{krb5\_responder\_pkinit\_challenge\_free (C function)@\spxentry{krb5\_responder\_pkinit\_challenge\_free}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_responder_pkinit_challenge_free:c.krb5_responder_pkinit_challenge_free}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_pkinit\_challenge\_free}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_context}}}}\DUrole{w}{ }\DUrole{n}{rctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:c.krb5_responder_pkinit_challenge}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_pkinit\_challenge}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{chl}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rctx} \sphinxhyphen{} Responder context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{chl} \sphinxhyphen{} The challenge to free - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.12 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_set\_default\_realm \sphinxhyphen{} Override the default realm for the specified context.} -\label{\detokenize{appdev/refs/api/krb5_set_default_realm:krb5-set-default-realm-override-the-default-realm-for-the-specified-context}}\label{\detokenize{appdev/refs/api/krb5_set_default_realm::doc}}\index{krb5\_set\_default\_realm (C function)@\spxentry{krb5\_set\_default\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_default_realm:c.krb5_set_default_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_default\_realm}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{lrealm}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{lrealm} \sphinxhyphen{} Realm name for the default realm - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{lrealm} is NULL, clear the default realm setting. - -\sphinxstepscope - - -\subsubsection{krb5\_set\_password \sphinxhyphen{} Set a password for a principal using specified credentials.} -\label{\detokenize{appdev/refs/api/krb5_set_password:krb5-set-password-set-a-password-for-a-principal-using-specified-credentials}}\label{\detokenize{appdev/refs/api/krb5_set_password::doc}}\index{krb5\_set\_password (C function)@\spxentry{krb5\_set\_password}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_password:c.krb5_set_password}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_password}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{newpw}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{change\_password\_for}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_code}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_code\_string}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_string}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Credentials for kadmin/changepw service - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{newpw} \sphinxhyphen{} New password - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{change\_password\_for} \sphinxhyphen{} Change the password for this principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_code} \sphinxhyphen{} Numeric error code from server - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_code\_string} \sphinxhyphen{} String equivalent to \sphinxstyleemphasis{result\_code} - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_string} \sphinxhyphen{} Data returned from the remote system - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success and result\_code is set to KRB5\_KPASSWD\_SUCCESS. - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function uses the credentials \sphinxstyleemphasis{creds} to set the password \sphinxstyleemphasis{newpw} for the principal \sphinxstyleemphasis{change\_password\_for} . It implements the set password operation of RFC 3244, for interoperability with Microsoft Windows implementations. - -\sphinxAtStartPar -The error code and strings are returned in \sphinxstyleemphasis{result\_code} , \sphinxstyleemphasis{result\_code\_string} and \sphinxstyleemphasis{result\_string} . - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If \sphinxstyleemphasis{change\_password\_for} is NULL, the change is performed on the current principal. If \sphinxstyleemphasis{change\_password\_for} is non\sphinxhyphen{}null, the change is performed on the principal name passed in \sphinxstyleemphasis{change\_password\_for} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_set\_password\_using\_ccache \sphinxhyphen{} Set a password for a principal using cached credentials.} -\label{\detokenize{appdev/refs/api/krb5_set_password_using_ccache:krb5-set-password-using-ccache-set-a-password-for-a-principal-using-cached-credentials}}\label{\detokenize{appdev/refs/api/krb5_set_password_using_ccache::doc}}\index{krb5\_set\_password\_using\_ccache (C function)@\spxentry{krb5\_set\_password\_using\_ccache}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_password_using_ccache:c.krb5_set_password_using_ccache}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_password\_using\_ccache}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{newpw}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{change\_password\_for}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_code}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_code\_string}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{result\_string}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{newpw} \sphinxhyphen{} New password - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{change\_password\_for} \sphinxhyphen{} Change the password for this principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_code} \sphinxhyphen{} Numeric error code from server - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_code\_string} \sphinxhyphen{} String equivalent to \sphinxstyleemphasis{result\_code} - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{result\_string} \sphinxhyphen{} Data returned from the remote system - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function uses the cached credentials from \sphinxstyleemphasis{ccache} to set the password \sphinxstyleemphasis{newpw} for the principal \sphinxstyleemphasis{change\_password\_for} . It implements RFC 3244 set password operation (interoperable with MS Windows implementations) using the credential cache. - -\sphinxAtStartPar -The error code and strings are returned in \sphinxstyleemphasis{result\_code} , \sphinxstyleemphasis{result\_code\_string} and \sphinxstyleemphasis{result\_string} . - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If \sphinxstyleemphasis{change\_password\_for} is set to NULL, the change is performed on the default principal in \sphinxstyleemphasis{ccache} . If \sphinxstyleemphasis{change\_password\_for} is non null, the change is performed on the specified principal. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_set\_principal\_realm \sphinxhyphen{} Set the realm field of a principal.} -\label{\detokenize{appdev/refs/api/krb5_set_principal_realm:krb5-set-principal-realm-set-the-realm-field-of-a-principal}}\label{\detokenize{appdev/refs/api/krb5_set_principal_realm::doc}}\index{krb5\_set\_principal\_realm (C function)@\spxentry{krb5\_set\_principal\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_principal_realm:c.krb5_set_principal_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_principal\_realm}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Set the realm name part of \sphinxstyleemphasis{principal} to \sphinxstyleemphasis{realm} , overwriting the previous realm. - -\sphinxstepscope - - -\subsubsection{krb5\_set\_trace\_callback \sphinxhyphen{} Specify a callback function for trace events.} -\label{\detokenize{appdev/refs/api/krb5_set_trace_callback:krb5-set-trace-callback-specify-a-callback-function-for-trace-events}}\label{\detokenize{appdev/refs/api/krb5_set_trace_callback::doc}}\index{krb5\_set\_trace\_callback (C function)@\spxentry{krb5\_set\_trace\_callback}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_trace_callback:c.krb5_set_trace_callback}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_trace\_callback}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_trace_callback:c.krb5_trace_callback}]{\sphinxcrossref{\DUrole{n}{krb5\_trace\_callback}}}}\DUrole{w}{ }\DUrole{n}{fn}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cb\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fn} \sphinxhyphen{} Callback function - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cb\_data} \sphinxhyphen{} Callback data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Returns KRB5\_TRACE\_NOSUPP if tracing is not supported in the library (unless fn is NULL). - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Specify a callback for trace events occurring in krb5 operations performed within \sphinxstyleemphasis{context} . \sphinxstyleemphasis{fn} will be invoked with \sphinxstyleemphasis{context} as the first argument, \sphinxstyleemphasis{cb\_data} as the last argument, and a pointer to a krb5\_trace\_info as the second argument. If the trace callback is reset via this function or \sphinxstyleemphasis{context} is destroyed, \sphinxstyleemphasis{fn} will be invoked with a NULL second argument so it can clean up \sphinxstyleemphasis{cb\_data} . Supply a NULL value for \sphinxstyleemphasis{fn} to disable trace callbacks within \sphinxstyleemphasis{context} . - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function overrides the information passed through the \sphinxstyleemphasis{KRB5\_TRACE} environment variable. -\end{sphinxadmonition} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_set\_trace\_filename \sphinxhyphen{} Specify a file name for directing trace events.} -\label{\detokenize{appdev/refs/api/krb5_set_trace_filename:krb5-set-trace-filename-specify-a-file-name-for-directing-trace-events}}\label{\detokenize{appdev/refs/api/krb5_set_trace_filename::doc}}\index{krb5\_set\_trace\_filename (C function)@\spxentry{krb5\_set\_trace\_filename}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_trace_filename:c.krb5_set_trace_filename}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_trace\_filename}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{filename}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{filename} \sphinxhyphen{} File name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_TRACE\_NOSUPP Tracing is not supported in the library. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Open \sphinxstyleemphasis{filename} for appending (creating it, if necessary) and set up a callback to write trace events to it. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function overrides the information passed through the \sphinxstyleemphasis{KRB5\_TRACE} environment variable. -\end{sphinxadmonition} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_sname\_match \sphinxhyphen{} Test whether a principal matches a matching principal.} -\label{\detokenize{appdev/refs/api/krb5_sname_match:krb5-sname-match-test-whether-a-principal-matches-a-matching-principal}}\label{\detokenize{appdev/refs/api/krb5_sname_match::doc}}\index{krb5\_sname\_match (C function)@\spxentry{krb5\_sname\_match}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_sname_match:c.krb5_sname_match}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_sname\_match}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{matching}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{matching} \sphinxhyphen{} Matching principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ} \sphinxhyphen{} Principal to test - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if princ matches matching , FALSE otherwise. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{matching} is NULL, return TRUE. If \sphinxstyleemphasis{matching} is not a matching principal, return the value of krb5\_principal\_compare(context, matching,princ). - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -A matching principal is a host\sphinxhyphen{}based principal with an empty realm and/or second data component (hostname). Profile configuration may cause the hostname to be ignored even if it is present. A principal matches a matching principal if the former has the same non\sphinxhyphen{}empty (and non\sphinxhyphen{}ignored) components of the latter. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_sname\_to\_principal \sphinxhyphen{} Generate a full principal name from a service name.} -\label{\detokenize{appdev/refs/api/krb5_sname_to_principal:krb5-sname-to-principal-generate-a-full-principal-name-from-a-service-name}}\label{\detokenize{appdev/refs/api/krb5_sname_to_principal::doc}}\index{krb5\_sname\_to\_principal (C function)@\spxentry{krb5\_sname\_to\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_sname_to_principal:c.krb5_sname_to_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_sname\_to\_principal}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{hostname}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{sname}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{n}{type}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ret\_princ}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{hostname} \sphinxhyphen{} Host name, or NULL to use local host - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{sname} \sphinxhyphen{} Service name, or NULL to use \sphinxstylestrong{“host”} - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{type} \sphinxhyphen{} Principal type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ret\_princ} \sphinxhyphen{} Generated principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function converts a \sphinxstyleemphasis{hostname} and \sphinxstyleemphasis{sname} into \sphinxstyleemphasis{krb5\_principal} structure \sphinxstyleemphasis{ret\_princ} . The returned principal will be of the form \sphinxstyleemphasis{sname/hostname@REALM} where REALM is determined by krb5\_get\_host\_realm(). In some cases this may be the referral (empty) realm. - -\sphinxAtStartPar -The \sphinxstyleemphasis{type} can be one of the following: -\begin{quote} -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_NT\_SRV\_HST canonicalizes the host name before looking up the realm and generating the principal. - -\item {} -\sphinxAtStartPar -KRB5\_NT\_UNKNOWN accepts the hostname as given, and does not canonicalize it. - -\end{itemize} - -\sphinxAtStartPar -Use krb5\_free\_principal to free \sphinxstyleemphasis{ret\_princ} when it is no longer needed. -\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_unparse\_name \sphinxhyphen{} Convert a krb5\_principal structure to a string representation.} -\label{\detokenize{appdev/refs/api/krb5_unparse_name:krb5-unparse-name-convert-a-krb5-principal-structure-to-a-string-representation}}\label{\detokenize{appdev/refs/api/krb5_unparse_name::doc}}\index{krb5\_unparse\_name (C function)@\spxentry{krb5\_unparse\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_unparse_name:c.krb5_unparse_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_unparse\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{name}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{name} \sphinxhyphen{} String representation of principal name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The resulting string representation uses the format and quoting conventions described for krb5\_parse\_name(). - -\sphinxAtStartPar -Use krb5\_free\_unparsed\_name() to free \sphinxstyleemphasis{name} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_unparse\_name\_ext \sphinxhyphen{} Convert krb5\_principal structure to string and length.} -\label{\detokenize{appdev/refs/api/krb5_unparse_name_ext:krb5-unparse-name-ext-convert-krb5-principal-structure-to-string-and-length}}\label{\detokenize{appdev/refs/api/krb5_unparse_name_ext::doc}}\index{krb5\_unparse\_name\_ext (C function)@\spxentry{krb5\_unparse\_name\_ext}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_unparse_name_ext:c.krb5_unparse_name_ext}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_unparse\_name\_ext}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{size}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{name} \sphinxhyphen{} String representation of principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{size} \sphinxhyphen{} Size of unparsed name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes. On failure name is set to NULL - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_unparse\_name(), but allows the use of an existing buffer for the result. If size is not NULL, then \sphinxstyleemphasis{name} must point to either NULL or an existing buffer of at least the size pointed to by \sphinxstyleemphasis{size} . The buffer will be allocated or resized if necessary, with the new pointer stored into \sphinxstyleemphasis{name} . Whether or not the buffer is resized, the necessary space for the result, including null terminator, will be stored into \sphinxstyleemphasis{size} . - -\sphinxAtStartPar -If size is NULL, this function behaves exactly as krb5\_unparse\_name(). - -\sphinxstepscope - - -\subsubsection{krb5\_unparse\_name\_flags \sphinxhyphen{} Convert krb5\_principal structure to a string with flags.} -\label{\detokenize{appdev/refs/api/krb5_unparse_name_flags:krb5-unparse-name-flags-convert-krb5-principal-structure-to-a-string-with-flags}}\label{\detokenize{appdev/refs/api/krb5_unparse_name_flags::doc}}\index{krb5\_unparse\_name\_flags (C function)@\spxentry{krb5\_unparse\_name\_flags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_unparse_name_flags:c.krb5_unparse_name_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_unparse\_name\_flags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{flags}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{name}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flags - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{name} \sphinxhyphen{} String representation of principal name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes. On failure name is set to NULL - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Similar to krb5\_unparse\_name(), this function converts a krb5\_principal structure to a string representation. - -\sphinxAtStartPar -The following flags are valid: -\begin{quote} -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_UNPARSE\_SHORT \sphinxhyphen{} omit realm if it is the local realm - -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_UNPARSE\_NO\_REALM \sphinxhyphen{} omit realm - -\item {} -\sphinxAtStartPar -KRB5\_PRINCIPAL\_UNPARSE\_DISPLAY \sphinxhyphen{} do not quote special characters - -\end{itemize} - -\sphinxAtStartPar -Use krb5\_free\_unparsed\_name() to free \sphinxstyleemphasis{name} when it is no longer needed. -\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_unparse\_name\_flags\_ext \sphinxhyphen{} Convert krb5\_principal structure to string format with flags.} -\label{\detokenize{appdev/refs/api/krb5_unparse_name_flags_ext:krb5-unparse-name-flags-ext-convert-krb5-principal-structure-to-string-format-with-flags}}\label{\detokenize{appdev/refs/api/krb5_unparse_name_flags_ext::doc}}\index{krb5\_unparse\_name\_flags\_ext (C function)@\spxentry{krb5\_unparse\_name\_flags\_ext}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_unparse_name_flags_ext:c.krb5_unparse_name_flags_ext}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_unparse\_name\_flags\_ext}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{flags}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{size}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flags - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{name} \sphinxhyphen{} Single string format of principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{size} \sphinxhyphen{} Size of unparsed name buffer - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes. On failure name is set to NULL - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_us\_timeofday \sphinxhyphen{} Retrieve the system time of day, in sec and ms, since the epoch.} -\label{\detokenize{appdev/refs/api/krb5_us_timeofday:krb5-us-timeofday-retrieve-the-system-time-of-day-in-sec-and-ms-since-the-epoch}}\label{\detokenize{appdev/refs/api/krb5_us_timeofday::doc}}\index{krb5\_us\_timeofday (C function)@\spxentry{krb5\_us\_timeofday}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_us_timeofday:c.krb5_us_timeofday}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_us\_timeofday}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{seconds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{microseconds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{seconds} \sphinxhyphen{} System timeofday, seconds portion - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{microseconds} \sphinxhyphen{} System timeofday, microseconds portion - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function retrieves the system time of day with the context specific time offset adjustment. - -\sphinxstepscope - - -\subsubsection{krb5\_verify\_authdata\_kdc\_issued \sphinxhyphen{} Unwrap and verify AD\sphinxhyphen{}KDCIssued authorization data.} -\label{\detokenize{appdev/refs/api/krb5_verify_authdata_kdc_issued:krb5-verify-authdata-kdc-issued-unwrap-and-verify-ad-kdcissued-authorization-data}}\label{\detokenize{appdev/refs/api/krb5_verify_authdata_kdc_issued::doc}}\index{krb5\_verify\_authdata\_kdc\_issued (C function)@\spxentry{krb5\_verify\_authdata\_kdc\_issued}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_verify_authdata_kdc_issued:c.krb5_verify_authdata_kdc_issued}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_verify\_authdata\_kdc\_issued}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ad\_kdcissued}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{issuer}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{authdata}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Session key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ad\_kdcissued} \sphinxhyphen{} AD\sphinxhyphen{}KDCIssued authorization data to be unwrapped - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{issuer} \sphinxhyphen{} Name of issuing principal (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{authdata} \sphinxhyphen{} Unwrapped list of authorization data - -\end{description}\end{quote} - -\sphinxAtStartPar -This function unwraps an AD\sphinxhyphen{}KDCIssued authdatum (see RFC 4120 section 5.2.6.2) and verifies its signature against \sphinxstyleemphasis{key} . The issuer field of the authdatum element is returned in \sphinxstyleemphasis{issuer} , and the unwrapped list of authdata is returned in \sphinxstyleemphasis{authdata} . - - -\subsection{Rarely used public interfaces} -\label{\detokenize{appdev/refs/api/index:rarely-used-public-interfaces}} -\sphinxstepscope - - -\subsubsection{krb5\_425\_conv\_principal \sphinxhyphen{} Convert a Kerberos V4 principal to a Kerberos V5 principal.} -\label{\detokenize{appdev/refs/api/krb5_425_conv_principal:krb5-425-conv-principal-convert-a-kerberos-v4-principal-to-a-kerberos-v5-principal}}\label{\detokenize{appdev/refs/api/krb5_425_conv_principal::doc}}\index{krb5\_425\_conv\_principal (C function)@\spxentry{krb5\_425\_conv\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_425_conv_principal:c.krb5_425_conv_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_425\_conv\_principal}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{instance}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{princ}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{name} \sphinxhyphen{} V4 name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{instance} \sphinxhyphen{} V4 instance - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{princ} \sphinxhyphen{} V5 principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function builds a \sphinxstyleemphasis{princ} from V4 specification based on given input \sphinxstyleemphasis{name.instance@realm} . - -\sphinxAtStartPar -Use krb5\_free\_principal() to free \sphinxstyleemphasis{princ} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_524\_conv\_principal \sphinxhyphen{} Convert a Kerberos V5 principal to a Kerberos V4 principal.} -\label{\detokenize{appdev/refs/api/krb5_524_conv_principal:krb5-524-conv-principal-convert-a-kerberos-v5-principal-to-a-kerberos-v4-principal}}\label{\detokenize{appdev/refs/api/krb5_524_conv_principal::doc}}\index{krb5\_524\_conv\_principal (C function)@\spxentry{krb5\_524\_conv\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_524_conv_principal:c.krb5_524_conv_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_524\_conv\_principal}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inst}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{princ} \sphinxhyphen{} V5 Principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{name} \sphinxhyphen{} V4 principal’s name to be filled in - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{inst} \sphinxhyphen{} V4 principal’s instance name to be filled in - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Principal’s realm name to be filled in - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5\_INVALID\_PRINCIPAL Invalid principal name - -\item {} -\sphinxAtStartPar -KRB5\_CONFIG\_CANTOPEN Can’t open or find Kerberos configuration file - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function separates a V5 principal \sphinxstyleemphasis{princ} into \sphinxstyleemphasis{name} , \sphinxstyleemphasis{instance} , and \sphinxstyleemphasis{realm} . - -\sphinxstepscope - - -\subsubsection{krb5\_address\_compare \sphinxhyphen{} Compare two Kerberos addresses.} -\label{\detokenize{appdev/refs/api/krb5_address_compare:krb5-address-compare-compare-two-kerberos-addresses}}\label{\detokenize{appdev/refs/api/krb5_address_compare::doc}}\index{krb5\_address\_compare (C function)@\spxentry{krb5\_address\_compare}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_address_compare:c.krb5_address_compare}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_address\_compare}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addr1}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addr2}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{addr1} \sphinxhyphen{} First address to be compared - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{addr2} \sphinxhyphen{} Second address to be compared - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if the addresses are the same, FALSE otherwise - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_address\_order \sphinxhyphen{} Return an ordering of the specified addresses.} -\label{\detokenize{appdev/refs/api/krb5_address_order:krb5-address-order-return-an-ordering-of-the-specified-addresses}}\label{\detokenize{appdev/refs/api/krb5_address_order::doc}}\index{krb5\_address\_order (C function)@\spxentry{krb5\_address\_order}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_address_order:c.krb5_address_order}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{int}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_address\_order}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addr1}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addr2}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{addr1} \sphinxhyphen{} First address - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{addr2} \sphinxhyphen{} Second address - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 if The two addresses are the same - -\item {} -\sphinxAtStartPar -\textless{} 0 First address is less than second - -\item {} -\sphinxAtStartPar -\textgreater{} 0 First address is greater than second - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_address\_search \sphinxhyphen{} Search a list of addresses for a specified address.} -\label{\detokenize{appdev/refs/api/krb5_address_search:krb5-address-search-search-a-list-of-addresses-for-a-specified-address}}\label{\detokenize{appdev/refs/api/krb5_address_search::doc}}\index{krb5\_address\_search (C function)@\spxentry{krb5\_address\_search}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_address_search:c.krb5_address_search}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_address\_search}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addrlist}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{addr} \sphinxhyphen{} Address to search for - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{addrlist} \sphinxhyphen{} Address list to be searched (or NULL) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if addr is listed in addrlist , or addrlist is NULL; FALSE otherwise - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If \sphinxstyleemphasis{addrlist} contains only a NetBIOS addresses, it will be treated as a null list. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_allow\_weak\_crypto \sphinxhyphen{} Allow the application to override the profile’s allow\_weak\_crypto setting.} -\label{\detokenize{appdev/refs/api/krb5_allow_weak_crypto:krb5-allow-weak-crypto-allow-the-application-to-override-the-profile-s-allow-weak-crypto-setting}}\label{\detokenize{appdev/refs/api/krb5_allow_weak_crypto::doc}}\index{krb5\_allow\_weak\_crypto (C function)@\spxentry{krb5\_allow\_weak\_crypto}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_allow_weak_crypto:c.krb5_allow_weak_crypto}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_allow\_weak\_crypto}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{n}{enable}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enable} \sphinxhyphen{} Boolean flag - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function allows an application to override the allow\_weak\_crypto setting. It is primarily for use by aklog. - -\sphinxstepscope - - -\subsubsection{krb5\_aname\_to\_localname \sphinxhyphen{} Convert a principal name to a local name.} -\label{\detokenize{appdev/refs/api/krb5_aname_to_localname:krb5-aname-to-localname-convert-a-principal-name-to-a-local-name}}\label{\detokenize{appdev/refs/api/krb5_aname_to_localname::doc}}\index{krb5\_aname\_to\_localname (C function)@\spxentry{krb5\_aname\_to\_localname}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_aname_to_localname:c.krb5_aname_to_localname}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_aname\_to\_localname}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{aname}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{lnsize\_in}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{lname}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{aname} \sphinxhyphen{} Principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{lnsize\_in} \sphinxhyphen{} Space available in \sphinxstyleemphasis{lname} - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{lname} \sphinxhyphen{} Local name buffer to be filled in - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -System errors - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{aname} does not correspond to any local account, KRB5\_LNAME\_NOTRANS is returned. If \sphinxstyleemphasis{lnsize\_in} is too small for the local name, KRB5\_CONFIG\_NOTENUFSPACE is returned. - -\sphinxAtStartPar -Local names, rather than principal names, can be used by programs that translate to an environment\sphinxhyphen{}specific name (for example, a user account name). - -\sphinxstepscope - - -\subsubsection{krb5\_anonymous\_principal \sphinxhyphen{} Build an anonymous principal.} -\label{\detokenize{appdev/refs/api/krb5_anonymous_principal:krb5-anonymous-principal-build-an-anonymous-principal}}\label{\detokenize{appdev/refs/api/krb5_anonymous_principal::doc}}\index{krb5\_anonymous\_principal (C function)@\spxentry{krb5\_anonymous\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_anonymous_principal:c.krb5_anonymous_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_anonymous\_principal}}}}{\DUrole{kt}{void}\DUrole{w}{ }\DUrole{n}{None}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{None} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function returns constant storage that must not be freed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -KRB5\_ANONYMOUS\_PRINCSTR - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_anonymous\_realm \sphinxhyphen{} Return an anonymous realm data.} -\label{\detokenize{appdev/refs/api/krb5_anonymous_realm:krb5-anonymous-realm-return-an-anonymous-realm-data}}\label{\detokenize{appdev/refs/api/krb5_anonymous_realm::doc}}\index{krb5\_anonymous\_realm (C function)@\spxentry{krb5\_anonymous\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_anonymous_realm:c.krb5_anonymous_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_anonymous\_realm}}}}{\DUrole{kt}{void}\DUrole{w}{ }\DUrole{n}{None}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{None} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function returns constant storage that must not be freed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -KRB5\_ANONYMOUS\_REALMSTR - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_appdefault\_boolean \sphinxhyphen{} Retrieve a boolean value from the appdefaults section of krb5.conf.} -\label{\detokenize{appdev/refs/api/krb5_appdefault_boolean:krb5-appdefault-boolean-retrieve-a-boolean-value-from-the-appdefaults-section-of-krb5-conf}}\label{\detokenize{appdev/refs/api/krb5_appdefault_boolean::doc}}\index{krb5\_appdefault\_boolean (C function)@\spxentry{krb5\_appdefault\_boolean}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_appdefault_boolean:c.krb5_appdefault_boolean}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_appdefault\_boolean}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{appname}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{option}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{default\_value}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ret\_value}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{appname} \sphinxhyphen{} Application name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{option} \sphinxhyphen{} Option to be checked - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{default\_value} \sphinxhyphen{} Default value to return if no match is found - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ret\_value} \sphinxhyphen{} Boolean value of \sphinxstyleemphasis{option} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function gets the application defaults for \sphinxstyleemphasis{option} based on the given \sphinxstyleemphasis{appname} and/or \sphinxstyleemphasis{realm} . - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_appdefault\_string() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_appdefault\_string \sphinxhyphen{} Retrieve a string value from the appdefaults section of krb5.conf.} -\label{\detokenize{appdev/refs/api/krb5_appdefault_string:krb5-appdefault-string-retrieve-a-string-value-from-the-appdefaults-section-of-krb5-conf}}\label{\detokenize{appdev/refs/api/krb5_appdefault_string::doc}}\index{krb5\_appdefault\_string (C function)@\spxentry{krb5\_appdefault\_string}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_appdefault_string:c.krb5_appdefault_string}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_appdefault\_string}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{appname}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{option}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{default\_value}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ret\_value}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{appname} \sphinxhyphen{} Application name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{option} \sphinxhyphen{} Option to be checked - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{default\_value} \sphinxhyphen{} Default value to return if no match is found - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ret\_value} \sphinxhyphen{} String value of \sphinxstyleemphasis{option} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function gets the application defaults for \sphinxstyleemphasis{option} based on the given \sphinxstyleemphasis{appname} and/or \sphinxstyleemphasis{realm} . - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_appdefault\_boolean() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_free \sphinxhyphen{} Free a krb5\_auth\_context structure.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_free:krb5-auth-con-free-free-a-krb5-auth-context-structure}}\label{\detokenize{appdev/refs/api/krb5_auth_con_free::doc}}\index{krb5\_auth\_con\_free (C function)@\spxentry{krb5\_auth\_con\_free}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_free:c.krb5_auth_con_free}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_free}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context to be freed - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees an auth context allocated by krb5\_auth\_con\_init(). - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_genaddrs \sphinxhyphen{} Generate auth context addresses from a connected socket.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_genaddrs:krb5-auth-con-genaddrs-generate-auth-context-addresses-from-a-connected-socket}}\label{\detokenize{appdev/refs/api/krb5_auth_con_genaddrs::doc}}\index{krb5\_auth\_con\_genaddrs (C function)@\spxentry{krb5\_auth\_con\_genaddrs}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_genaddrs:c.krb5_auth_con_genaddrs}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_genaddrs}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{infd}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{infd} \sphinxhyphen{} Connected socket descriptor - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flags - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the local and/or remote addresses in \sphinxstyleemphasis{auth\_context} based on the local and remote endpoints of the socket \sphinxstyleemphasis{infd} . The following flags determine the operations performed: -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_ADDR Generate local address. - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_ADDR Generate remote address. - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_FULL\_ADDR Generate local address and port. - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_FULL\_ADDR Generate remote address and port. - -\end{itemize} - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_get\_checksum\_func \sphinxhyphen{} Get the checksum callback from an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_get_checksum_func:krb5-auth-con-get-checksum-func-get-the-checksum-callback-from-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_get_checksum_func::doc}}\index{krb5\_auth\_con\_get\_checksum\_func (C function)@\spxentry{krb5\_auth\_con\_get\_checksum\_func}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_get_checksum_func:c.krb5_auth_con_get_checksum_func}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_get\_checksum\_func}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_mk_req_checksum_func:c.krb5_mk_req_checksum_func}]{\sphinxcrossref{\DUrole{n}{krb5\_mk\_req\_checksum\_func}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{func}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{func} \sphinxhyphen{} Checksum callback - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{data} \sphinxhyphen{} Callback argument - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getaddrs \sphinxhyphen{} Retrieve address fields from an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getaddrs:krb5-auth-con-getaddrs-retrieve-address-fields-from-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getaddrs::doc}}\index{krb5\_auth\_con\_getaddrs (C function)@\spxentry{krb5\_auth\_con\_getaddrs}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getaddrs:c.krb5_auth_con_getaddrs}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getaddrs}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{local\_addr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{remote\_addr}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{local\_addr} \sphinxhyphen{} Local address (NULL if not needed) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{remote\_addr} \sphinxhyphen{} Remote address (NULL if not needed) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getauthenticator \sphinxhyphen{} Retrieve the authenticator from an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getauthenticator:krb5-auth-con-getauthenticator-retrieve-the-authenticator-from-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getauthenticator::doc}}\index{krb5\_auth\_con\_getauthenticator (C function)@\spxentry{krb5\_auth\_con\_getauthenticator}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getauthenticator:c.krb5_auth_con_getauthenticator}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getauthenticator}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{authenticator}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{authenticator} \sphinxhyphen{} Authenticator - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success. Otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_authenticator() to free \sphinxstyleemphasis{authenticator} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getflags \sphinxhyphen{} Retrieve flags from a krb5\_auth\_context structure.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getflags:krb5-auth-con-getflags-retrieve-flags-from-a-krb5-auth-context-structure}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getflags::doc}}\index{krb5\_auth\_con\_getflags (C function)@\spxentry{krb5\_auth\_con\_getflags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getflags:c.krb5_auth_con_getflags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getflags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flags bit mask - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Valid values for \sphinxstyleemphasis{flags} are: -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_DO\_TIME Use timestamps - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_RET\_TIME Save timestamps - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE Use sequence numbers - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE Save sequence numbers - -\end{itemize} - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getkey \sphinxhyphen{} Retrieve the session key from an auth context as a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getkey:krb5-auth-con-getkey-retrieve-the-session-key-from-an-auth-context-as-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getkey::doc}}\index{krb5\_auth\_con\_getkey (C function)@\spxentry{krb5\_auth\_con\_getkey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getkey:c.krb5_auth_con_getkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getkey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} Session key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success. Otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a keyblock containing the session key from \sphinxstyleemphasis{auth\_context} . Use krb5\_free\_keyblock() to free \sphinxstyleemphasis{keyblock} when it is no longer needed - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getkey\_k \sphinxhyphen{} Retrieve the session key from an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getkey_k:krb5-auth-con-getkey-k-retrieve-the-session-key-from-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getkey_k::doc}}\index{krb5\_auth\_con\_getkey\_k (C function)@\spxentry{krb5\_auth\_con\_getkey\_k}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getkey_k:c.krb5_auth_con_getkey_k}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getkey\_k}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{key} \sphinxhyphen{} Session key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets \sphinxstyleemphasis{key} to the session key from \sphinxstyleemphasis{auth\_context} . Use krb5\_k\_free\_key() to release \sphinxstyleemphasis{key} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getlocalseqnumber \sphinxhyphen{} Retrieve the local sequence number from an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getlocalseqnumber:krb5-auth-con-getlocalseqnumber-retrieve-the-local-sequence-number-from-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getlocalseqnumber::doc}}\index{krb5\_auth\_con\_getlocalseqnumber (C function)@\spxentry{krb5\_auth\_con\_getlocalseqnumber}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getlocalseqnumber:c.krb5_auth_con_getlocalseqnumber}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getlocalseqnumber}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{seqnumber}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{seqnumber} \sphinxhyphen{} Local sequence number - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Retrieve the local sequence number from \sphinxstyleemphasis{auth\_context} and return it in \sphinxstyleemphasis{seqnumber} . The KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE flag must be set in \sphinxstyleemphasis{auth\_context} for this function to be useful. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getrcache \sphinxhyphen{} Retrieve the replay cache from an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getrcache:krb5-auth-con-getrcache-retrieve-the-replay-cache-from-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getrcache::doc}}\index{krb5\_auth\_con\_getrcache (C function)@\spxentry{krb5\_auth\_con\_getrcache}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getrcache:c.krb5_auth_con_getrcache}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getrcache}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_rcache:c.krb5_rcache}]{\sphinxcrossref{\DUrole{n}{krb5\_rcache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rcache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rcache} \sphinxhyphen{} Replay cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function fetches the replay cache from \sphinxstyleemphasis{auth\_context} . The caller should not close \sphinxstyleemphasis{rcache} . - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getrecvsubkey \sphinxhyphen{} Retrieve the receiving subkey from an auth context as a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getrecvsubkey:krb5-auth-con-getrecvsubkey-retrieve-the-receiving-subkey-from-an-auth-context-as-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getrecvsubkey::doc}}\index{krb5\_auth\_con\_getrecvsubkey (C function)@\spxentry{krb5\_auth\_con\_getrecvsubkey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getrecvsubkey:c.krb5_auth_con_getrecvsubkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getrecvsubkey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{ac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ac} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} Receiving subkey - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a keyblock containing the receiving subkey from \sphinxstyleemphasis{auth\_context} . Use krb5\_free\_keyblock() to free \sphinxstyleemphasis{keyblock} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getrecvsubkey\_k \sphinxhyphen{} Retrieve the receiving subkey from an auth context as a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getrecvsubkey_k:krb5-auth-con-getrecvsubkey-k-retrieve-the-receiving-subkey-from-an-auth-context-as-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getrecvsubkey_k::doc}}\index{krb5\_auth\_con\_getrecvsubkey\_k (C function)@\spxentry{krb5\_auth\_con\_getrecvsubkey\_k}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getrecvsubkey_k:c.krb5_auth_con_getrecvsubkey_k}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getrecvsubkey\_k}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{ac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ac} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{key} \sphinxhyphen{} Receiving subkey - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets \sphinxstyleemphasis{key} to the receiving subkey from \sphinxstyleemphasis{auth\_context} . Use krb5\_k\_free\_key() to release \sphinxstyleemphasis{key} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getremoteseqnumber \sphinxhyphen{} Retrieve the remote sequence number from an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getremoteseqnumber:krb5-auth-con-getremoteseqnumber-retrieve-the-remote-sequence-number-from-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getremoteseqnumber::doc}}\index{krb5\_auth\_con\_getremoteseqnumber (C function)@\spxentry{krb5\_auth\_con\_getremoteseqnumber}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getremoteseqnumber:c.krb5_auth_con_getremoteseqnumber}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getremoteseqnumber}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{seqnumber}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{seqnumber} \sphinxhyphen{} Remote sequence number - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Retrieve the remote sequence number from \sphinxstyleemphasis{auth\_context} and return it in \sphinxstyleemphasis{seqnumber} . The KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE flag must be set in \sphinxstyleemphasis{auth\_context} for this function to be useful. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getsendsubkey \sphinxhyphen{} Retrieve the send subkey from an auth context as a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getsendsubkey:krb5-auth-con-getsendsubkey-retrieve-the-send-subkey-from-an-auth-context-as-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getsendsubkey::doc}}\index{krb5\_auth\_con\_getsendsubkey (C function)@\spxentry{krb5\_auth\_con\_getsendsubkey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getsendsubkey:c.krb5_auth_con_getsendsubkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getsendsubkey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{ac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ac} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} Send subkey - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a keyblock containing the send subkey from \sphinxstyleemphasis{auth\_context} . Use krb5\_free\_keyblock() to free \sphinxstyleemphasis{keyblock} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getsendsubkey\_k \sphinxhyphen{} Retrieve the send subkey from an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getsendsubkey_k:krb5-auth-con-getsendsubkey-k-retrieve-the-send-subkey-from-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getsendsubkey_k::doc}}\index{krb5\_auth\_con\_getsendsubkey\_k (C function)@\spxentry{krb5\_auth\_con\_getsendsubkey\_k}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getsendsubkey_k:c.krb5_auth_con_getsendsubkey_k}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getsendsubkey\_k}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{ac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ac} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{key} \sphinxhyphen{} Send subkey - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets \sphinxstyleemphasis{key} to the send subkey from \sphinxstyleemphasis{auth\_context} . Use krb5\_k\_free\_key() to release \sphinxstyleemphasis{key} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_init \sphinxhyphen{} Create and initialize an authentication context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_init:krb5-auth-con-init-create-and-initialize-an-authentication-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_init::doc}}\index{krb5\_auth\_con\_init (C function)@\spxentry{krb5\_auth\_con\_init}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_init:c.krb5_auth_con_init}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_init}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{auth\_context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates an authentication context to hold configuration and state relevant to krb5 functions for authenticating principals and protecting messages once authentication has occurred. - -\sphinxAtStartPar -By default, flags for the context are set to enable the use of the replay cache (KRB5\_AUTH\_CONTEXT\_DO\_TIME), but not sequence numbers. Use krb5\_auth\_con\_setflags() to change the flags. - -\sphinxAtStartPar -The allocated \sphinxstyleemphasis{auth\_context} must be freed with krb5\_auth\_con\_free() when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_set\_checksum\_func \sphinxhyphen{} Set a checksum callback in an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_set_checksum_func:krb5-auth-con-set-checksum-func-set-a-checksum-callback-in-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_set_checksum_func::doc}}\index{krb5\_auth\_con\_set\_checksum\_func (C function)@\spxentry{krb5\_auth\_con\_set\_checksum\_func}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_set_checksum_func:c.krb5_auth_con_set_checksum_func}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_set\_checksum\_func}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_mk_req_checksum_func:c.krb5_mk_req_checksum_func}]{\sphinxcrossref{\DUrole{n}{krb5\_mk\_req\_checksum\_func}}}}\DUrole{w}{ }\DUrole{n}{func}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{func} \sphinxhyphen{} Checksum callback - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Callback argument - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Set a callback to obtain checksum data in krb5\_mk\_req(). The callback will be invoked after the subkey and local sequence number are stored in \sphinxstyleemphasis{auth\_context} . - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_set\_req\_cksumtype \sphinxhyphen{} Set checksum type in an an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_set_req_cksumtype:krb5-auth-con-set-req-cksumtype-set-checksum-type-in-an-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_set_req_cksumtype::doc}}\index{krb5\_auth\_con\_set\_req\_cksumtype (C function)@\spxentry{krb5\_auth\_con\_set\_req\_cksumtype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_set_req_cksumtype:c.krb5_auth_con_set_req_cksumtype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_set\_req\_cksumtype}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success. Otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the checksum type in \sphinxstyleemphasis{auth\_context} to be used by krb5\_mk\_req() for the authenticator checksum. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setaddrs \sphinxhyphen{} Set the local and remote addresses in an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setaddrs:krb5-auth-con-setaddrs-set-the-local-and-remote-addresses-in-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setaddrs::doc}}\index{krb5\_auth\_con\_setaddrs (C function)@\spxentry{krb5\_auth\_con\_setaddrs}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setaddrs:c.krb5_auth_con_setaddrs}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setaddrs}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{local\_addr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{remote\_addr}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{local\_addr} \sphinxhyphen{} Local address - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{remote\_addr} \sphinxhyphen{} Remote address - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function releases the storage assigned to the contents of the local and remote addresses of \sphinxstyleemphasis{auth\_context} and then sets them to \sphinxstyleemphasis{local\_addr} and \sphinxstyleemphasis{remote\_addr} respectively. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_auth\_con\_genaddrs() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setflags \sphinxhyphen{} Set a flags field in a krb5\_auth\_context structure.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setflags:krb5-auth-con-setflags-set-a-flags-field-in-a-krb5-auth-context-structure}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setflags::doc}}\index{krb5\_auth\_con\_setflags (C function)@\spxentry{krb5\_auth\_con\_setflags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setflags:c.krb5_auth_con_setflags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setflags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flags bit mask - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Valid values for \sphinxstyleemphasis{flags} are: -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_DO\_TIME Use timestamps - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_RET\_TIME Save timestamps - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE Use sequence numbers - -\item {} -\sphinxAtStartPar -KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE Save sequence numbers - -\end{itemize} - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setports \sphinxhyphen{} Set local and remote port fields in an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setports:krb5-auth-con-setports-set-local-and-remote-port-fields-in-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setports::doc}}\index{krb5\_auth\_con\_setports (C function)@\spxentry{krb5\_auth\_con\_setports}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setports:c.krb5_auth_con_setports}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setports}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{local\_port}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{remote\_port}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{local\_port} \sphinxhyphen{} Local port - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{remote\_port} \sphinxhyphen{} Remote port - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function releases the storage assigned to the contents of the local and remote ports of \sphinxstyleemphasis{auth\_context} and then sets them to \sphinxstyleemphasis{local\_port} and \sphinxstyleemphasis{remote\_port} respectively. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_auth\_con\_genaddrs() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setrcache \sphinxhyphen{} Set the replay cache in an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setrcache:krb5-auth-con-setrcache-set-the-replay-cache-in-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setrcache::doc}}\index{krb5\_auth\_con\_setrcache (C function)@\spxentry{krb5\_auth\_con\_setrcache}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setrcache:c.krb5_auth_con_setrcache}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setrcache}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_rcache:c.krb5_rcache}]{\sphinxcrossref{\DUrole{n}{krb5\_rcache}}}}\DUrole{w}{ }\DUrole{n}{rcache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{rcache} \sphinxhyphen{} Replay cache haddle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the replay cache in \sphinxstyleemphasis{auth\_context} to \sphinxstyleemphasis{rcache} . \sphinxstyleemphasis{rcache} will be closed when \sphinxstyleemphasis{auth\_context} is freed, so the caller should relinquish that responsibility. - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setrecvsubkey \sphinxhyphen{} Set the receiving subkey in an auth context with a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setrecvsubkey:krb5-auth-con-setrecvsubkey-set-the-receiving-subkey-in-an-auth-context-with-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setrecvsubkey::doc}}\index{krb5\_auth\_con\_setrecvsubkey (C function)@\spxentry{krb5\_auth\_con\_setrecvsubkey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setrecvsubkey:c.krb5_auth_con_setrecvsubkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setrecvsubkey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{ac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ac} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} Receiving subkey - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the receiving subkey in \sphinxstyleemphasis{ac} to a copy of \sphinxstyleemphasis{keyblock} . - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setrecvsubkey\_k \sphinxhyphen{} Set the receiving subkey in an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setrecvsubkey_k:krb5-auth-con-setrecvsubkey-k-set-the-receiving-subkey-in-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setrecvsubkey_k::doc}}\index{krb5\_auth\_con\_setrecvsubkey\_k (C function)@\spxentry{krb5\_auth\_con\_setrecvsubkey\_k}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setrecvsubkey_k:c.krb5_auth_con_setrecvsubkey_k}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setrecvsubkey\_k}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{ac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ac} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Receiving subkey - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the receiving subkey in \sphinxstyleemphasis{ac} to \sphinxstyleemphasis{key} , incrementing its reference count. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setsendsubkey \sphinxhyphen{} Set the send subkey in an auth context with a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setsendsubkey:krb5-auth-con-setsendsubkey-set-the-send-subkey-in-an-auth-context-with-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setsendsubkey::doc}}\index{krb5\_auth\_con\_setsendsubkey (C function)@\spxentry{krb5\_auth\_con\_setsendsubkey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setsendsubkey:c.krb5_auth_con_setsendsubkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setsendsubkey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{ac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ac} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} Send subkey - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success. Otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the send subkey in \sphinxstyleemphasis{ac} to a copy of \sphinxstyleemphasis{keyblock} . - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setsendsubkey\_k \sphinxhyphen{} Set the send subkey in an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setsendsubkey_k:krb5-auth-con-setsendsubkey-k-set-the-send-subkey-in-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setsendsubkey_k::doc}}\index{krb5\_auth\_con\_setsendsubkey\_k (C function)@\spxentry{krb5\_auth\_con\_setsendsubkey\_k}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setsendsubkey_k:c.krb5_auth_con_setsendsubkey_k}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setsendsubkey\_k}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{ac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ac} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{key} \sphinxhyphen{} Send subkey - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the send subkey in \sphinxstyleemphasis{ac} to \sphinxstyleemphasis{key} , incrementing its reference count. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_setuseruserkey \sphinxhyphen{} Set the session key in an auth context.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_setuseruserkey:krb5-auth-con-setuseruserkey-set-the-session-key-in-an-auth-context}}\label{\detokenize{appdev/refs/api/krb5_auth_con_setuseruserkey::doc}}\index{krb5\_auth\_con\_setuseruserkey (C function)@\spxentry{krb5\_auth\_con\_setuseruserkey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_setuseruserkey:c.krb5_auth_con_setuseruserkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_setuseruserkey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} User key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_cache\_match \sphinxhyphen{} Find a credential cache with a specified client principal.} -\label{\detokenize{appdev/refs/api/krb5_cc_cache_match:krb5-cc-cache-match-find-a-credential-cache-with-a-specified-client-principal}}\label{\detokenize{appdev/refs/api/krb5_cc_cache_match::doc}}\index{krb5\_cc\_cache\_match (C function)@\spxentry{krb5\_cc\_cache\_match}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_cache_match:c.krb5_cc_cache_match}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_cache\_match}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{client}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cache\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client} \sphinxhyphen{} Client principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cache\_out} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5\_CC\_NOTFOUND - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Find a cache within the collection whose default principal is \sphinxstyleemphasis{client} . Use \sphinxstyleemphasis{krb5\_cc\_close} to close \sphinxstyleemphasis{ccache} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.10 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_copy\_creds \sphinxhyphen{} Copy a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_copy_creds:krb5-cc-copy-creds-copy-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_copy_creds::doc}}\index{krb5\_cc\_copy\_creds (C function)@\spxentry{krb5\_cc\_copy\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_copy_creds:c.krb5_cc_copy_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_copy\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{incc}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{outcc}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{incc} \sphinxhyphen{} Credential cache to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outcc} \sphinxhyphen{} Copy of credential cache to be filled in - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_end\_seq\_get \sphinxhyphen{} Finish a series of sequential processing credential cache entries.} -\label{\detokenize{appdev/refs/api/krb5_cc_end_seq_get:krb5-cc-end-seq-get-finish-a-series-of-sequential-processing-credential-cache-entries}}\label{\detokenize{appdev/refs/api/krb5_cc_end_seq_get::doc}}\index{krb5\_cc\_end\_seq\_get (C function)@\spxentry{krb5\_cc\_end\_seq\_get}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_end_seq_get:c.krb5_cc_end_seq_get}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_end\_seq\_get}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cc_cursor:c.krb5_cc_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_cc\_cursor}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cursor}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Cursor - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 (always) - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function finishes processing credential cache entries and invalidates \sphinxstyleemphasis{cursor} . - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_cc\_start\_seq\_get(), krb5\_cc\_next\_cred() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_get\_config \sphinxhyphen{} Get a configuration value from a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_get_config:krb5-cc-get-config-get-a-configuration-value-from-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_get_config::doc}}\index{krb5\_cc\_get\_config (C function)@\spxentry{krb5\_cc\_get\_config}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_get_config:c.krb5_cc_get_config}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_get\_config}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{id}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{id} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Configuration for this principal; if NULL, global for the whole cache - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Name of config variable - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{data} \sphinxhyphen{} Data to be fetched - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{data} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_get\_flags \sphinxhyphen{} Retrieve flags from a credential cache structure.} -\label{\detokenize{appdev/refs/api/krb5_cc_get_flags:krb5-cc-get-flags-retrieve-flags-from-a-credential-cache-structure}}\label{\detokenize{appdev/refs/api/krb5_cc_get_flags::doc}}\index{krb5\_cc\_get\_flags (C function)@\spxentry{krb5\_cc\_get\_flags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_get_flags:c.krb5_cc_get_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_get\_flags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flag bit mask - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{warning}{Warning:} -\sphinxAtStartPar -For memory credential cache always returns a flag mask of 0. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_get\_full\_name \sphinxhyphen{} Retrieve the full name of a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_get_full_name:krb5-cc-get-full-name-retrieve-the-full-name-of-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_get_full_name::doc}}\index{krb5\_cc\_get\_full\_name (C function)@\spxentry{krb5\_cc\_get\_full\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_get_full_name:c.krb5_cc_get_full_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_get\_full\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{fullname\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{fullname\_out} \sphinxhyphen{} Full name of cache - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_string() to free \sphinxstyleemphasis{fullname\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.10 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_move \sphinxhyphen{} Move a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_move:krb5-cc-move-move-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_move::doc}}\index{krb5\_cc\_move (C function)@\spxentry{krb5\_cc\_move}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_move:c.krb5_cc_move}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_move}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{src}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{dst}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{src} \sphinxhyphen{} The credential cache to move the content from - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{dst} \sphinxhyphen{} The credential cache to move the content to - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; src is closed. - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes; src is still allocated. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function reinitializes \sphinxstyleemphasis{dst} and populates it with the credentials and default principal of \sphinxstyleemphasis{src} ; then, if successful, destroys \sphinxstyleemphasis{src} . - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_next\_cred \sphinxhyphen{} Retrieve the next entry from the credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_next_cred:krb5-cc-next-cred-retrieve-the-next-entry-from-the-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_next_cred::doc}}\index{krb5\_cc\_next\_cred (C function)@\spxentry{krb5\_cc\_next\_cred}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_next_cred:c.krb5_cc_next_cred}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_next\_cred}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cc_cursor:c.krb5_cc_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_cc\_cursor}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cursor}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Cursor - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Next credential cache entry - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function fills in \sphinxstyleemphasis{creds} with the next entry in \sphinxstyleemphasis{cache} and advances \sphinxstyleemphasis{cursor} . - -\sphinxAtStartPar -Use krb5\_free\_cred\_contents() to free \sphinxstyleemphasis{creds} when it is no longer needed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_cc\_start\_seq\_get(), krb5\_end\_seq\_get() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_remove\_cred \sphinxhyphen{} Remove credentials from a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_remove_cred:krb5-cc-remove-cred-remove-credentials-from-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_remove_cred::doc}}\index{krb5\_cc\_remove\_cred (C function)@\spxentry{krb5\_cc\_remove\_cred}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_remove_cred:c.krb5_cc_remove_cred}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_remove\_cred}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{flags}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Bitwise\sphinxhyphen{}ORed search flags - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Credentials to be matched - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_CC\_NOSUPP Not implemented for this cache type - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -No matches found; Data cannot be deleted; Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function accepts the same flag values as krb5\_cc\_retrieve\_cred(). - -\begin{sphinxadmonition}{warning}{Warning:} -\sphinxAtStartPar -This function is not implemented for some cache types. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_retrieve\_cred \sphinxhyphen{} Retrieve a specified credentials from a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_retrieve_cred:krb5-cc-retrieve-cred-retrieve-a-specified-credentials-from-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_retrieve_cred::doc}}\index{krb5\_cc\_retrieve\_cred (C function)@\spxentry{krb5\_cc\_retrieve\_cred}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_retrieve_cred:c.krb5_cc_retrieve_cred}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_retrieve\_cred}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{flags}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{mcreds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flags bit mask - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{mcreds} \sphinxhyphen{} Credentials to match - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Credentials matching the requested value - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function searches a credential cache for credentials matching \sphinxstyleemphasis{mcreds} and returns it if found. - -\sphinxAtStartPar -Valid values for \sphinxstyleemphasis{flags} are: -\begin{quote} -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_TIMES The requested lifetime must be at least as great as in \sphinxstyleemphasis{mcreds} . - -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_IS\_SKEY The \sphinxstyleemphasis{is\_skey} field much match exactly. - -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_FLAGS Flags set in \sphinxstyleemphasis{mcreds} must be set. - -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_TIMES\_EXACT The requested lifetime must match exactly. - -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_FLAGS\_EXACT Flags must match exactly. - -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_AUTHDATA The authorization data must match. - -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_SRV\_NAMEONLY Only the name portion of the principal name must match, not the realm. - -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_2ND\_TKT The second tickets must match. - -\item {} -\sphinxAtStartPar -KRB5\_TC\_MATCH\_KTYPE The encryption key types must match. - -\item {} -\sphinxAtStartPar -KRB5\_TC\_SUPPORTED\_KTYPES Check all matching entries that have any supported encryption type and return the one with the encryption type listed earliest. - -\end{itemize} - -\sphinxAtStartPar -Use krb5\_free\_cred\_contents() to free \sphinxstyleemphasis{creds} when it is no longer needed. -\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_select \sphinxhyphen{} Select a credential cache to use with a server principal.} -\label{\detokenize{appdev/refs/api/krb5_cc_select:krb5-cc-select-select-a-credential-cache-to-use-with-a-server-principal}}\label{\detokenize{appdev/refs/api/krb5_cc_select::doc}}\index{krb5\_cc\_select (C function)@\spxentry{krb5\_cc\_select}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_select:c.krb5_cc_select}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_select}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{server}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cache\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{princ\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Server principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cache\_out} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{princ\_out} \sphinxhyphen{} Client principal - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -If an appropriate cache is found, 0 is returned, cache\_out is set to the selected cache, and princ\_out is set to the default principal of that cache. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Select a cache within the collection containing credentials most appropriate for use with \sphinxstyleemphasis{server} , according to configured rules and heuristics. - -\sphinxAtStartPar -Use krb5\_cc\_close() to release \sphinxstyleemphasis{cache\_out} when it is no longer needed. Use krb5\_free\_principal() to release \sphinxstyleemphasis{princ\_out} when it is no longer needed. Note that \sphinxstyleemphasis{princ\_out} is set in some error conditions. - -\sphinxAtStartPar -If the appropriate client principal can be authoritatively determined but the cache collection contains no credentials for that principal, then KRB5\_CC\_NOTFOUND is returned, \sphinxstyleemphasis{cache\_out} is set to NULL, and \sphinxstyleemphasis{princ\_out} is set to the appropriate client principal. - -\sphinxAtStartPar -If no configured mechanism can determine the appropriate cache or principal, KRB5\_CC\_NOTFOUND is returned and \sphinxstyleemphasis{cache\_out} and \sphinxstyleemphasis{princ\_out} are set to NULL. - -\sphinxAtStartPar -Any other error code indicates a fatal error in the processing of a cache selection mechanism. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.10 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_set\_config \sphinxhyphen{} Store a configuration value in a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_set_config:krb5-cc-set-config-store-a-configuration-value-in-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_set_config::doc}}\index{krb5\_cc\_set\_config (C function)@\spxentry{krb5\_cc\_set\_config}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_set_config:c.krb5_cc_set_config}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_set\_config}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{id}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{id} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Configuration for a specific principal; if NULL, global for the whole cache - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Name of config variable - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Data to store, or NULL to remove - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{warning}{Warning:} -\sphinxAtStartPar -Before version 1.10 \sphinxstyleemphasis{data} was assumed to be always non\sphinxhyphen{}null. -\end{sphinxadmonition} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Existing configuration under the same key is over\sphinxhyphen{}written. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_set\_default\_name \sphinxhyphen{} Set the default credential cache name.} -\label{\detokenize{appdev/refs/api/krb5_cc_set_default_name:krb5-cc-set-default-name-set-the-default-credential-cache-name}}\label{\detokenize{appdev/refs/api/krb5_cc_set_default_name::doc}}\index{krb5\_cc\_set\_default\_name (C function)@\spxentry{krb5\_cc\_set\_default\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_set_default_name:c.krb5_cc_set_default_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_set\_default\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{name}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{name} \sphinxhyphen{} Default credential cache name or NULL - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KV5M\_CONTEXT Bad magic number for \_krb5\_context structure - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Set the default credential cache name to \sphinxstyleemphasis{name} for future operations using \sphinxstyleemphasis{context} . If \sphinxstyleemphasis{name} is NULL, clear any previous application\sphinxhyphen{}set default name and forget any cached value of the default name for \sphinxstyleemphasis{context} . - -\sphinxAtStartPar -Calls to this function invalidate the result of any previous calls to krb5\_cc\_default\_name() using \sphinxstyleemphasis{context} . - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_set\_flags \sphinxhyphen{} Set options flags on a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_set_flags:krb5-cc-set-flags-set-options-flags-on-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_set_flags::doc}}\index{krb5\_cc\_set\_flags (C function)@\spxentry{krb5\_cc\_set\_flags}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_set_flags:c.krb5_cc_set_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_set\_flags}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Flag bit mask - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function resets \sphinxstyleemphasis{cache} flags to \sphinxstyleemphasis{flags} . - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_start\_seq\_get \sphinxhyphen{} Prepare to sequentially read every credential in a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_start_seq_get:krb5-cc-start-seq-get-prepare-to-sequentially-read-every-credential-in-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_start_seq_get::doc}}\index{krb5\_cc\_start\_seq\_get (C function)@\spxentry{krb5\_cc\_start\_seq\_get}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_start_seq_get:c.krb5_cc_start_seq_get}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_start\_seq\_get}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cc_cursor:c.krb5_cc_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_cc\_cursor}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cursor}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Cursor - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -krb5\_cc\_end\_seq\_get() must be called to complete the retrieve operation. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If the cache represented by \sphinxstyleemphasis{cache} is modified between the time of the call to this function and the time of the final krb5\_cc\_end\_seq\_get(), these changes may not be reflected in the results of krb5\_cc\_next\_cred() calls. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_store\_cred \sphinxhyphen{} Store credentials in a credential cache.} -\label{\detokenize{appdev/refs/api/krb5_cc_store_cred:krb5-cc-store-cred-store-credentials-in-a-credential-cache}}\label{\detokenize{appdev/refs/api/krb5_cc_store_cred::doc}}\index{krb5\_cc\_store\_cred (C function)@\spxentry{krb5\_cc\_store\_cred}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_store_cred:c.krb5_cc_store_cred}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_store\_cred}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Credentials to be stored in cache - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Permission errors; storage failure errors; Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function stores \sphinxstyleemphasis{creds} into \sphinxstyleemphasis{cache} . If \sphinxstyleemphasis{creds\sphinxhyphen{}\textgreater{}server} and the server in the decoded ticket \sphinxstyleemphasis{creds\sphinxhyphen{}\textgreater{}ticket} differ, the credentials will be stored under both server principal names. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_support\_switch \sphinxhyphen{} Determine whether a credential cache type supports switching.} -\label{\detokenize{appdev/refs/api/krb5_cc_support_switch:krb5-cc-support-switch-determine-whether-a-credential-cache-type-supports-switching}}\label{\detokenize{appdev/refs/api/krb5_cc_support_switch::doc}}\index{krb5\_cc\_support\_switch (C function)@\spxentry{krb5\_cc\_support\_switch}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_support_switch:c.krb5_cc_support_switch}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_support\_switch}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{type}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{type} \sphinxhyphen{} Credential cache type - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if type supports switching - -\item {} -\sphinxAtStartPar -FALSE if it does not or is not a valid credential cache type. - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.10 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_switch \sphinxhyphen{} Make a credential cache the primary cache for its collection.} -\label{\detokenize{appdev/refs/api/krb5_cc_switch:krb5-cc-switch-make-a-credential-cache-the-primary-cache-for-its-collection}}\label{\detokenize{appdev/refs/api/krb5_cc_switch::doc}}\index{krb5\_cc\_switch (C function)@\spxentry{krb5\_cc\_switch}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_switch:c.krb5_cc_switch}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_switch}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{cache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success, or the type of cache doesn’t support switching - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -If the type of \sphinxstyleemphasis{cache} supports it, set \sphinxstyleemphasis{cache} to be the primary credential cache for the collection it belongs to. - -\sphinxstepscope - - -\subsubsection{krb5\_cccol\_cursor\_free \sphinxhyphen{} Free a credential cache collection cursor.} -\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_free:krb5-cccol-cursor-free-free-a-credential-cache-collection-cursor}}\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_free::doc}}\index{krb5\_cccol\_cursor\_free (C function)@\spxentry{krb5\_cccol\_cursor\_free}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_free:c.krb5_cccol_cursor_free}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cccol\_cursor\_free}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cccol_cursor:c.krb5_cccol_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_cccol\_cursor}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cursor}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Cursor - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_cccol\_cursor\_new(), krb5\_cccol\_cursor\_next() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_cccol\_cursor\_new \sphinxhyphen{} Prepare to iterate over the collection of known credential caches.} -\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_new:krb5-cccol-cursor-new-prepare-to-iterate-over-the-collection-of-known-credential-caches}}\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_new::doc}}\index{krb5\_cccol\_cursor\_new (C function)@\spxentry{krb5\_cccol\_cursor\_new}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_new:c.krb5_cccol_cursor_new}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cccol\_cursor\_new}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cccol_cursor:c.krb5_cccol_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_cccol\_cursor}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cursor}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Cursor - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Get a new cache iteration \sphinxstyleemphasis{cursor} that will iterate over all known credential caches independent of type. - -\sphinxAtStartPar -Use krb5\_cccol\_cursor\_free() to release \sphinxstyleemphasis{cursor} when it is no longer needed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_cccol\_cursor\_next() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_cccol\_cursor\_next \sphinxhyphen{} Get the next credential cache in the collection.} -\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_next:krb5-cccol-cursor-next-get-the-next-credential-cache-in-the-collection}}\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_next::doc}}\index{krb5\_cccol\_cursor\_next (C function)@\spxentry{krb5\_cccol\_cursor\_next}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cccol_cursor_next:c.krb5_cccol_cursor_next}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cccol\_cursor\_next}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cccol_cursor:c.krb5_cccol_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_cccol\_cursor}}}}\DUrole{w}{ }\DUrole{n}{cursor}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ccache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Cursor - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_cc\_close() to close \sphinxstyleemphasis{ccache} when it is no longer needed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_cccol\_cursor\_new(), krb5\_cccol\_cursor\_free() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -When all caches are iterated over and the end of the list is reached, \sphinxstyleemphasis{ccache} is set to NULL. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cccol\_have\_content \sphinxhyphen{} Check if the credential cache collection contains any initialized caches.} -\label{\detokenize{appdev/refs/api/krb5_cccol_have_content:krb5-cccol-have-content-check-if-the-credential-cache-collection-contains-any-initialized-caches}}\label{\detokenize{appdev/refs/api/krb5_cccol_have_content::doc}}\index{krb5\_cccol\_have\_content (C function)@\spxentry{krb5\_cccol\_have\_content}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cccol_have_content:c.krb5_cccol_have_content}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cccol\_have\_content}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 At least one initialized cache is present in the collection - -\item {} -\sphinxAtStartPar -KRB5\_CC\_NOTFOUND The collection contains no caches - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_clear\_error\_message \sphinxhyphen{} Clear the extended error message in a context.} -\label{\detokenize{appdev/refs/api/krb5_clear_error_message:krb5-clear-error-message-clear-the-extended-error-message-in-a-context}}\label{\detokenize{appdev/refs/api/krb5_clear_error_message::doc}}\index{krb5\_clear\_error\_message (C function)@\spxentry{krb5\_clear\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_clear_error_message:c.krb5_clear_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_clear\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\end{description}\end{quote} - -\sphinxAtStartPar -This function unsets the extended error message in a context, to ensure that it is not mistakenly applied to another occurrence of the same error code. - -\sphinxstepscope - - -\subsubsection{krb5\_check\_clockskew \sphinxhyphen{} Check if a timestamp is within the allowed clock skew of the current time.} -\label{\detokenize{appdev/refs/api/krb5_check_clockskew:krb5-check-clockskew-check-if-a-timestamp-is-within-the-allowed-clock-skew-of-the-current-time}}\label{\detokenize{appdev/refs/api/krb5_check_clockskew::doc}}\index{krb5\_check\_clockskew (C function)@\spxentry{krb5\_check\_clockskew}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_check_clockskew:c.krb5_check_clockskew}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_check\_clockskew}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{n}{date}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{date} \sphinxhyphen{} Timestamp to check - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5KRB\_AP\_ERR\_SKEW date is not within allowable clock skew - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function checks if \sphinxstyleemphasis{date} is close enough to the current time according to the configured allowable clock skew. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.10 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_addresses \sphinxhyphen{} Copy an array of addresses.} -\label{\detokenize{appdev/refs/api/krb5_copy_addresses:krb5-copy-addresses-copy-an-array-of-addresses}}\label{\detokenize{appdev/refs/api/krb5_copy_addresses::doc}}\index{krb5\_copy\_addresses (C function)@\spxentry{krb5\_copy\_addresses}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_addresses:c.krb5_copy_addresses}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_addresses}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inaddr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{outaddr}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inaddr} \sphinxhyphen{} Array of addresses to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outaddr} \sphinxhyphen{} Copy of array of addresses - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new address array containing a copy of \sphinxstyleemphasis{inaddr} . Use krb5\_free\_addresses() to free \sphinxstyleemphasis{outaddr} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_authdata \sphinxhyphen{} Copy an authorization data list.} -\label{\detokenize{appdev/refs/api/krb5_copy_authdata:krb5-copy-authdata-copy-an-authorization-data-list}}\label{\detokenize{appdev/refs/api/krb5_copy_authdata::doc}}\index{krb5\_copy\_authdata (C function)@\spxentry{krb5\_copy\_authdata}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_authdata:c.krb5_copy_authdata}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_authdata}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_authdat}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_authdat} \sphinxhyphen{} List of \sphinxstyleemphasis{krb5\_authdata} structures - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} New array of \sphinxstyleemphasis{krb5\_authdata} structures - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new authorization data list containing a copy of \sphinxstyleemphasis{in\_authdat} , which must be null\sphinxhyphen{}terminated. Use krb5\_free\_authdata() to free \sphinxstyleemphasis{out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The last array entry in \sphinxstyleemphasis{in\_authdat} must be a NULL pointer. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_authenticator \sphinxhyphen{} Copy a krb5\_authenticator structure.} -\label{\detokenize{appdev/refs/api/krb5_copy_authenticator:krb5-copy-authenticator-copy-a-krb5-authenticator-structure}}\label{\detokenize{appdev/refs/api/krb5_copy_authenticator::doc}}\index{krb5\_copy\_authenticator (C function)@\spxentry{krb5\_copy\_authenticator}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_authenticator:c.krb5_copy_authenticator}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_authenticator}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{authfrom}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{authto}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{authfrom} \sphinxhyphen{} krb5\_authenticator structure to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{authto} \sphinxhyphen{} Copy of krb5\_authenticator structure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new krb5\_authenticator structure with the content of \sphinxstyleemphasis{authfrom} . Use krb5\_free\_authenticator() to free \sphinxstyleemphasis{authto} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_checksum \sphinxhyphen{} Copy a krb5\_checksum structure.} -\label{\detokenize{appdev/refs/api/krb5_copy_checksum:krb5-copy-checksum-copy-a-krb5-checksum-structure}}\label{\detokenize{appdev/refs/api/krb5_copy_checksum::doc}}\index{krb5\_copy\_checksum (C function)@\spxentry{krb5\_copy\_checksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_checksum:c.krb5_copy_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_checksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ckfrom}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ckto}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ckfrom} \sphinxhyphen{} Checksum to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ckto} \sphinxhyphen{} Copy of krb5\_checksum structure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new krb5\_checksum structure with the contents of \sphinxstyleemphasis{ckfrom} . Use krb5\_free\_checksum() to free \sphinxstyleemphasis{ckto} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_context \sphinxhyphen{} Copy a krb5\_context structure.} -\label{\detokenize{appdev/refs/api/krb5_copy_context:krb5-copy-context-copy-a-krb5-context-structure}}\label{\detokenize{appdev/refs/api/krb5_copy_context::doc}}\index{krb5\_copy\_context (C function)@\spxentry{krb5\_copy\_context}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_context:c.krb5_copy_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_context}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{nctx\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{nctx\_out} \sphinxhyphen{} New context structure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The newly created context must be released by calling krb5\_free\_context() when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_creds \sphinxhyphen{} Copy a krb5\_creds structure.} -\label{\detokenize{appdev/refs/api/krb5_copy_creds:krb5-copy-creds-copy-a-krb5-creds-structure}}\label{\detokenize{appdev/refs/api/krb5_copy_creds::doc}}\index{krb5\_copy\_creds (C function)@\spxentry{krb5\_copy\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_creds:c.krb5_copy_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{incred}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{outcred}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{incred} \sphinxhyphen{} Credentials structure to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outcred} \sphinxhyphen{} Copy of \sphinxstyleemphasis{incred} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new credential with the contents of \sphinxstyleemphasis{incred} . Use krb5\_free\_creds() to free \sphinxstyleemphasis{outcred} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_data \sphinxhyphen{} Copy a krb5\_data object.} -\label{\detokenize{appdev/refs/api/krb5_copy_data:krb5-copy-data-copy-a-krb5-data-object}}\label{\detokenize{appdev/refs/api/krb5_copy_data::doc}}\index{krb5\_copy\_data (C function)@\spxentry{krb5\_copy\_data}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_data:c.krb5_copy_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_data}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{indata}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{outdata}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{indata} \sphinxhyphen{} Data object to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outdata} \sphinxhyphen{} Copy of \sphinxstyleemphasis{indata} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new krb5\_data object with the contents of \sphinxstyleemphasis{indata} . Use krb5\_free\_data() to free \sphinxstyleemphasis{outdata} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_error\_message \sphinxhyphen{} Copy the most recent extended error message from one context to another.} -\label{\detokenize{appdev/refs/api/krb5_copy_error_message:krb5-copy-error-message-copy-the-most-recent-extended-error-message-from-one-context-to-another}}\label{\detokenize{appdev/refs/api/krb5_copy_error_message::doc}}\index{krb5\_copy\_error\_message (C function)@\spxentry{krb5\_copy\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_error_message:c.krb5_copy_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{dest\_ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{src\_ctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{dest\_ctx} \sphinxhyphen{} Library context to copy message to - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{src\_ctx} \sphinxhyphen{} Library context with current message - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_keyblock \sphinxhyphen{} Copy a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_copy_keyblock:krb5-copy-keyblock-copy-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_copy_keyblock::doc}}\index{krb5\_copy\_keyblock (C function)@\spxentry{krb5\_copy\_keyblock}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_keyblock:c.krb5_copy_keyblock}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_keyblock}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{from}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{to}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{from} \sphinxhyphen{} Keyblock to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{to} \sphinxhyphen{} Copy of keyblock \sphinxstyleemphasis{from} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new keyblock with the same contents as \sphinxstyleemphasis{from} . Use krb5\_free\_keyblock() to free \sphinxstyleemphasis{to} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_keyblock\_contents \sphinxhyphen{} Copy the contents of a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_copy_keyblock_contents:krb5-copy-keyblock-contents-copy-the-contents-of-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_copy_keyblock_contents::doc}}\index{krb5\_copy\_keyblock\_contents (C function)@\spxentry{krb5\_copy\_keyblock\_contents}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_keyblock_contents:c.krb5_copy_keyblock_contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_keyblock\_contents}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{from}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{to}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{from} \sphinxhyphen{} Key to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{to} \sphinxhyphen{} Output key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function copies the contents of \sphinxstyleemphasis{from} to \sphinxstyleemphasis{to} . Use krb5\_free\_keyblock\_contents() to free \sphinxstyleemphasis{to} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_principal \sphinxhyphen{} Copy a principal.} -\label{\detokenize{appdev/refs/api/krb5_copy_principal:krb5-copy-principal-copy-a-principal}}\label{\detokenize{appdev/refs/api/krb5_copy_principal::doc}}\index{krb5\_copy\_principal (C function)@\spxentry{krb5\_copy\_principal}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_principal:c.krb5_copy_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_principal}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{inprinc}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{outprinc}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inprinc} \sphinxhyphen{} Principal to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outprinc} \sphinxhyphen{} Copy of \sphinxstyleemphasis{inprinc} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new principal structure with the contents of \sphinxstyleemphasis{inprinc} . Use krb5\_free\_principal() to free \sphinxstyleemphasis{outprinc} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_copy\_ticket \sphinxhyphen{} Copy a krb5\_ticket structure.} -\label{\detokenize{appdev/refs/api/krb5_copy_ticket:krb5-copy-ticket-copy-a-krb5-ticket-structure}}\label{\detokenize{appdev/refs/api/krb5_copy_ticket::doc}}\index{krb5\_copy\_ticket (C function)@\spxentry{krb5\_copy\_ticket}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_copy_ticket:c.krb5_copy_ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_copy\_ticket}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{from}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{pto}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{from} \sphinxhyphen{} Ticket to be copied - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{pto} \sphinxhyphen{} Copy of ticket - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new krb5\_ticket structure containing the contents of \sphinxstyleemphasis{from} . Use krb5\_free\_ticket() to free \sphinxstyleemphasis{pto} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_find\_authdata \sphinxhyphen{} Find authorization data elements.} -\label{\detokenize{appdev/refs/api/krb5_find_authdata:krb5-find-authdata-find-authorization-data-elements}}\label{\detokenize{appdev/refs/api/krb5_find_authdata::doc}}\index{krb5\_find\_authdata (C function)@\spxentry{krb5\_find\_authdata}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_find_authdata:c.krb5_find_authdata}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_find\_authdata}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ticket\_authdata}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ap\_req\_authdata}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdatatype:c.krb5_authdatatype}]{\sphinxcrossref{\DUrole{n}{krb5\_authdatatype}}}}\DUrole{w}{ }\DUrole{n}{ad\_type}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{results}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ticket\_authdata} \sphinxhyphen{} Authorization data list from ticket - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ap\_req\_authdata} \sphinxhyphen{} Authorization data list from AP request - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ad\_type} \sphinxhyphen{} Authorization data type to find - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{results} \sphinxhyphen{} List of matching entries - -\end{description}\end{quote} - -\sphinxAtStartPar -This function searches \sphinxstyleemphasis{ticket\_authdata} and \sphinxstyleemphasis{ap\_req\_authdata} for elements of type \sphinxstyleemphasis{ad\_type} . Either input list may be NULL, in which case it will not be searched; otherwise, the input lists must be terminated by NULL entries. This function will search inside AD\sphinxhyphen{}IF\sphinxhyphen{}RELEVANT containers if found in either list. Use krb5\_free\_authdata() to free \sphinxstyleemphasis{results} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.10 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_addresses \sphinxhyphen{} Free the data stored in array of addresses.} -\label{\detokenize{appdev/refs/api/krb5_free_addresses:krb5-free-addresses-free-the-data-stored-in-array-of-addresses}}\label{\detokenize{appdev/refs/api/krb5_free_addresses::doc}}\index{krb5\_free\_addresses (C function)@\spxentry{krb5\_free\_addresses}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_addresses:c.krb5_free_addresses}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_addresses}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Array of addresses to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the array itself. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The last entry in the array must be a NULL pointer. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_ap\_rep\_enc\_part \sphinxhyphen{} Free a krb5\_ap\_rep\_enc\_part structure.} -\label{\detokenize{appdev/refs/api/krb5_free_ap_rep_enc_part:krb5-free-ap-rep-enc-part-free-a-krb5-ap-rep-enc-part-structure}}\label{\detokenize{appdev/refs/api/krb5_free_ap_rep_enc_part::doc}}\index{krb5\_free\_ap\_rep\_enc\_part (C function)@\spxentry{krb5\_free\_ap\_rep\_enc\_part}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_ap_rep_enc_part:c.krb5_free_ap_rep_enc_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_ap\_rep\_enc\_part}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} AP\sphinxhyphen{}REP enc part to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_authdata \sphinxhyphen{} Free the storage assigned to array of authentication data.} -\label{\detokenize{appdev/refs/api/krb5_free_authdata:krb5-free-authdata-free-the-storage-assigned-to-array-of-authentication-data}}\label{\detokenize{appdev/refs/api/krb5_free_authdata::doc}}\index{krb5\_free\_authdata (C function)@\spxentry{krb5\_free\_authdata}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_authdata:c.krb5_free_authdata}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_authdata}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Array of authentication data to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the array itself. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The last entry in the array must be a NULL pointer. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_authenticator \sphinxhyphen{} Free a krb5\_authenticator structure.} -\label{\detokenize{appdev/refs/api/krb5_free_authenticator:krb5-free-authenticator-free-a-krb5-authenticator-structure}}\label{\detokenize{appdev/refs/api/krb5_free_authenticator::doc}}\index{krb5\_free\_authenticator (C function)@\spxentry{krb5\_free\_authenticator}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_authenticator:c.krb5_free_authenticator}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_authenticator}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Authenticator structure to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_cred\_contents \sphinxhyphen{} Free the contents of a krb5\_creds structure.} -\label{\detokenize{appdev/refs/api/krb5_free_cred_contents:krb5-free-cred-contents-free-the-contents-of-a-krb5-creds-structure}}\label{\detokenize{appdev/refs/api/krb5_free_cred_contents::doc}}\index{krb5\_free\_cred\_contents (C function)@\spxentry{krb5\_free\_cred\_contents}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_cred_contents:c.krb5_free_cred_contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_cred\_contents}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Credential structure to free contents of - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} , but not the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_creds \sphinxhyphen{} Free a krb5\_creds structure.} -\label{\detokenize{appdev/refs/api/krb5_free_creds:krb5-free-creds-free-a-krb5-creds-structure}}\label{\detokenize{appdev/refs/api/krb5_free_creds::doc}}\index{krb5\_free\_creds (C function)@\spxentry{krb5\_free\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_creds:c.krb5_free_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Credential structure to be freed. - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_data \sphinxhyphen{} Free a krb5\_data structure.} -\label{\detokenize{appdev/refs/api/krb5_free_data:krb5-free-data-free-a-krb5-data-structure}}\label{\detokenize{appdev/refs/api/krb5_free_data::doc}}\index{krb5\_free\_data (C function)@\spxentry{krb5\_free\_data}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_data:c.krb5_free_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_data}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Data structure to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_data\_contents \sphinxhyphen{} Free the contents of a krb5\_data structure and zero the data field.} -\label{\detokenize{appdev/refs/api/krb5_free_data_contents:krb5-free-data-contents-free-the-contents-of-a-krb5-data-structure-and-zero-the-data-field}}\label{\detokenize{appdev/refs/api/krb5_free_data_contents::doc}}\index{krb5\_free\_data\_contents (C function)@\spxentry{krb5\_free\_data\_contents}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_data_contents:c.krb5_free_data_contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_data\_contents}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Data structure to free contents of - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} , but not the structure itself. It sets the structure’s data pointer to null and (beginning in release 1.19) sets its length to zero. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_default\_realm \sphinxhyphen{} Free a default realm string returned by krb5\_get\_default\_realm().} -\label{\detokenize{appdev/refs/api/krb5_free_default_realm:krb5-free-default-realm-free-a-default-realm-string-returned-by-krb5-get-default-realm}}\label{\detokenize{appdev/refs/api/krb5_free_default_realm::doc}}\index{krb5\_free\_default\_realm (C function)@\spxentry{krb5\_free\_default\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_default_realm:c.krb5_free_default_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_default\_realm}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{lrealm}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{lrealm} \sphinxhyphen{} Realm to be freed - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_enctypes \sphinxhyphen{} Free an array of encryption types.} -\label{\detokenize{appdev/refs/api/krb5_free_enctypes:krb5-free-enctypes-free-an-array-of-encryption-types}}\label{\detokenize{appdev/refs/api/krb5_free_enctypes::doc}}\index{krb5\_free\_enctypes (C function)@\spxentry{krb5\_free\_enctypes}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_enctypes:c.krb5_free_enctypes}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_enctypes}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Array of enctypes to be freed - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.12 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_error \sphinxhyphen{} Free an error allocated by krb5\_read\_error() or krb5\_sendauth().} -\label{\detokenize{appdev/refs/api/krb5_free_error:krb5-free-error-free-an-error-allocated-by-krb5-read-error-or-krb5-sendauth}}\label{\detokenize{appdev/refs/api/krb5_free_error::doc}}\index{krb5\_free\_error (C function)@\spxentry{krb5\_free\_error}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_error:c.krb5_free_error}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_error}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Error data structure to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_host\_realm \sphinxhyphen{} Free the memory allocated by krb5\_get\_host\_realm().} -\label{\detokenize{appdev/refs/api/krb5_free_host_realm:krb5-free-host-realm-free-the-memory-allocated-by-krb5-get-host-realm}}\label{\detokenize{appdev/refs/api/krb5_free_host_realm::doc}}\index{krb5\_free\_host\_realm (C function)@\spxentry{krb5\_free\_host\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_host_realm:c.krb5_free_host_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_host\_realm}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realmlist}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{realmlist} \sphinxhyphen{} List of realm names to be released - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_keyblock \sphinxhyphen{} Free a krb5\_keyblock structure.} -\label{\detokenize{appdev/refs/api/krb5_free_keyblock:krb5-free-keyblock-free-a-krb5-keyblock-structure}}\label{\detokenize{appdev/refs/api/krb5_free_keyblock::doc}}\index{krb5\_free\_keyblock (C function)@\spxentry{krb5\_free\_keyblock}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_keyblock:c.krb5_free_keyblock}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_keyblock}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Keyblock to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_keyblock\_contents \sphinxhyphen{} Free the contents of a krb5\_keyblock structure.} -\label{\detokenize{appdev/refs/api/krb5_free_keyblock_contents:krb5-free-keyblock-contents-free-the-contents-of-a-krb5-keyblock-structure}}\label{\detokenize{appdev/refs/api/krb5_free_keyblock_contents::doc}}\index{krb5\_free\_keyblock\_contents (C function)@\spxentry{krb5\_free\_keyblock\_contents}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_keyblock_contents:c.krb5_free_keyblock_contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_keyblock\_contents}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Keyblock to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{key} , but not the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_keytab\_entry\_contents \sphinxhyphen{} Free the contents of a key table entry.} -\label{\detokenize{appdev/refs/api/krb5_free_keytab_entry_contents:krb5-free-keytab-entry-contents-free-the-contents-of-a-key-table-entry}}\label{\detokenize{appdev/refs/api/krb5_free_keytab_entry_contents::doc}}\index{krb5\_free\_keytab\_entry\_contents (C function)@\spxentry{krb5\_free\_keytab\_entry\_contents}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_keytab_entry_contents:c.krb5_free_keytab_entry_contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_keytab\_entry\_contents}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{entry}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{entry} \sphinxhyphen{} Key table entry whose contents are to be freed - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The pointer is not freed. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_string \sphinxhyphen{} Free a string allocated by a krb5 function.} -\label{\detokenize{appdev/refs/api/krb5_free_string:krb5-free-string-free-a-string-allocated-by-a-krb5-function}}\label{\detokenize{appdev/refs/api/krb5_free_string::doc}}\index{krb5\_free\_string (C function)@\spxentry{krb5\_free\_string}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_string:c.krb5_free_string}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_string}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} String to be freed - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.10 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_ticket \sphinxhyphen{} Free a ticket.} -\label{\detokenize{appdev/refs/api/krb5_free_ticket:krb5-free-ticket-free-a-ticket}}\label{\detokenize{appdev/refs/api/krb5_free_ticket::doc}}\index{krb5\_free\_ticket (C function)@\spxentry{krb5\_free\_ticket}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_ticket:c.krb5_free_ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_ticket}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Ticket to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_unparsed\_name \sphinxhyphen{} Free a string representation of a principal.} -\label{\detokenize{appdev/refs/api/krb5_free_unparsed_name:krb5-free-unparsed-name-free-a-string-representation-of-a-principal}}\label{\detokenize{appdev/refs/api/krb5_free_unparsed_name::doc}}\index{krb5\_free\_unparsed\_name (C function)@\spxentry{krb5\_free\_unparsed\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_unparsed_name:c.krb5_free_unparsed_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_unparsed\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Name string to be freed - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_etype\_info \sphinxhyphen{} Retrieve enctype, salt and s2kparams from KDC.} -\label{\detokenize{appdev/refs/api/krb5_get_etype_info:krb5-get-etype-info-retrieve-enctype-salt-and-s2kparams-from-kdc}}\label{\detokenize{appdev/refs/api/krb5_get_etype_info::doc}}\index{krb5\_get\_etype\_info (C function)@\spxentry{krb5\_get\_etype\_info}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_etype_info:c.krb5_get_etype_info}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_etype\_info}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{enctype\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{salt\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{s2kparams\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal whose information is requested - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{opt} \sphinxhyphen{} Initial credential options - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{enctype\_out} \sphinxhyphen{} The enctype chosen by KDC - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{salt\_out} \sphinxhyphen{} Salt returned from KDC - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{s2kparams\_out} \sphinxhyphen{} String\sphinxhyphen{}to\sphinxhyphen{}key parameters returned from KDC - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -A Kerberos error code - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Send an initial ticket request for \sphinxstyleemphasis{principal} and extract the encryption type, salt type, and string\sphinxhyphen{}to\sphinxhyphen{}key parameters from the KDC response. If the KDC provides no etype\sphinxhyphen{}info, set \sphinxstyleemphasis{enctype\_out} to \sphinxstylestrong{ENCTYPE\_NULL} and set \sphinxstyleemphasis{salt\_out} and \sphinxstyleemphasis{s2kparams\_out} to empty. If the KDC etype\sphinxhyphen{}info provides no salt, compute the default salt and place it in \sphinxstyleemphasis{salt\_out} . If the KDC etype\sphinxhyphen{}info provides no string\sphinxhyphen{}to\sphinxhyphen{}key parameters, set \sphinxstyleemphasis{s2kparams\_out} to empty. -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{opt} may be used to specify options which affect the initial request, such as request encryption types or a FAST armor cache (see krb5\_get\_init\_creds\_opt\_set\_etype\_list() and krb5\_get\_init\_creds\_opt\_set\_fast\_ccache\_name()). -\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{salt\_out} and \sphinxstyleemphasis{s2kparams\_out} when they are no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.17 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_permitted\_enctypes \sphinxhyphen{} Return a list of encryption types permitted for session keys.} -\label{\detokenize{appdev/refs/api/krb5_get_permitted_enctypes:krb5-get-permitted-enctypes-return-a-list-of-encryption-types-permitted-for-session-keys}}\label{\detokenize{appdev/refs/api/krb5_get_permitted_enctypes::doc}}\index{krb5\_get\_permitted\_enctypes (C function)@\spxentry{krb5\_get\_permitted\_enctypes}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_permitted_enctypes:c.krb5_get_permitted_enctypes}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_permitted\_enctypes}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ktypes}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ktypes} \sphinxhyphen{} Zero\sphinxhyphen{}terminated list of encryption types - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function returns the list of encryption types permitted for session keys within \sphinxstyleemphasis{context} , as determined by configuration or by a previous call to krb5\_set\_default\_tgs\_enctypes(). - -\sphinxAtStartPar -Use krb5\_free\_enctypes() to free \sphinxstyleemphasis{ktypes} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_server\_rcache \sphinxhyphen{} Generate a replay cache object for server use and open it.} -\label{\detokenize{appdev/refs/api/krb5_get_server_rcache:krb5-get-server-rcache-generate-a-replay-cache-object-for-server-use-and-open-it}}\label{\detokenize{appdev/refs/api/krb5_get_server_rcache::doc}}\index{krb5\_get\_server\_rcache (C function)@\spxentry{krb5\_get\_server\_rcache}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_server_rcache:c.krb5_get_server_rcache}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_server\_rcache}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{piece}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_rcache:c.krb5_rcache}]{\sphinxcrossref{\DUrole{n}{krb5\_rcache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rcptr}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{piece} \sphinxhyphen{} Unused (replay cache identifier) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rcptr} \sphinxhyphen{} Handle to an open rcache - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a handle to the default replay cache. Use krb5\_rc\_close() to close \sphinxstyleemphasis{rcptr} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Prior to release 1.18, this function creates a handle to a different replay cache for each unique value of \sphinxstyleemphasis{piece} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_time\_offsets \sphinxhyphen{} Return the time offsets from the os context.} -\label{\detokenize{appdev/refs/api/krb5_get_time_offsets:krb5-get-time-offsets-return-the-time-offsets-from-the-os-context}}\label{\detokenize{appdev/refs/api/krb5_get_time_offsets::doc}}\index{krb5\_get\_time\_offsets (C function)@\spxentry{krb5\_get\_time\_offsets}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_time_offsets:c.krb5_get_time_offsets}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_time\_offsets}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{seconds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{microseconds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{seconds} \sphinxhyphen{} Time offset, seconds portion - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{microseconds} \sphinxhyphen{} Time offset, microseconds portion - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function returns the time offsets in \sphinxstyleemphasis{context} . - -\sphinxstepscope - - -\subsubsection{krb5\_init\_context\_profile \sphinxhyphen{} Create a krb5 library context using a specified profile.} -\label{\detokenize{appdev/refs/api/krb5_init_context_profile:krb5-init-context-profile-create-a-krb5-library-context-using-a-specified-profile}}\label{\detokenize{appdev/refs/api/krb5_init_context_profile::doc}}\index{krb5\_init\_context\_profile (C function)@\spxentry{krb5\_init\_context\_profile}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_context_profile:c.krb5_init_context_profile}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_context\_profile}}}}{\DUrole{k}{struct}\DUrole{w}{ }\DUrole{n}{\_profile\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{profile}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{flags}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{profile} \sphinxhyphen{} Profile object (NULL to create default profile) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Context initialization flags - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\end{description}\end{quote} - -\sphinxAtStartPar -Create a context structure, optionally using a specified profile and initialization flags. If \sphinxstyleemphasis{profile} is NULL, the default profile will be created from config files. If \sphinxstyleemphasis{profile} is non\sphinxhyphen{}null, a copy of it will be made for the new context; the caller should still clean up its copy. Valid flag values are: -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_INIT\_CONTEXT\_SECURE Ignore environment variables - -\item {} -\sphinxAtStartPar -KRB5\_INIT\_CONTEXT\_KDC Use KDC configuration if creating profile - -\end{itemize} - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_free \sphinxhyphen{} Free an initial credentials context.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_free:krb5-init-creds-free-free-an-initial-credentials-context}}\label{\detokenize{appdev/refs/api/krb5_init_creds_free::doc}}\index{krb5\_init\_creds\_free (C function)@\spxentry{krb5\_init\_creds\_free}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_free:c.krb5_init_creds_free}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_free}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\end{description}\end{quote} -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{context} must be the same as the one passed to krb5\_init\_creds\_init() for this initial credentials context. -\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_get \sphinxhyphen{} Acquire credentials using an initial credentials context.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_get:krb5-init-creds-get-acquire-credentials-using-an-initial-credentials-context}}\label{\detokenize{appdev/refs/api/krb5_init_creds_get::doc}}\index{krb5\_init\_creds\_get (C function)@\spxentry{krb5\_init\_creds\_get}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_get:c.krb5_init_creds_get}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_get}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function synchronously obtains credentials using a context created by krb5\_init\_creds\_init(). On successful return, the credentials can be retrieved with krb5\_init\_creds\_get\_creds(). -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{context} must be the same as the one passed to krb5\_init\_creds\_init() for this initial credentials context. -\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_get\_creds \sphinxhyphen{} Retrieve acquired credentials from an initial credentials context.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_get_creds:krb5-init-creds-get-creds-retrieve-acquired-credentials-from-an-initial-credentials-context}}\label{\detokenize{appdev/refs/api/krb5_init_creds_get_creds::doc}}\index{krb5\_init\_creds\_get\_creds (C function)@\spxentry{krb5\_init\_creds\_get\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_get_creds:c.krb5_init_creds_get_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_get\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Acquired credentials - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function copies the acquired initial credentials from \sphinxstyleemphasis{ctx} into \sphinxstyleemphasis{creds} , after the successful completion of krb5\_init\_creds\_get() or krb5\_init\_creds\_step(). Use krb5\_free\_cred\_contents() to free \sphinxstyleemphasis{creds} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_get\_error \sphinxhyphen{} Get the last error from KDC from an initial credentials context.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_get_error:krb5-init-creds-get-error-get-the-last-error-from-kdc-from-an-initial-credentials-context}}\label{\detokenize{appdev/refs/api/krb5_init_creds_get_error::doc}}\index{krb5\_init\_creds\_get\_error (C function)@\spxentry{krb5\_init\_creds\_get\_error}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_get_error:c.krb5_init_creds_get_error}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_get\_error}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{error}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{error} \sphinxhyphen{} Error from KDC, or NULL if none was received - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_get\_times \sphinxhyphen{} Retrieve ticket times from an initial credentials context.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_get_times:krb5-init-creds-get-times-retrieve-ticket-times-from-an-initial-credentials-context}}\label{\detokenize{appdev/refs/api/krb5_init_creds_get_times::doc}}\index{krb5\_init\_creds\_get\_times (C function)@\spxentry{krb5\_init\_creds\_get\_times}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_get_times:c.krb5_init_creds_get_times}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_get\_times}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{times}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{times} \sphinxhyphen{} Ticket times for acquired credentials - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The initial credentials context must have completed obtaining credentials via either krb5\_init\_creds\_get() or krb5\_init\_creds\_step(). - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_init \sphinxhyphen{} Create a context for acquiring initial credentials.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_init:krb5-init-creds-init-create-a-context-for-acquiring-initial-credentials}}\label{\detokenize{appdev/refs/api/krb5_init_creds_init::doc}}\index{krb5\_init\_creds\_init (C function)@\spxentry{krb5\_init\_creds\_init}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_init:c.krb5_init_creds_init}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_init}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{client}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_prompter_fct:c.krb5_prompter_fct}]{\sphinxcrossref{\DUrole{n}{krb5\_prompter\_fct}}}}\DUrole{w}{ }\DUrole{n}{prompter}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\DUrole{n}{start\_time}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client} \sphinxhyphen{} Client principal to get initial creds for - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{prompter} \sphinxhyphen{} Prompter callback - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Prompter callback argument - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{start\_time} \sphinxhyphen{} Time when credentials become valid (0 for now) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{options} \sphinxhyphen{} Options structure (NULL for default) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} New initial credentials context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a new context for acquiring initial credentials. Use krb5\_init\_creds\_free() to free \sphinxstyleemphasis{ctx} when it is no longer needed. - -\sphinxAtStartPar -Any subsequent calls to krb5\_init\_creds\_step(), krb5\_init\_creds\_get(), or krb5\_init\_creds\_free() for this initial credentials context must use the same \sphinxstyleemphasis{context} argument as the one passed to this function. - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_set\_keytab \sphinxhyphen{} Specify a keytab to use for acquiring initial credentials.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_set_keytab:krb5-init-creds-set-keytab-specify-a-keytab-to-use-for-acquiring-initial-credentials}}\label{\detokenize{appdev/refs/api/krb5_init_creds_set_keytab::doc}}\index{krb5\_init\_creds\_set\_keytab (C function)@\spxentry{krb5\_init\_creds\_set\_keytab}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_set_keytab:c.krb5_init_creds_set_keytab}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_set\_keytab}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function supplies a keytab containing the client key for an initial credentials request. - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_set\_password \sphinxhyphen{} Set a password for acquiring initial credentials.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_set_password:krb5-init-creds-set-password-set-a-password-for-acquiring-initial-credentials}}\label{\detokenize{appdev/refs/api/krb5_init_creds_set_password::doc}}\index{krb5\_init\_creds\_set\_password (C function)@\spxentry{krb5\_init\_creds\_set\_password}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_set_password:c.krb5_init_creds_set_password}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_set\_password}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{password}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{password} \sphinxhyphen{} Password - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function supplies a password to be used to construct the client key for an initial credentials request. - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_set\_service \sphinxhyphen{} Specify a service principal for acquiring initial credentials.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_set_service:krb5-init-creds-set-service-specify-a-service-principal-for-acquiring-initial-credentials}}\label{\detokenize{appdev/refs/api/krb5_init_creds_set_service::doc}}\index{krb5\_init\_creds\_set\_service (C function)@\spxentry{krb5\_init\_creds\_set\_service}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_set_service:c.krb5_init_creds_set_service}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_set\_service}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{service}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{service} \sphinxhyphen{} Service principal string - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function supplies a service principal string to acquire initial credentials for instead of the default krbtgt service. \sphinxstyleemphasis{service} is parsed as a principal name; any realm part is ignored. - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_step \sphinxhyphen{} Get the next KDC request for acquiring initial credentials.} -\label{\detokenize{appdev/refs/api/krb5_init_creds_step:krb5-init-creds-step-get-the-next-kdc-request-for-acquiring-initial-credentials}}\label{\detokenize{appdev/refs/api/krb5_init_creds_step::doc}}\index{krb5\_init\_creds\_step (C function)@\spxentry{krb5\_init\_creds\_step}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_creds_step:c.krb5_init_creds_step}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_step}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_init\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Initial credentials context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in} \sphinxhyphen{} KDC response (empty on the first call) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} Next KDC request - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm for next KDC request - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Output flags - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function constructs the next KDC request in an initial credential exchange, allowing the caller to control the transport of KDC requests and replies. On the first call, \sphinxstyleemphasis{in} should be set to an empty buffer; on subsequent calls, it should be set to the KDC’s reply to the previous request. - -\sphinxAtStartPar -If more requests are needed, \sphinxstyleemphasis{flags} will be set to KRB5\_INIT\_CREDS\_STEP\_FLAG\_CONTINUE and the next request will be placed in \sphinxstyleemphasis{out} . If no more requests are needed, \sphinxstyleemphasis{flags} will not contain KRB5\_INIT\_CREDS\_STEP\_FLAG\_CONTINUE and \sphinxstyleemphasis{out} will be empty. - -\sphinxAtStartPar -If this function returns \sphinxstylestrong{KRB5KRB\_ERR\_RESPONSE\_TOO\_BIG} , the caller should transmit the next request using TCP rather than UDP. If this function returns any other error, the initial credential exchange has failed. -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{context} must be the same as the one passed to krb5\_init\_creds\_init() for this initial credentials context. -\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_init\_keyblock \sphinxhyphen{} Initialize an empty krb5\_keyblock .} -\label{\detokenize{appdev/refs/api/krb5_init_keyblock:krb5-init-keyblock-initialize-an-empty-krb5-keyblock}}\label{\detokenize{appdev/refs/api/krb5_init_keyblock::doc}}\index{krb5\_init\_keyblock (C function)@\spxentry{krb5\_init\_keyblock}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_keyblock:c.krb5_init_keyblock}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_keyblock}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{length}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{length} \sphinxhyphen{} Length of keyblock (or 0) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} New keyblock structure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Initialize a new keyblock and allocate storage for the contents of the key. It is legal to pass in a length of 0, in which case contents are left unallocated. Use krb5\_free\_keyblock() to free \sphinxstyleemphasis{out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If \sphinxstyleemphasis{length} is set to 0, contents are left unallocated. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_is\_referral\_realm \sphinxhyphen{} Check for a match with KRB5\_REFERRAL\_REALM.} -\label{\detokenize{appdev/refs/api/krb5_is_referral_realm:krb5-is-referral-realm-check-for-a-match-with-krb5-referral-realm}}\label{\detokenize{appdev/refs/api/krb5_is_referral_realm::doc}}\index{krb5\_is\_referral\_realm (C function)@\spxentry{krb5\_is\_referral\_realm}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_is_referral_realm:c.krb5_is_referral_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_is\_referral\_realm}}}}{\DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{r}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{r} \sphinxhyphen{} Realm to check - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if r is zero\sphinxhyphen{}length, FALSE otherwise - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_kdc\_sign\_ticket \sphinxhyphen{} Sign a PAC, possibly including a ticket signature.} -\label{\detokenize{appdev/refs/api/krb5_kdc_sign_ticket:krb5-kdc-sign-ticket-sign-a-pac-possibly-including-a-ticket-signature}}\label{\detokenize{appdev/refs/api/krb5_kdc_sign_ticket::doc}}\index{krb5\_kdc\_sign\_ticket (C function)@\spxentry{krb5\_kdc\_sign\_ticket}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kdc_sign_ticket:c.krb5_kdc_sign_ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kdc\_sign\_ticket}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{enc\_tkt}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{server\_princ}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{client\_princ}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{server}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{privsvr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{n}{with\_realm}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enc\_tkt} \sphinxhyphen{} The ticket for the signature - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server\_princ} \sphinxhyphen{} Canonical ticket server name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client\_princ} \sphinxhyphen{} PAC\_CLIENT\_INFO principal (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Key for server checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{privsvr} \sphinxhyphen{} Key for KDC and ticket checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{with\_realm} \sphinxhyphen{} If true, include the realm of \sphinxstyleemphasis{principal} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 on success, otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Sign \sphinxstyleemphasis{pac} using the keys \sphinxstyleemphasis{server} and \sphinxstyleemphasis{privsvr} . Include a ticket signature over \sphinxstyleemphasis{enc\_tkt} if \sphinxstyleemphasis{server\_princ} is not a TGS or kadmin/changepw principal name. Add the signed PAC’s encoding to the authorization data of \sphinxstyleemphasis{enc\_tkt} in the first slot, wrapped in an AD\sphinxhyphen{}IF\sphinxhyphen{}RELEVANT container. If \sphinxstyleemphasis{client\_princ} is non\sphinxhyphen{}null, add a PAC\_CLIENT\_INFO buffer, including the realm if \sphinxstyleemphasis{with\_realm} is true. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.20 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_kdc\_verify\_ticket \sphinxhyphen{} Verify a PAC, possibly including ticket signature.} -\label{\detokenize{appdev/refs/api/krb5_kdc_verify_ticket:krb5-kdc-verify-ticket-verify-a-pac-possibly-including-ticket-signature}}\label{\detokenize{appdev/refs/api/krb5_kdc_verify_ticket::doc}}\index{krb5\_kdc\_verify\_ticket (C function)@\spxentry{krb5\_kdc\_verify\_ticket}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kdc_verify_ticket:c.krb5_kdc_verify_ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kdc\_verify\_ticket}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{enc\_tkt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{server\_princ}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{server}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{privsvr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pac\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enc\_tkt} \sphinxhyphen{} Ticket enc\sphinxhyphen{}part, possibly containing a PAC - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server\_princ} \sphinxhyphen{} Canonicalized name of ticket server - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Key to validate server checksum (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{privsvr} \sphinxhyphen{} Key to validate KDC checksum (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{pac\_out} \sphinxhyphen{} Verified PAC (NULL if no PAC included) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -If a PAC is present in \sphinxstyleemphasis{enc\_tkt} , verify its signatures. If \sphinxstyleemphasis{privsvr} is not NULL and \sphinxstyleemphasis{server\_princ} is not a krbtgt or kadmin/changepw service, require a ticket signature over \sphinxstyleemphasis{enc\_tkt} in addition to the KDC signature. Place the verified PAC in \sphinxstyleemphasis{pac\_out} . If an invalid PAC signature is found, return an error matching the Windows KDC protocol code for that condition as closely as possible. - -\sphinxAtStartPar -If no PAC is present in \sphinxstyleemphasis{enc\_tkt} , set \sphinxstyleemphasis{pac\_out} to NULL and return successfully. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function does not validate the PAC\_CLIENT\_INFO buffer. If a specific value is expected, the caller can make a separate call to krb5\_pac\_verify\_ext() with a principal but no keys. -\end{sphinxadmonition} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.20 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_add\_entry \sphinxhyphen{} Add a new entry to a key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_add_entry:krb5-kt-add-entry-add-a-new-entry-to-a-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_add_entry::doc}}\index{krb5\_kt\_add\_entry (C function)@\spxentry{krb5\_kt\_add\_entry}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_add_entry:c.krb5_kt_add_entry}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_add\_entry}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{id}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{entry}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{id} \sphinxhyphen{} Key table handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{entry} \sphinxhyphen{} Entry to be added - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -ENOMEM Insufficient memory - -\item {} -\sphinxAtStartPar -KRB5\_KT\_NOWRITE Key table is not writeable - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_end\_seq\_get \sphinxhyphen{} Release a keytab cursor.} -\label{\detokenize{appdev/refs/api/krb5_kt_end_seq_get:krb5-kt-end-seq-get-release-a-keytab-cursor}}\label{\detokenize{appdev/refs/api/krb5_kt_end_seq_get::doc}}\index{krb5\_kt\_end\_seq\_get (C function)@\spxentry{krb5\_kt\_end\_seq\_get}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_end_seq_get:c.krb5_kt_end_seq_get}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_end\_seq\_get}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_kt_cursor:c.krb5_kt_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_kt\_cursor}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cursor}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Cursor - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function should be called to release the cursor created by krb5\_kt\_start\_seq\_get(). - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_get\_entry \sphinxhyphen{} Get an entry from a key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_get_entry:krb5-kt-get-entry-get-an-entry-from-a-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_get_entry::doc}}\index{krb5\_kt\_get\_entry (C function)@\spxentry{krb5\_kt\_get\_entry}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_get_entry:c.krb5_kt_get_entry}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_get\_entry}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_kvno:c.krb5_kvno}]{\sphinxcrossref{\DUrole{n}{krb5\_kvno}}}}\DUrole{w}{ }\DUrole{n}{vno}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{entry}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{vno} \sphinxhyphen{} Key version number (0 for highest available) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type (0 zero for any enctype) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{entry} \sphinxhyphen{} Returned entry from key table - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -Kerberos error codes on failure - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Retrieve an entry from a key table which matches the \sphinxstyleemphasis{keytab} , \sphinxstyleemphasis{principal} , \sphinxstyleemphasis{vno} , and \sphinxstyleemphasis{enctype} . If \sphinxstyleemphasis{vno} is zero, retrieve the highest\sphinxhyphen{}numbered kvno matching the other fields. If \sphinxstyleemphasis{enctype} is 0, match any enctype. - -\sphinxAtStartPar -Use krb5\_free\_keytab\_entry\_contents() to free \sphinxstyleemphasis{entry} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If \sphinxstyleemphasis{vno} is zero, the function retrieves the highest\sphinxhyphen{}numbered\sphinxhyphen{}kvno entry that matches the specified principal. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_have\_content \sphinxhyphen{} Check if a keytab exists and contains entries.} -\label{\detokenize{appdev/refs/api/krb5_kt_have_content:krb5-kt-have-content-check-if-a-keytab-exists-and-contains-entries}}\label{\detokenize{appdev/refs/api/krb5_kt_have_content::doc}}\index{krb5\_kt\_have\_content (C function)@\spxentry{krb5\_kt\_have\_content}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_have_content:c.krb5_kt_have_content}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_have\_content}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Keytab exists and contains entries - -\item {} -\sphinxAtStartPar -KRB5\_KT\_NOTFOUND Keytab does not contain entries - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.11 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_next\_entry \sphinxhyphen{} Retrieve the next entry from the key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_next_entry:krb5-kt-next-entry-retrieve-the-next-entry-from-the-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_next_entry::doc}}\index{krb5\_kt\_next\_entry (C function)@\spxentry{krb5\_kt\_next\_entry}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_next_entry:c.krb5_kt_next_entry}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_next\_entry}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{entry}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_kt_cursor:c.krb5_kt_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_kt\_cursor}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cursor}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{entry} \sphinxhyphen{} Returned key table entry - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Key table cursor - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5\_KT\_END \sphinxhyphen{} if the last entry was reached - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Return the next sequential entry in \sphinxstyleemphasis{keytab} and advance \sphinxstyleemphasis{cursor} . Callers must release the returned entry with krb5\_kt\_free\_entry(). - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_read\_service\_key \sphinxhyphen{} Retrieve a service key from a key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_read_service_key:krb5-kt-read-service-key-retrieve-a-service-key-from-a-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_read_service_key::doc}}\index{krb5\_kt\_read\_service\_key (C function)@\spxentry{krb5\_kt\_read\_service\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_read_service_key:c.krb5_kt_read_service_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_read\_service\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{keyprocarg}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_kvno:c.krb5_kvno}]{\sphinxcrossref{\DUrole{n}{krb5\_kvno}}}}\DUrole{w}{ }\DUrole{n}{vno}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keyprocarg} \sphinxhyphen{} Name of a key table (NULL to use default name) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Service principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{vno} \sphinxhyphen{} Key version number (0 for highest available) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type (0 for any type) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{key} \sphinxhyphen{} Service key from key table - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error code if not found or keyprocarg is invalid. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Open and search the specified key table for the entry identified by \sphinxstyleemphasis{principal} , \sphinxstyleemphasis{enctype} , and \sphinxstyleemphasis{vno} . If no key is found, return an error code. - -\sphinxAtStartPar -The default key table is used, unless \sphinxstyleemphasis{keyprocarg} is non\sphinxhyphen{}null. \sphinxstyleemphasis{keyprocarg} designates a specific key table. - -\sphinxAtStartPar -Use krb5\_free\_keyblock() to free \sphinxstyleemphasis{key} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_remove\_entry \sphinxhyphen{} Remove an entry from a key table.} -\label{\detokenize{appdev/refs/api/krb5_kt_remove_entry:krb5-kt-remove-entry-remove-an-entry-from-a-key-table}}\label{\detokenize{appdev/refs/api/krb5_kt_remove_entry::doc}}\index{krb5\_kt\_remove\_entry (C function)@\spxentry{krb5\_kt\_remove\_entry}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_remove_entry:c.krb5_kt_remove_entry}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_remove\_entry}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{id}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{entry}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{id} \sphinxhyphen{} Key table handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{entry} \sphinxhyphen{} Entry to remove from key table - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5\_KT\_NOWRITE Key table is not writable - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_start\_seq\_get \sphinxhyphen{} Start a sequential retrieval of key table entries.} -\label{\detokenize{appdev/refs/api/krb5_kt_start_seq_get:krb5-kt-start-seq-get-start-a-sequential-retrieval-of-key-table-entries}}\label{\detokenize{appdev/refs/api/krb5_kt_start_seq_get::doc}}\index{krb5\_kt\_start\_seq\_get (C function)@\spxentry{krb5\_kt\_start\_seq\_get}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_start_seq_get:c.krb5_kt_start_seq_get}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_start\_seq\_get}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_kt_cursor:c.krb5_kt_cursor}]{\sphinxcrossref{\DUrole{n}{krb5\_kt\_cursor}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cursor}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cursor} \sphinxhyphen{} Cursor - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Prepare to read sequentially every key in the specified key table. Use krb5\_kt\_end\_seq\_get() to release the cursor when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_make\_authdata\_kdc\_issued \sphinxhyphen{} Encode and sign AD\sphinxhyphen{}KDCIssued authorization data.} -\label{\detokenize{appdev/refs/api/krb5_make_authdata_kdc_issued:krb5-make-authdata-kdc-issued-encode-and-sign-ad-kdcissued-authorization-data}}\label{\detokenize{appdev/refs/api/krb5_make_authdata_kdc_issued::doc}}\index{krb5\_make\_authdata\_kdc\_issued (C function)@\spxentry{krb5\_make\_authdata\_kdc\_issued}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_make_authdata_kdc_issued:c.krb5_make_authdata_kdc_issued}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_make\_authdata\_kdc\_issued}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{issuer}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{authdata}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ad\_kdcissued}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Session key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{issuer} \sphinxhyphen{} The name of the issuing principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{authdata} \sphinxhyphen{} List of authorization data to be signed - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ad\_kdcissued} \sphinxhyphen{} List containing AD\sphinxhyphen{}KDCIssued authdata - -\end{description}\end{quote} - -\sphinxAtStartPar -This function wraps a list of authorization data entries \sphinxstyleemphasis{authdata} in an AD\sphinxhyphen{}KDCIssued container (see RFC 4120 section 5.2.6.2) signed with \sphinxstyleemphasis{key} . The result is returned in \sphinxstyleemphasis{ad\_kdcissued} as a single\sphinxhyphen{}element list. - -\sphinxstepscope - - -\subsubsection{krb5\_marshal\_credentials \sphinxhyphen{} Serialize a krb5\_creds object.} -\label{\detokenize{appdev/refs/api/krb5_marshal_credentials:krb5-marshal-credentials-serialize-a-krb5-creds-object}}\label{\detokenize{appdev/refs/api/krb5_marshal_credentials::doc}}\index{krb5\_marshal\_credentials (C function)@\spxentry{krb5\_marshal\_credentials}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_marshal_credentials:c.krb5_marshal_credentials}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_marshal\_credentials}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{data\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_creds} \sphinxhyphen{} The credentials object to serialize - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{data\_out} \sphinxhyphen{} The serialized credentials - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Serialize \sphinxstyleemphasis{creds} in the format used by the FILE ccache format (vesion 4) and KCM ccache protocol. - -\sphinxAtStartPar -Use krb5\_free\_data() to free \sphinxstyleemphasis{data\_out} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_merge\_authdata \sphinxhyphen{} Merge two authorization data lists into a new list.} -\label{\detokenize{appdev/refs/api/krb5_merge_authdata:krb5-merge-authdata-merge-two-authorization-data-lists-into-a-new-list}}\label{\detokenize{appdev/refs/api/krb5_merge_authdata::doc}}\index{krb5\_merge\_authdata (C function)@\spxentry{krb5\_merge\_authdata}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_merge_authdata:c.krb5_merge_authdata}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_merge\_authdata}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inauthdat1}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inauthdat2}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{outauthdat}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inauthdat1} \sphinxhyphen{} First list of \sphinxstyleemphasis{krb5\_authdata} structures - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inauthdat2} \sphinxhyphen{} Second list of \sphinxstyleemphasis{krb5\_authdata} structures - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outauthdat} \sphinxhyphen{} Merged list of \sphinxstyleemphasis{krb5\_authdata} structures - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Merge two authdata arrays, such as the array from a ticket and authenticator. Use krb5\_free\_authdata() to free \sphinxstyleemphasis{outauthdat} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The last array entry in \sphinxstyleemphasis{inauthdat1} and \sphinxstyleemphasis{inauthdat2} must be a NULL pointer. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_1cred \sphinxhyphen{} Format a KRB\sphinxhyphen{}CRED message for a single set of credentials.} -\label{\detokenize{appdev/refs/api/krb5_mk_1cred:krb5-mk-1cred-format-a-krb-cred-message-for-a-single-set-of-credentials}}\label{\detokenize{appdev/refs/api/krb5_mk_1cred::doc}}\index{krb5\_mk\_1cred (C function)@\spxentry{krb5\_mk\_1cred}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_1cred:c.krb5_mk_1cred}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_1cred}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{der\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rdata\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Pointer to credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{der\_out} \sphinxhyphen{} Encoded credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rdata\_out} \sphinxhyphen{} Replay cache data (NULL if not needed) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -ENOMEM Insufficient memory - -\item {} -\sphinxAtStartPar -KRB5\_RC\_REQUIRED Message replay detection requires rcache parameter - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This is a convenience function that calls krb5\_mk\_ncred() with a single set of credentials. - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_error \sphinxhyphen{} Format and encode a KRB\_ERROR message.} -\label{\detokenize{appdev/refs/api/krb5_mk_error:krb5-mk-error-format-and-encode-a-krb-error-message}}\label{\detokenize{appdev/refs/api/krb5_mk_error::doc}}\index{krb5\_mk\_error (C function)@\spxentry{krb5\_mk\_error}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_error:c.krb5_mk_error}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_error}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{dec\_err}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{enc\_err}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{dec\_err} \sphinxhyphen{} Error structure to be encoded - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{enc\_err} \sphinxhyphen{} Encoded error structure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates a \sphinxstylestrong{KRB\_ERROR} message in \sphinxstyleemphasis{enc\_err} . Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{enc\_err} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_ncred \sphinxhyphen{} Format a KRB\sphinxhyphen{}CRED message for an array of credentials.} -\label{\detokenize{appdev/refs/api/krb5_mk_ncred:krb5-mk-ncred-format-a-krb-cred-message-for-an-array-of-credentials}}\label{\detokenize{appdev/refs/api/krb5_mk_ncred::doc}}\index{krb5\_mk\_ncred (C function)@\spxentry{krb5\_mk\_ncred}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_ncred:c.krb5_mk_ncred}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_ncred}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{der\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rdata\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Null\sphinxhyphen{}terminated array of credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{der\_out} \sphinxhyphen{} Encoded credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rdata\_out} \sphinxhyphen{} Replay cache information (NULL if not needed) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -ENOMEM Insufficient memory - -\item {} -\sphinxAtStartPar -KRB5\_RC\_REQUIRED Message replay detection requires rcache parameter - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function takes an array of credentials \sphinxstyleemphasis{creds} and formats a \sphinxstylestrong{KRB\sphinxhyphen{}CRED} message \sphinxstyleemphasis{der\_out} to pass to krb5\_rd\_cred(). - -\sphinxAtStartPar -The local and remote addresses in \sphinxstyleemphasis{auth\_context} are optional; if either is specified, they are used to form the sender and receiver addresses in the KRB\sphinxhyphen{}CRED message. - -\sphinxAtStartPar -If the KRB5\_AUTH\_CONTEXT\_DO\_TIME flag is set in \sphinxstyleemphasis{auth\_context} , an entry for the message is entered in an in\sphinxhyphen{}memory replay cache to detect if the message is reflected by an attacker. If KRB5\_AUTH\_CONTEXT\_DO\_TIME is not set, no replay cache is used. If KRB5\_AUTH\_CONTEXT\_RET\_TIME is set in \sphinxstyleemphasis{auth\_context} , the timestamp used for the KRB\sphinxhyphen{}CRED message is stored in \sphinxstyleemphasis{rdata\_out} . - -\sphinxAtStartPar -If either KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE is set, the \sphinxstyleemphasis{auth\_context} local sequence number is included in the KRB\sphinxhyphen{}CRED message and then incremented. If KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE is set, the sequence number used is stored in \sphinxstyleemphasis{rdata\_out} . - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{der\_out} when it is no longer needed. - -\sphinxAtStartPar -The message will be encrypted using the send subkey of \sphinxstyleemphasis{auth\_context} if it is present, or the session key otherwise. If neither key is present, the credentials will not be encrypted, and the message should only be sent over a secure channel. No replay cache entry is used in this case. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The \sphinxstyleemphasis{rdata\_out} argument is required if the KRB5\_AUTH\_CONTEXT\_RET\_TIME or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE flag is set in \sphinxstyleemphasis{auth\_context} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_priv \sphinxhyphen{} Format a KRB\sphinxhyphen{}PRIV message.} -\label{\detokenize{appdev/refs/api/krb5_mk_priv:krb5-mk-priv-format-a-krb-priv-message}}\label{\detokenize{appdev/refs/api/krb5_mk_priv::doc}}\index{krb5\_mk\_priv (C function)@\spxentry{krb5\_mk\_priv}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_priv:c.krb5_mk_priv}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_priv}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{userdata}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{der\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rdata\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{userdata} \sphinxhyphen{} User data for \sphinxstylestrong{KRB\sphinxhyphen{}PRIV} message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{der\_out} \sphinxhyphen{} Formatted \sphinxstylestrong{KRB\sphinxhyphen{}PRIV} message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rdata\_out} \sphinxhyphen{} Replay data (NULL if not needed) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_mk\_safe(), but the message is encrypted and integrity\sphinxhyphen{}protected, not just integrity\sphinxhyphen{}protected. - -\sphinxAtStartPar -The local address in \sphinxstyleemphasis{auth\_context} must be set, and is used to form the sender address used in the KRB\sphinxhyphen{}PRIV message. The remote address is optional; if specified, it will be used to form the receiver address used in the message. - -\sphinxAtStartPar -If the KRB5\_AUTH\_CONTEXT\_DO\_TIME flag is set in \sphinxstyleemphasis{auth\_context} , a timestamp is included in the KRB\sphinxhyphen{}PRIV message, and an entry for the message is entered in an in\sphinxhyphen{}memory replay cache to detect if the message is reflected by an attacker. If KRB5\_AUTH\_CONTEXT\_DO\_TIME is not set, no replay cache is used. If KRB5\_AUTH\_CONTEXT\_RET\_TIME is set in \sphinxstyleemphasis{auth\_context} , a timestamp is included in the KRB\sphinxhyphen{}PRIV message and is stored in \sphinxstyleemphasis{rdata\_out} . - -\sphinxAtStartPar -If either KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE is set, the \sphinxstyleemphasis{auth\_context} local sequence number is included in the KRB\sphinxhyphen{}PRIV message and then incremented. If KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE is set, the sequence number used is stored in \sphinxstyleemphasis{rdata\_out} . - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{der\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The \sphinxstyleemphasis{rdata\_out} argument is required if the KRB5\_AUTH\_CONTEXT\_RET\_TIME or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE flag is set in \sphinxstyleemphasis{auth\_context} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_rep \sphinxhyphen{} Format and encrypt a KRB\_AP\_REP message.} -\label{\detokenize{appdev/refs/api/krb5_mk_rep:krb5-mk-rep-format-and-encrypt-a-krb-ap-rep-message}}\label{\detokenize{appdev/refs/api/krb5_mk_rep::doc}}\index{krb5\_mk\_rep (C function)@\spxentry{krb5\_mk\_rep}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_rep:c.krb5_mk_rep}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_rep}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{outbuf}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outbuf} \sphinxhyphen{} \sphinxstylestrong{AP\sphinxhyphen{}REP} message - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function fills in \sphinxstyleemphasis{outbuf} with an AP\sphinxhyphen{}REP message using information from \sphinxstyleemphasis{auth\_context} . - -\sphinxAtStartPar -If the flags in \sphinxstyleemphasis{auth\_context} indicate that a sequence number should be used (either KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE) and the local sequence number in \sphinxstyleemphasis{auth\_context} is 0, a new number will be generated with krb5\_generate\_seq\_number(). - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{outbuf} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_rep\_dce \sphinxhyphen{} Format and encrypt a KRB\_AP\_REP message for DCE RPC.} -\label{\detokenize{appdev/refs/api/krb5_mk_rep_dce:krb5-mk-rep-dce-format-and-encrypt-a-krb-ap-rep-message-for-dce-rpc}}\label{\detokenize{appdev/refs/api/krb5_mk_rep_dce::doc}}\index{krb5\_mk\_rep\_dce (C function)@\spxentry{krb5\_mk\_rep\_dce}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_rep_dce:c.krb5_mk_rep_dce}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_rep\_dce}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{outbuf}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outbuf} \sphinxhyphen{} \sphinxstylestrong{AP\sphinxhyphen{}REP} message - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{outbuf} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_req \sphinxhyphen{} Create a KRB\_AP\_REQ message.} -\label{\detokenize{appdev/refs/api/krb5_mk_req:krb5-mk-req-create-a-krb-ap-req-message}}\label{\detokenize{appdev/refs/api/krb5_mk_req::doc}}\index{krb5\_mk\_req (C function)@\spxentry{krb5\_mk\_req}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_req:c.krb5_mk_req}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_req}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{ap\_req\_options}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{service}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{hostname}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{outbuf}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Pre\sphinxhyphen{}existing or newly created auth context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ap\_req\_options} \sphinxhyphen{} Options (see AP\_OPTS macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{service} \sphinxhyphen{} Service name, or NULL to use \sphinxstylestrong{“host”} - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{hostname} \sphinxhyphen{} Host name, or NULL to use local hostname - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_data} \sphinxhyphen{} Application data to be checksummed in the authenticator, or NULL - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache used to obtain credentials for the desired service. - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outbuf} \sphinxhyphen{} \sphinxstylestrong{AP\sphinxhyphen{}REQ} message - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_mk\_req\_extended() except that it uses a given \sphinxstyleemphasis{hostname} , \sphinxstyleemphasis{service} , and \sphinxstyleemphasis{ccache} to construct a service principal name and obtain credentials. - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{outbuf} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_req\_extended \sphinxhyphen{} Create a KRB\_AP\_REQ message using supplied credentials.} -\label{\detokenize{appdev/refs/api/krb5_mk_req_extended:krb5-mk-req-extended-create-a-krb-ap-req-message-using-supplied-credentials}}\label{\detokenize{appdev/refs/api/krb5_mk_req_extended::doc}}\index{krb5\_mk\_req\_extended (C function)@\spxentry{krb5\_mk\_req\_extended}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_req_extended:c.krb5_mk_req_extended}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_req\_extended}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{ap\_req\_options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{outbuf}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Pre\sphinxhyphen{}existing or newly created auth context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ap\_req\_options} \sphinxhyphen{} Options (see AP\_OPTS macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_data} \sphinxhyphen{} Application data to be checksummed in the authenticator, or NULL - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_creds} \sphinxhyphen{} Credentials for the service with valid ticket and key - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{outbuf} \sphinxhyphen{} \sphinxstylestrong{AP\sphinxhyphen{}REQ} message - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Valid \sphinxstyleemphasis{ap\_req\_options} are: -\begin{quote} -\begin{itemize} -\item {} -\sphinxAtStartPar -AP\_OPTS\_USE\_SESSION\_KEY \sphinxhyphen{} Use the session key when creating the request used for user to user authentication. - -\item {} -\sphinxAtStartPar -AP\_OPTS\_MUTUAL\_REQUIRED \sphinxhyphen{} Request a mutual authentication packet from the receiver. - -\item {} -\sphinxAtStartPar -AP\_OPTS\_USE\_SUBKEY \sphinxhyphen{} Generate a subsession key from the current session key obtained from the credentials. - -\end{itemize} - -\sphinxAtStartPar -This function creates a KRB\_AP\_REQ message using supplied credentials \sphinxstyleemphasis{in\_creds} . \sphinxstyleemphasis{auth\_context} may point to an existing auth context or to NULL, in which case a new one will be created. If \sphinxstyleemphasis{in\_data} is non\sphinxhyphen{}null, a checksum of it will be included in the authenticator contained in the KRB\_AP\_REQ message. Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{outbuf} when it is no longer needed. -\end{quote} - -\sphinxAtStartPar -On successful return, the authenticator is stored in \sphinxstyleemphasis{auth\_context} with the \sphinxstyleemphasis{client} and \sphinxstyleemphasis{checksum} fields nulled out. (This is to prevent pointer\sphinxhyphen{}sharing problems; the caller should not need these fields anyway, since the caller supplied them.) - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_mk\_req() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_safe \sphinxhyphen{} Format a KRB\sphinxhyphen{}SAFE message.} -\label{\detokenize{appdev/refs/api/krb5_mk_safe:krb5-mk-safe-format-a-krb-safe-message}}\label{\detokenize{appdev/refs/api/krb5_mk_safe::doc}}\index{krb5\_mk\_safe (C function)@\spxentry{krb5\_mk\_safe}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_mk_safe:c.krb5_mk_safe}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_safe}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{userdata}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{der\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rdata\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{userdata} \sphinxhyphen{} User data in the message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{der\_out} \sphinxhyphen{} Formatted \sphinxstylestrong{KRB\sphinxhyphen{}SAFE} buffer - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rdata\_out} \sphinxhyphen{} Replay data. Specify NULL if not needed - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function creates an integrity protected \sphinxstylestrong{KRB\sphinxhyphen{}SAFE} message using data supplied by the application. - -\sphinxAtStartPar -Fields in \sphinxstyleemphasis{auth\_context} specify the checksum type, the keyblock that can be used to seed the checksum, full addresses (host and port) for the sender and receiver, and KRB5\_AUTH\_CONTEXT flags. - -\sphinxAtStartPar -The local address in \sphinxstyleemphasis{auth\_context} must be set, and is used to form the sender address used in the KRB\sphinxhyphen{}SAFE message. The remote address is optional; if specified, it will be used to form the receiver address used in the message. - -\sphinxAtStartPar -If the KRB5\_AUTH\_CONTEXT\_DO\_TIME flag is set in \sphinxstyleemphasis{auth\_context} , a timestamp is included in the KRB\sphinxhyphen{}SAFE message, and an entry for the message is entered in an in\sphinxhyphen{}memory replay cache to detect if the message is reflected by an attacker. If KRB5\_AUTH\_CONTEXT\_DO\_TIME is not set, no replay cache is used. If KRB5\_AUTH\_CONTEXT\_RET\_TIME is set in \sphinxstyleemphasis{auth\_context} , a timestamp is included in the KRB\sphinxhyphen{}SAFE message and is stored in \sphinxstyleemphasis{rdata\_out} . - -\sphinxAtStartPar -If either KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE is set, the \sphinxstyleemphasis{auth\_context} local sequence number is included in the KRB\sphinxhyphen{}SAFE message and then incremented. If KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE is set, the sequence number used is stored in \sphinxstyleemphasis{rdata\_out} . - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{der\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The \sphinxstyleemphasis{rdata\_out} argument is required if the KRB5\_AUTH\_CONTEXT\_RET\_TIME or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE flag is set in \sphinxstyleemphasis{auth\_context} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_os\_localaddr \sphinxhyphen{} Return all interface addresses for this host.} -\label{\detokenize{appdev/refs/api/krb5_os_localaddr:krb5-os-localaddr-return-all-interface-addresses-for-this-host}}\label{\detokenize{appdev/refs/api/krb5_os_localaddr::doc}}\index{krb5\_os\_localaddr (C function)@\spxentry{krb5\_os\_localaddr}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_os_localaddr:c.krb5_os_localaddr}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_os\_localaddr}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{addr}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{addr} \sphinxhyphen{} Array of krb5\_address pointers, ending with NULL - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_addresses() to free \sphinxstyleemphasis{addr} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_add\_buffer \sphinxhyphen{} Add a buffer to a PAC handle.} -\label{\detokenize{appdev/refs/api/krb5_pac_add_buffer:krb5-pac-add-buffer-add-a-buffer-to-a-pac-handle}}\label{\detokenize{appdev/refs/api/krb5_pac_add_buffer::doc}}\index{krb5\_pac\_add\_buffer (C function)@\spxentry{krb5\_pac\_add\_buffer}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_add_buffer:c.krb5_pac_add_buffer}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_add\_buffer}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}]{\sphinxcrossref{\DUrole{n}{krb5\_ui\_4}}}}\DUrole{w}{ }\DUrole{n}{type}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{type} \sphinxhyphen{} Buffer type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} contents - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function adds a buffer of type \sphinxstyleemphasis{type} and contents \sphinxstyleemphasis{data} to \sphinxstyleemphasis{pac} if there isn’t already a buffer of this type present. - -\sphinxAtStartPar -The valid values of \sphinxstyleemphasis{type} is one of the following: -\begin{itemize} -\item {} -\sphinxAtStartPar -KRB5\_PAC\_LOGON\_INFO \sphinxhyphen{} Logon information - -\item {} -\sphinxAtStartPar -KRB5\_PAC\_CREDENTIALS\_INFO \sphinxhyphen{} Credentials information - -\item {} -\sphinxAtStartPar -KRB5\_PAC\_SERVER\_CHECKSUM \sphinxhyphen{} Server checksum - -\item {} -\sphinxAtStartPar -KRB5\_PAC\_PRIVSVR\_CHECKSUM \sphinxhyphen{} KDC checksum - -\item {} -\sphinxAtStartPar -KRB5\_PAC\_CLIENT\_INFO \sphinxhyphen{} Client name and ticket information - -\item {} -\sphinxAtStartPar -KRB5\_PAC\_DELEGATION\_INFO \sphinxhyphen{} Constrained delegation information - -\item {} -\sphinxAtStartPar -KRB5\_PAC\_UPN\_DNS\_INFO \sphinxhyphen{} User principal name and DNS information - -\end{itemize} - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_free \sphinxhyphen{} Free a PAC handle.} -\label{\detokenize{appdev/refs/api/krb5_pac_free:krb5-pac-free-free-a-pac-handle}}\label{\detokenize{appdev/refs/api/krb5_pac_free::doc}}\index{krb5\_pac\_free (C function)@\spxentry{krb5\_pac\_free}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_free:c.krb5_pac_free}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_free}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{pac} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_get\_buffer \sphinxhyphen{} Retrieve a buffer value from a PAC.} -\label{\detokenize{appdev/refs/api/krb5_pac_get_buffer:krb5-pac-get-buffer-retrieve-a-buffer-value-from-a-pac}}\label{\detokenize{appdev/refs/api/krb5_pac_get_buffer::doc}}\index{krb5\_pac\_get\_buffer (C function)@\spxentry{krb5\_pac\_get\_buffer}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_get_buffer:c.krb5_pac_get_buffer}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_get\_buffer}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}]{\sphinxcrossref{\DUrole{n}{krb5\_ui\_4}}}}\DUrole{w}{ }\DUrole{n}{type}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{type} \sphinxhyphen{} Type of buffer to retrieve - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{data} \sphinxhyphen{} Buffer value - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{data} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_get\_types \sphinxhyphen{} Return an array of buffer types in a PAC handle.} -\label{\detokenize{appdev/refs/api/krb5_pac_get_types:krb5-pac-get-types-return-an-array-of-buffer-types-in-a-pac-handle}}\label{\detokenize{appdev/refs/api/krb5_pac_get_types::doc}}\index{krb5\_pac\_get\_types (C function)@\spxentry{krb5\_pac\_get\_types}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_get_types:c.krb5_pac_get_types}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_get\_types}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{len}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}]{\sphinxcrossref{\DUrole{n}{krb5\_ui\_4}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{types}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{len} \sphinxhyphen{} Number of entries in \sphinxstyleemphasis{types} - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{types} \sphinxhyphen{} Array of buffer types - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_init \sphinxhyphen{} Create an empty Privilege Attribute Certificate (PAC) handle.} -\label{\detokenize{appdev/refs/api/krb5_pac_init:krb5-pac-init-create-an-empty-privilege-attribute-certificate-pac-handle}}\label{\detokenize{appdev/refs/api/krb5_pac_init::doc}}\index{krb5\_pac\_init (C function)@\spxentry{krb5\_pac\_init}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_init:c.krb5_pac_init}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_init}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pac}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{pac} \sphinxhyphen{} New PAC handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_pac\_free() to free \sphinxstyleemphasis{pac} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_parse \sphinxhyphen{} Unparse an encoded PAC into a new handle.} -\label{\detokenize{appdev/refs/api/krb5_pac_parse:krb5-pac-parse-unparse-an-encoded-pac-into-a-new-handle}}\label{\detokenize{appdev/refs/api/krb5_pac_parse::doc}}\index{krb5\_pac\_parse (C function)@\spxentry{krb5\_pac\_parse}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_parse:c.krb5_pac_parse}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_parse}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ptr}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{len}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pac}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ptr} \sphinxhyphen{} PAC buffer - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{len} \sphinxhyphen{} Length of \sphinxstyleemphasis{ptr} - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC handle - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_pac\_free() to free \sphinxstyleemphasis{pac} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_sign} -\label{\detokenize{appdev/refs/api/krb5_pac_sign:krb5-pac-sign}}\label{\detokenize{appdev/refs/api/krb5_pac_sign::doc}}\index{krb5\_pac\_sign (C function)@\spxentry{krb5\_pac\_sign}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_sign:c.krb5_pac_sign}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_sign}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{n}{authtime}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{server\_key}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{privsvr\_key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{pac} - -\sphinxAtStartPar -\sphinxstylestrong{authtime} - -\sphinxAtStartPar -\sphinxstylestrong{principal} - -\sphinxAtStartPar -\sphinxstylestrong{server\_key} - -\sphinxAtStartPar -\sphinxstylestrong{privsvr\_key} - -\sphinxAtStartPar -\sphinxstylestrong{data} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Use krb5\_kdc\_sign\_ticket() instead. - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_sign\_ext} -\label{\detokenize{appdev/refs/api/krb5_pac_sign_ext:krb5-pac-sign-ext}}\label{\detokenize{appdev/refs/api/krb5_pac_sign_ext::doc}}\index{krb5\_pac\_sign\_ext (C function)@\spxentry{krb5\_pac\_sign\_ext}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_sign_ext:c.krb5_pac_sign_ext}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_sign\_ext}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{n}{authtime}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{server\_key}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{privsvr\_key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{n}{with\_realm}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{pac} - -\sphinxAtStartPar -\sphinxstylestrong{authtime} - -\sphinxAtStartPar -\sphinxstylestrong{principal} - -\sphinxAtStartPar -\sphinxstylestrong{server\_key} - -\sphinxAtStartPar -\sphinxstylestrong{privsvr\_key} - -\sphinxAtStartPar -\sphinxstylestrong{with\_realm} - -\sphinxAtStartPar -\sphinxstylestrong{data} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Use krb5\_kdc\_sign\_ticket() instead. - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_verify \sphinxhyphen{} Verify a PAC.} -\label{\detokenize{appdev/refs/api/krb5_pac_verify:krb5-pac-verify-verify-a-pac}}\label{\detokenize{appdev/refs/api/krb5_pac_verify::doc}}\index{krb5\_pac\_verify (C function)@\spxentry{krb5\_pac\_verify}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_verify:c.krb5_pac_verify}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_verify}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{n}{authtime}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{server}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{privsvr}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{authtime} \sphinxhyphen{} Expected timestamp - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Expected principal name (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Key to validate server checksum (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{privsvr} \sphinxhyphen{} Key to validate KDC checksum (or NULL) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function validates \sphinxstyleemphasis{pac} against the supplied \sphinxstyleemphasis{server} , \sphinxstyleemphasis{privsvr} , \sphinxstyleemphasis{principal} and \sphinxstyleemphasis{authtime} . If \sphinxstyleemphasis{principal} is NULL, the principal and authtime are not verified. If \sphinxstyleemphasis{server} or \sphinxstyleemphasis{privsvr} is NULL, the corresponding checksum is not verified. - -\sphinxAtStartPar -If successful, \sphinxstyleemphasis{pac} is marked as verified. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -A checksum mismatch can occur if the PAC was copied from a cross\sphinxhyphen{}realm TGT by an ignorant KDC; also macOS Server Open Directory (as of 10.6) generates PACs with no server checksum at all. One should consider not failing the whole authentication because of this reason, but, instead, treating the ticket as if it did not contain a PAC or marking the PAC information as non\sphinxhyphen{}verified. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_verify\_ext \sphinxhyphen{} Verify a PAC, possibly from a specified realm.} -\label{\detokenize{appdev/refs/api/krb5_pac_verify_ext:krb5-pac-verify-ext-verify-a-pac-possibly-from-a-specified-realm}}\label{\detokenize{appdev/refs/api/krb5_pac_verify_ext::doc}}\index{krb5\_pac\_verify\_ext (C function)@\spxentry{krb5\_pac\_verify\_ext}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_verify_ext:c.krb5_pac_verify_ext}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_verify\_ext}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{n}{authtime}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{principal}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{server}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{privsvr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{n}{with\_realm}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{authtime} \sphinxhyphen{} Expected timestamp - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{principal} \sphinxhyphen{} Expected principal name (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Key to validate server checksum (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{privsvr} \sphinxhyphen{} Key to validate KDC checksum (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{with\_realm} \sphinxhyphen{} If true, expect the realm of \sphinxstyleemphasis{principal} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_pac\_verify(), but adds a parameter \sphinxstyleemphasis{with\_realm} . If \sphinxstyleemphasis{with\_realm} is true, the PAC\_CLIENT\_INFO field is expected to include the realm of \sphinxstyleemphasis{principal} as well as the name. This flag is necessary to verify PACs in cross\sphinxhyphen{}realm S4U2Self referral TGTs. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.17 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_pac\_get\_client\_info \sphinxhyphen{} Read client information from a PAC.} -\label{\detokenize{appdev/refs/api/krb5_pac_get_client_info:krb5-pac-get-client-info-read-client-information-from-a-pac}}\label{\detokenize{appdev/refs/api/krb5_pac_get_client_info::doc}}\index{krb5\_pac\_get\_client\_info (C function)@\spxentry{krb5\_pac\_get\_client\_info}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_pac_get_client_info:c.krb5_pac_get_client_info}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac\_get\_client\_info}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}]{\sphinxcrossref{\DUrole{n}{krb5\_pac}}}}\DUrole{w}{ }\DUrole{n}{pac}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{authtime\_out}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{princname\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pac} \sphinxhyphen{} PAC handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{authtime\_out} \sphinxhyphen{} Authentication timestamp (NULL if not needed) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{princname\_out} \sphinxhyphen{} Client account name - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 on success, ENOENT if no PAC\_CLIENT\_INFO buffer is present in pac , ERANGE if the buffer contains invalid lengths. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Read the PAC\_CLIENT\_INFO buffer in \sphinxstyleemphasis{pac} . Place the client account name as a string in \sphinxstyleemphasis{princname\_out} . If \sphinxstyleemphasis{authtime\_out} is not NULL, place the initial authentication timestamp in \sphinxstyleemphasis{authtime\_out} . - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.18 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_prepend\_error\_message \sphinxhyphen{} Add a prefix to the message for an error code.} -\label{\detokenize{appdev/refs/api/krb5_prepend_error_message:krb5-prepend-error-message-add-a-prefix-to-the-message-for-an-error-code}}\label{\detokenize{appdev/refs/api/krb5_prepend_error_message::doc}}\index{krb5\_prepend\_error\_message (C function)@\spxentry{krb5\_prepend\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_prepend_error_message:c.krb5_prepend_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_prepend\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{code}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{fmt}\sphinxparamcomma \DUrole{p}{...}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{code} \sphinxhyphen{} Error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fmt} \sphinxhyphen{} Format string for error message prefix - -\end{description}\end{quote} - -\sphinxAtStartPar -Format a message and prepend it to the current message for \sphinxstyleemphasis{code} . The prefix will be separated from the old message with a colon and space. - -\sphinxstepscope - - -\subsubsection{krb5\_principal2salt \sphinxhyphen{} Convert a principal name into the default salt for that principal.} -\label{\detokenize{appdev/refs/api/krb5_principal2salt:krb5-principal2salt-convert-a-principal-name-into-the-default-salt-for-that-principal}}\label{\detokenize{appdev/refs/api/krb5_principal2salt::doc}}\index{krb5\_principal2salt (C function)@\spxentry{krb5\_principal2salt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_principal2salt:c.krb5_principal2salt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_principal2salt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{pr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ret}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pr} \sphinxhyphen{} Principal name - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ret} \sphinxhyphen{} Default salt for \sphinxstyleemphasis{pr} to be filled in - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_rd\_cred \sphinxhyphen{} Read and validate a KRB\sphinxhyphen{}CRED message.} -\label{\detokenize{appdev/refs/api/krb5_rd_cred:krb5-rd-cred-read-and-validate-a-krb-cred-message}}\label{\detokenize{appdev/refs/api/krb5_rd_cred::doc}}\index{krb5\_rd\_cred (C function)@\spxentry{krb5\_rd\_cred}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_rd_cred:c.krb5_rd_cred}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_rd\_cred}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creddata}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{creds\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rdata\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creddata} \sphinxhyphen{} \sphinxstylestrong{KRB\sphinxhyphen{}CRED} message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds\_out} \sphinxhyphen{} Null\sphinxhyphen{}terminated array of forwarded credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rdata\_out} \sphinxhyphen{} Replay data (NULL if not needed) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{creddata} will be decrypted using the receiving subkey if it is present in \sphinxstyleemphasis{auth\_context} , or the session key if the receiving subkey is not present or fails to decrypt the message. -\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_tgt\_creds() to free \sphinxstyleemphasis{creds\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The \sphinxstyleemphasis{rdata\_out} argument is required if the KRB5\_AUTH\_CONTEXT\_RET\_TIME or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE flag is set in \sphinxstyleemphasis{auth\_context} .\textasciigrave{} -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_rd\_error \sphinxhyphen{} Decode a KRB\sphinxhyphen{}ERROR message.} -\label{\detokenize{appdev/refs/api/krb5_rd_error:krb5-rd-error-decode-a-krb-error-message}}\label{\detokenize{appdev/refs/api/krb5_rd_error::doc}}\index{krb5\_rd\_error (C function)@\spxentry{krb5\_rd\_error}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_rd_error:c.krb5_rd_error}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_rd\_error}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{enc\_errbuf}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{dec\_error}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enc\_errbuf} \sphinxhyphen{} Encoded error message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{dec\_error} \sphinxhyphen{} Decoded error message - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function processes \sphinxstylestrong{KRB\sphinxhyphen{}ERROR} message \sphinxstyleemphasis{enc\_errbuf} and returns an allocated structure \sphinxstyleemphasis{dec\_error} containing the error message. Use krb5\_free\_error() to free \sphinxstyleemphasis{dec\_error} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_rd\_priv \sphinxhyphen{} Process a KRB\sphinxhyphen{}PRIV message.} -\label{\detokenize{appdev/refs/api/krb5_rd_priv:krb5-rd-priv-process-a-krb-priv-message}}\label{\detokenize{appdev/refs/api/krb5_rd_priv::doc}}\index{krb5\_rd\_priv (C function)@\spxentry{krb5\_rd\_priv}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_rd_priv:c.krb5_rd_priv}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_rd\_priv}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inbuf}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{userdata\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rdata\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inbuf} \sphinxhyphen{} \sphinxstylestrong{KRB\sphinxhyphen{}PRIV} message to be parsed - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{userdata\_out} \sphinxhyphen{} Data parsed from \sphinxstylestrong{KRB\sphinxhyphen{}PRIV} message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rdata\_out} \sphinxhyphen{} Replay data. Specify NULL if not needed - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function parses a \sphinxstylestrong{KRB\sphinxhyphen{}PRIV} message, verifies its integrity, and stores its unencrypted data into \sphinxstyleemphasis{userdata\_out} . - -\sphinxAtStartPar -If \sphinxstyleemphasis{auth\_context} has a remote address set, the address will be used to verify the sender address in the KRB\sphinxhyphen{}PRIV message. If \sphinxstyleemphasis{auth\_context} has a local address set, it will be used to verify the receiver address in the KRB\sphinxhyphen{}PRIV message if the message contains one. - -\sphinxAtStartPar -If the KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE flag is set in \sphinxstyleemphasis{auth\_context} , the sequence number of the KRB\sphinxhyphen{}PRIV message is checked against the remote sequence number field of \sphinxstyleemphasis{auth\_context} . Otherwise, the sequence number is not used. - -\sphinxAtStartPar -If the KRB5\_AUTH\_CONTEXT\_DO\_TIME flag is set in \sphinxstyleemphasis{auth\_context} , then the timestamp in the message is verified to be within the permitted clock skew of the current time, and the message is checked against an in\sphinxhyphen{}memory replay cache to detect reflections or replays. - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{userdata\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The \sphinxstyleemphasis{rdata\_out} argument is required if the KRB5\_AUTH\_CONTEXT\_RET\_TIME or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE flag is set in \sphinxstyleemphasis{auth\_context} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_rd\_rep \sphinxhyphen{} Parse and decrypt a KRB\_AP\_REP message.} -\label{\detokenize{appdev/refs/api/krb5_rd_rep:krb5-rd-rep-parse-and-decrypt-a-krb-ap-rep-message}}\label{\detokenize{appdev/refs/api/krb5_rd_rep::doc}}\index{krb5\_rd\_rep (C function)@\spxentry{krb5\_rd\_rep}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_rd_rep:c.krb5_rd_rep}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_rd\_rep}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inbuf}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{repl}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inbuf} \sphinxhyphen{} AP\sphinxhyphen{}REP message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{repl} \sphinxhyphen{} Decrypted reply message - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function parses, decrypts and verifies a message from \sphinxstyleemphasis{inbuf} and fills in \sphinxstyleemphasis{repl} with a pointer to allocated memory containing the fields from the encrypted response. - -\sphinxAtStartPar -Use krb5\_free\_ap\_rep\_enc\_part() to free \sphinxstyleemphasis{repl} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_rd\_rep\_dce \sphinxhyphen{} Parse and decrypt a KRB\_AP\_REP message for DCE RPC.} -\label{\detokenize{appdev/refs/api/krb5_rd_rep_dce:krb5-rd-rep-dce-parse-and-decrypt-a-krb-ap-rep-message-for-dce-rpc}}\label{\detokenize{appdev/refs/api/krb5_rd_rep_dce::doc}}\index{krb5\_rd\_rep\_dce (C function)@\spxentry{krb5\_rd\_rep\_dce}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_rd_rep_dce:c.krb5_rd_rep_dce}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_rd\_rep\_dce}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inbuf}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}]{\sphinxcrossref{\DUrole{n}{krb5\_ui\_4}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{nonce}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inbuf} \sphinxhyphen{} AP\sphinxhyphen{}REP message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{nonce} \sphinxhyphen{} Sequence number from the decrypted reply - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function parses, decrypts and verifies a message from \sphinxstyleemphasis{inbuf} and fills in \sphinxstyleemphasis{nonce} with a decrypted reply sequence number. - -\sphinxstepscope - - -\subsubsection{krb5\_rd\_req \sphinxhyphen{} Parse and decrypt a KRB\_AP\_REQ message.} -\label{\detokenize{appdev/refs/api/krb5_rd_req:krb5-rd-req-parse-and-decrypt-a-krb-ap-req-message}}\label{\detokenize{appdev/refs/api/krb5_rd_req::doc}}\index{krb5\_rd\_req (C function)@\spxentry{krb5\_rd\_req}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_rd_req:c.krb5_rd_req}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_rd\_req}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inbuf}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{w}{ }\DUrole{n}{server}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ap\_req\_options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ticket}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Pre\sphinxhyphen{}existing or newly created auth context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inbuf} \sphinxhyphen{} AP\sphinxhyphen{}REQ message to be parsed - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Matching principal for server, or NULL to allow any principal in keytab - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table, or NULL to use the default - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ap\_req\_options} \sphinxhyphen{} If non\sphinxhyphen{}null, the AP\sphinxhyphen{}REQ flags on output - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ticket} \sphinxhyphen{} If non\sphinxhyphen{}null, ticket from the AP\sphinxhyphen{}REQ message - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function parses, decrypts and verifies a AP\sphinxhyphen{}REQ message from \sphinxstyleemphasis{inbuf} and stores the authenticator in \sphinxstyleemphasis{auth\_context} . - -\sphinxAtStartPar -If a keyblock was specified in \sphinxstyleemphasis{auth\_context} using krb5\_auth\_con\_setuseruserkey(), that key is used to decrypt the ticket in AP\sphinxhyphen{}REQ message and \sphinxstyleemphasis{keytab} is ignored. In this case, \sphinxstyleemphasis{server} should be specified as a complete principal name to allow for proper transited\sphinxhyphen{}path checking and replay cache selection. - -\sphinxAtStartPar -Otherwise, the decryption key is obtained from \sphinxstyleemphasis{keytab} , or from the default keytab if it is NULL. In this case, \sphinxstyleemphasis{server} may be a complete principal name, a matching principal (see krb5\_sname\_match()), or NULL to match any principal name. The keys tried against the encrypted part of the ticket are determined as follows: -\begin{itemize} -\item {} -\sphinxAtStartPar -If \sphinxstyleemphasis{server} is a complete principal name, then its entry in \sphinxstyleemphasis{keytab} is tried. - -\item {} -\sphinxAtStartPar -Otherwise, if \sphinxstyleemphasis{keytab} is iterable, then all entries in \sphinxstyleemphasis{keytab} which match \sphinxstyleemphasis{server} are tried. - -\item {} -\sphinxAtStartPar -Otherwise, the server principal in the ticket must match \sphinxstyleemphasis{server} , and its entry in \sphinxstyleemphasis{keytab} is tried. - -\end{itemize} - -\sphinxAtStartPar -The client specified in the decrypted authenticator must match the client specified in the decrypted ticket. - -\sphinxAtStartPar -If the \sphinxstyleemphasis{remote\_addr} field of \sphinxstyleemphasis{auth\_context} is set, the request must come from that address. - -\sphinxAtStartPar -If a replay cache handle is provided in the \sphinxstyleemphasis{auth\_context} , the authenticator and ticket are verified against it. If no conflict is found, the new authenticator is then stored in the replay cache of \sphinxstyleemphasis{auth\_context} . - -\sphinxAtStartPar -Various other checks are performed on the decoded data, including cross\sphinxhyphen{}realm policy, clockskew, and ticket validation times. - -\sphinxAtStartPar -On success the authenticator, subkey, and remote sequence number of the request are stored in \sphinxstyleemphasis{auth\_context} . If the AP\_OPTS\_MUTUAL\_REQUIRED bit is set, the local sequence number is XORed with the remote sequence number in the request. - -\sphinxAtStartPar -Use krb5\_free\_ticket() to free \sphinxstyleemphasis{ticket} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_rd\_safe \sphinxhyphen{} Process KRB\sphinxhyphen{}SAFE message.} -\label{\detokenize{appdev/refs/api/krb5_rd_safe:krb5-rd-safe-process-krb-safe-message}}\label{\detokenize{appdev/refs/api/krb5_rd_safe::doc}}\index{krb5\_rd\_safe (C function)@\spxentry{krb5\_rd\_safe}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_rd_safe:c.krb5_rd_safe}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_rd\_safe}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{inbuf}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{userdata\_out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{rdata\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inbuf} \sphinxhyphen{} \sphinxstylestrong{KRB\sphinxhyphen{}SAFE} message to be parsed - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{userdata\_out} \sphinxhyphen{} Data parsed from \sphinxstylestrong{KRB\sphinxhyphen{}SAFE} message - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rdata\_out} \sphinxhyphen{} Replay data. Specify NULL if not needed - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function parses a \sphinxstylestrong{KRB\sphinxhyphen{}SAFE} message, verifies its integrity, and stores its data into \sphinxstyleemphasis{userdata\_out} . - -\sphinxAtStartPar -If \sphinxstyleemphasis{auth\_context} has a remote address set, the address will be used to verify the sender address in the KRB\sphinxhyphen{}SAFE message. If \sphinxstyleemphasis{auth\_context} has a local address set, it will be used to verify the receiver address in the KRB\sphinxhyphen{}SAFE message if the message contains one. - -\sphinxAtStartPar -If the KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE flag is set in \sphinxstyleemphasis{auth\_context} , the sequence number of the KRB\sphinxhyphen{}SAFE message is checked against the remote sequence number field of \sphinxstyleemphasis{auth\_context} . Otherwise, the sequence number is not used. - -\sphinxAtStartPar -If the KRB5\_AUTH\_CONTEXT\_DO\_TIME flag is set in \sphinxstyleemphasis{auth\_context} , then the timestamp in the message is verified to be within the permitted clock skew of the current time, and the message is checked against an in\sphinxhyphen{}memory replay cache to detect reflections or replays. - -\sphinxAtStartPar -Use krb5\_free\_data\_contents() to free \sphinxstyleemphasis{userdata\_out} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The \sphinxstyleemphasis{rdata\_out} argument is required if the KRB5\_AUTH\_CONTEXT\_RET\_TIME or KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE flag is set in \sphinxstyleemphasis{auth\_context} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_read\_password \sphinxhyphen{} Read a password from keyboard input.} -\label{\detokenize{appdev/refs/api/krb5_read_password:krb5-read-password-read-a-password-from-keyboard-input}}\label{\detokenize{appdev/refs/api/krb5_read_password::doc}}\index{krb5\_read\_password (C function)@\spxentry{krb5\_read\_password}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_read_password:c.krb5_read_password}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_read\_password}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{prompt}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{prompt2}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{return\_pwd}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{size\_return}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{prompt} \sphinxhyphen{} First user prompt when reading password - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{prompt2} \sphinxhyphen{} Second user prompt (NULL to prompt only once) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{return\_pwd} \sphinxhyphen{} Returned password - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{size\_return} \sphinxhyphen{} On input, maximum size of password; on output, size of password read - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Error in reading or verifying the password - -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function reads a password from keyboard input and stores it in \sphinxstyleemphasis{return\_pwd} . \sphinxstyleemphasis{size\_return} should be set by the caller to the amount of storage space available in \sphinxstyleemphasis{return\_pwd} ; on successful return, it will be set to the length of the password read. -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{prompt} is printed to the terminal, followed by”:”, and then a password is read from the keyboard. -\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{prompt2} is NULL, the password is read only once. Otherwise, \sphinxstyleemphasis{prompt2} is printed to the terminal and a second password is read. If the two passwords entered are not identical, KRB5\_LIBOS\_BADPWDMATCH is returned. - -\sphinxAtStartPar -Echoing is turned off when the password is read. - -\sphinxstepscope - - -\subsubsection{krb5\_salttype\_to\_string \sphinxhyphen{} Convert a salt type to a string.} -\label{\detokenize{appdev/refs/api/krb5_salttype_to_string:krb5-salttype-to-string-convert-a-salt-type-to-a-string}}\label{\detokenize{appdev/refs/api/krb5_salttype_to_string::doc}}\index{krb5\_salttype\_to\_string (C function)@\spxentry{krb5\_salttype\_to\_string}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_salttype_to_string:c.krb5_salttype_to_string}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_salttype\_to\_string}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{n}{salttype}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{buffer}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{buflen}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{salttype} \sphinxhyphen{} Salttype to convert - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{buffer} \sphinxhyphen{} Buffer to receive the converted string - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{buflen} \sphinxhyphen{} Storage available in \sphinxstyleemphasis{buffer} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_server\_decrypt\_ticket\_keytab \sphinxhyphen{} Decrypt a ticket using the specified key table.} -\label{\detokenize{appdev/refs/api/krb5_server_decrypt_ticket_keytab:krb5-server-decrypt-ticket-keytab-decrypt-a-ticket-using-the-specified-key-table}}\label{\detokenize{appdev/refs/api/krb5_server_decrypt_ticket_keytab::doc}}\index{krb5\_server\_decrypt\_ticket\_keytab (C function)@\spxentry{krb5\_server\_decrypt\_ticket\_keytab}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_server_decrypt_ticket_keytab:c.krb5_server_decrypt_ticket_keytab}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_server\_decrypt\_ticket\_keytab}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{kt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ticket}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{kt} \sphinxhyphen{} Key table - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ticket} \sphinxhyphen{} Ticket to be decrypted - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function takes a \sphinxstyleemphasis{ticket} as input and decrypts it using key data from \sphinxstyleemphasis{kt} . The result is placed into \sphinxstyleemphasis{ticket\sphinxhyphen{}\textgreater{}enc\_part2} . - -\sphinxstepscope - - -\subsubsection{krb5\_set\_default\_tgs\_enctypes \sphinxhyphen{} Set default TGS encryption types in a krb5\_context structure.} -\label{\detokenize{appdev/refs/api/krb5_set_default_tgs_enctypes:krb5-set-default-tgs-enctypes-set-default-tgs-encryption-types-in-a-krb5-context-structure}}\label{\detokenize{appdev/refs/api/krb5_set_default_tgs_enctypes::doc}}\index{krb5\_set\_default\_tgs\_enctypes (C function)@\spxentry{krb5\_set\_default\_tgs\_enctypes}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_default_tgs_enctypes:c.krb5_set_default_tgs_enctypes}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_default\_tgs\_enctypes}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{etypes}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{etypes} \sphinxhyphen{} Encryption type(s) to set - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\item {} -\sphinxAtStartPar -KRB5\_PROG\_ETYPE\_NOSUPP Program lacks support for encryption type - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the default enctype list for TGS requests made using \sphinxstyleemphasis{context} to \sphinxstyleemphasis{etypes} . - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This overrides the default list (from config file or built\sphinxhyphen{}in). -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_set\_error\_message \sphinxhyphen{} Set an extended error message for an error code.} -\label{\detokenize{appdev/refs/api/krb5_set_error_message:krb5-set-error-message-set-an-extended-error-message-for-an-error-code}}\label{\detokenize{appdev/refs/api/krb5_set_error_message::doc}}\index{krb5\_set\_error\_message (C function)@\spxentry{krb5\_set\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_error_message:c.krb5_set_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{code}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{fmt}\sphinxparamcomma \DUrole{p}{...}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{code} \sphinxhyphen{} Error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fmt} \sphinxhyphen{} Error string for the error code - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_set\_kdc\_recv\_hook \sphinxhyphen{} Set a KDC post\sphinxhyphen{}receive hook function.} -\label{\detokenize{appdev/refs/api/krb5_set_kdc_recv_hook:krb5-set-kdc-recv-hook-set-a-kdc-post-receive-hook-function}}\label{\detokenize{appdev/refs/api/krb5_set_kdc_recv_hook::doc}}\index{krb5\_set\_kdc\_recv\_hook (C function)@\spxentry{krb5\_set\_kdc\_recv\_hook}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_kdc_recv_hook:c.krb5_set_kdc_recv_hook}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_kdc\_recv\_hook}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_post_recv_fn:c.krb5_post_recv_fn}]{\sphinxcrossref{\DUrole{n}{krb5\_post\_recv\_fn}}}}\DUrole{w}{ }\DUrole{n}{recv\_hook}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} The library context. - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{recv\_hook} \sphinxhyphen{} Hook function (or NULL to disable the hook) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Callback data to be passed to \sphinxstyleemphasis{recv\_hook} - -\end{description}\end{quote} -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{recv\_hook} will be called after a reply is received from a KDC during a call to a library function such as krb5\_get\_credentials(). The hook function may inspect or override the reply. This hook will not be executed if the pre\sphinxhyphen{}send hook returns a synthetic reply. -\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.15 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_set\_kdc\_send\_hook \sphinxhyphen{} Set a KDC pre\sphinxhyphen{}send hook function.} -\label{\detokenize{appdev/refs/api/krb5_set_kdc_send_hook:krb5-set-kdc-send-hook-set-a-kdc-pre-send-hook-function}}\label{\detokenize{appdev/refs/api/krb5_set_kdc_send_hook::doc}}\index{krb5\_set\_kdc\_send\_hook (C function)@\spxentry{krb5\_set\_kdc\_send\_hook}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_kdc_send_hook:c.krb5_set_kdc_send_hook}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_kdc\_send\_hook}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pre_send_fn:c.krb5_pre_send_fn}]{\sphinxcrossref{\DUrole{n}{krb5\_pre\_send\_fn}}}}\DUrole{w}{ }\DUrole{n}{send\_hook}\sphinxparamcomma \DUrole{kt}{void}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{send\_hook} \sphinxhyphen{} Hook function (or NULL to disable the hook) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Callback data to be passed to \sphinxstyleemphasis{send\_hook} - -\end{description}\end{quote} -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{send\_hook} will be called before messages are sent to KDCs by library functions such as krb5\_get\_credentials(). The hook function may inspect, override, or synthesize its own reply to the message. -\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.15 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_set\_real\_time \sphinxhyphen{} Set time offset field in a krb5\_context structure.} -\label{\detokenize{appdev/refs/api/krb5_set_real_time:krb5-set-real-time-set-time-offset-field-in-a-krb5-context-structure}}\label{\detokenize{appdev/refs/api/krb5_set_real_time::doc}}\index{krb5\_set\_real\_time (C function)@\spxentry{krb5\_set\_real\_time}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_set_real_time:c.krb5_set_real_time}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_set\_real\_time}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{n}{seconds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{n}{microseconds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{seconds} \sphinxhyphen{} Real time, seconds portion - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{microseconds} \sphinxhyphen{} Real time, microseconds portion - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function sets the time offset in \sphinxstyleemphasis{context} to the difference between the system time and the real time as determined by \sphinxstyleemphasis{seconds} and \sphinxstyleemphasis{microseconds} . - -\sphinxstepscope - - -\subsubsection{krb5\_string\_to\_cksumtype \sphinxhyphen{} Convert a string to a checksum type.} -\label{\detokenize{appdev/refs/api/krb5_string_to_cksumtype:krb5-string-to-cksumtype-convert-a-string-to-a-checksum-type}}\label{\detokenize{appdev/refs/api/krb5_string_to_cksumtype::doc}}\index{krb5\_string\_to\_cksumtype (C function)@\spxentry{krb5\_string\_to\_cksumtype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_string_to_cksumtype:c.krb5_string_to_cksumtype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_string\_to\_cksumtype}}}}{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{string}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cksumtypep}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{string} \sphinxhyphen{} String to be converted - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cksumtypep} \sphinxhyphen{} Checksum type to be filled in - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} EINVAL - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_string\_to\_deltat \sphinxhyphen{} Convert a string to a delta time value.} -\label{\detokenize{appdev/refs/api/krb5_string_to_deltat:krb5-string-to-deltat-convert-a-string-to-a-delta-time-value}}\label{\detokenize{appdev/refs/api/krb5_string_to_deltat::doc}}\index{krb5\_string\_to\_deltat (C function)@\spxentry{krb5\_string\_to\_deltat}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_string_to_deltat:c.krb5_string_to_deltat}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_string\_to\_deltat}}}}{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{string}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{deltatp}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{string} \sphinxhyphen{} String to be converted - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{deltatp} \sphinxhyphen{} Delta time to be filled in - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} KRB5\_DELTAT\_BADFORMAT - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_string\_to\_enctype \sphinxhyphen{} Convert a string to an encryption type.} -\label{\detokenize{appdev/refs/api/krb5_string_to_enctype:krb5-string-to-enctype-convert-a-string-to-an-encryption-type}}\label{\detokenize{appdev/refs/api/krb5_string_to_enctype::doc}}\index{krb5\_string\_to\_enctype (C function)@\spxentry{krb5\_string\_to\_enctype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_string_to_enctype:c.krb5_string_to_enctype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_string\_to\_enctype}}}}{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{string}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{enctypep}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{string} \sphinxhyphen{} String to convert to an encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{enctypep} \sphinxhyphen{} Encryption type - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} EINVAL - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_string\_to\_salttype \sphinxhyphen{} Convert a string to a salt type.} -\label{\detokenize{appdev/refs/api/krb5_string_to_salttype:krb5-string-to-salttype-convert-a-string-to-a-salt-type}}\label{\detokenize{appdev/refs/api/krb5_string_to_salttype::doc}}\index{krb5\_string\_to\_salttype (C function)@\spxentry{krb5\_string\_to\_salttype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_string_to_salttype:c.krb5_string_to_salttype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_string\_to\_salttype}}}}{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{string}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{salttypep}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{string} \sphinxhyphen{} String to convert to an encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{salttypep} \sphinxhyphen{} Salt type to be filled in - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} EINVAL - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_string\_to\_timestamp \sphinxhyphen{} Convert a string to a timestamp.} -\label{\detokenize{appdev/refs/api/krb5_string_to_timestamp:krb5-string-to-timestamp-convert-a-string-to-a-timestamp}}\label{\detokenize{appdev/refs/api/krb5_string_to_timestamp::doc}}\index{krb5\_string\_to\_timestamp (C function)@\spxentry{krb5\_string\_to\_timestamp}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_string_to_timestamp:c.krb5_string_to_timestamp}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_string\_to\_timestamp}}}}{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{string}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{timestampp}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{string} \sphinxhyphen{} String to be converted - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{timestampp} \sphinxhyphen{} Pointer to timestamp - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} EINVAL - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_timeofday \sphinxhyphen{} Retrieve the current time with context specific time offset adjustment.} -\label{\detokenize{appdev/refs/api/krb5_timeofday:krb5-timeofday-retrieve-the-current-time-with-context-specific-time-offset-adjustment}}\label{\detokenize{appdev/refs/api/krb5_timeofday::doc}}\index{krb5\_timeofday (C function)@\spxentry{krb5\_timeofday}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_timeofday:c.krb5_timeofday}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_timeofday}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{timeret}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{timeret} \sphinxhyphen{} Timestamp to fill in - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success - -\end{itemize} - -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function retrieves the system time of day with the context specific time offset adjustment. - -\sphinxstepscope - - -\subsubsection{krb5\_timestamp\_to\_sfstring \sphinxhyphen{} Convert a timestamp to a string, with optional output padding.} -\label{\detokenize{appdev/refs/api/krb5_timestamp_to_sfstring:krb5-timestamp-to-sfstring-convert-a-timestamp-to-a-string-with-optional-output-padding}}\label{\detokenize{appdev/refs/api/krb5_timestamp_to_sfstring::doc}}\index{krb5\_timestamp\_to\_sfstring (C function)@\spxentry{krb5\_timestamp\_to\_sfstring}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_timestamp_to_sfstring:c.krb5_timestamp_to_sfstring}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_timestamp\_to\_sfstring}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{n}{timestamp}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{buffer}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{buflen}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pad}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{timestamp} \sphinxhyphen{} Timestamp to convert - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{buffer} \sphinxhyphen{} Buffer to hold the converted timestamp - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{buflen} \sphinxhyphen{} Length of buffer - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pad} \sphinxhyphen{} Optional value to pad \sphinxstyleemphasis{buffer} if converted timestamp does not fill it - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{pad} is not NULL, \sphinxstyleemphasis{buffer} is padded out to \sphinxstyleemphasis{buflen} \sphinxhyphen{} 1 characters with the value of * \sphinxstyleemphasis{pad} . - -\sphinxstepscope - - -\subsubsection{krb5\_timestamp\_to\_string \sphinxhyphen{} Convert a timestamp to a string.} -\label{\detokenize{appdev/refs/api/krb5_timestamp_to_string:krb5-timestamp-to-string-convert-a-timestamp-to-a-string}}\label{\detokenize{appdev/refs/api/krb5_timestamp_to_string::doc}}\index{krb5\_timestamp\_to\_string (C function)@\spxentry{krb5\_timestamp\_to\_string}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_timestamp_to_string:c.krb5_timestamp_to_string}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_timestamp\_to\_string}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\DUrole{n}{timestamp}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{buffer}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{buflen}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{timestamp} \sphinxhyphen{} Timestamp to convert - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{buffer} \sphinxhyphen{} Buffer to hold converted timestamp - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{buflen} \sphinxhyphen{} Storage available in \sphinxstyleemphasis{buffer} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The string is returned in the locale’s appropriate date and time representation. - -\sphinxstepscope - - -\subsubsection{krb5\_tkt\_creds\_free \sphinxhyphen{} Free a TGS request context.} -\label{\detokenize{appdev/refs/api/krb5_tkt_creds_free:krb5-tkt-creds-free-free-a-tgs-request-context}}\label{\detokenize{appdev/refs/api/krb5_tkt_creds_free::doc}}\index{krb5\_tkt\_creds\_free (C function)@\spxentry{krb5\_tkt\_creds\_free}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_tkt_creds_free:c.krb5_tkt_creds_free}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_tkt\_creds\_free}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_tkt_creds_context:c.krb5_tkt_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} TGS request context - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_tkt\_creds\_get \sphinxhyphen{} Synchronously obtain credentials using a TGS request context.} -\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get:krb5-tkt-creds-get-synchronously-obtain-credentials-using-a-tgs-request-context}}\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get::doc}}\index{krb5\_tkt\_creds\_get (C function)@\spxentry{krb5\_tkt\_creds\_get}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get:c.krb5_tkt_creds_get}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_tkt\_creds\_get}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_tkt_creds_context:c.krb5_tkt_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} TGS request context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function synchronously obtains credentials using a context created by krb5\_tkt\_creds\_init(). On successful return, the credentials can be retrieved with krb5\_tkt\_creds\_get\_creds(). - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_tkt\_creds\_get\_creds \sphinxhyphen{} Retrieve acquired credentials from a TGS request context.} -\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get_creds:krb5-tkt-creds-get-creds-retrieve-acquired-credentials-from-a-tgs-request-context}}\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get_creds::doc}}\index{krb5\_tkt\_creds\_get\_creds (C function)@\spxentry{krb5\_tkt\_creds\_get\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get_creds:c.krb5_tkt_creds_get_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_tkt\_creds\_get\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_tkt_creds_context:c.krb5_tkt_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} TGS request context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Acquired credentials - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function copies the acquired initial credentials from \sphinxstyleemphasis{ctx} into \sphinxstyleemphasis{creds} , after the successful completion of krb5\_tkt\_creds\_get() or krb5\_tkt\_creds\_step(). Use krb5\_free\_cred\_contents() to free \sphinxstyleemphasis{creds} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_tkt\_creds\_get\_times \sphinxhyphen{} Retrieve ticket times from a TGS request context.} -\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get_times:krb5-tkt-creds-get-times-retrieve-ticket-times-from-a-tgs-request-context}}\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get_times::doc}}\index{krb5\_tkt\_creds\_get\_times (C function)@\spxentry{krb5\_tkt\_creds\_get\_times}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_tkt_creds_get_times:c.krb5_tkt_creds_get_times}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_tkt\_creds\_get\_times}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_tkt_creds_context:c.krb5_tkt_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{times}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} TGS request context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{times} \sphinxhyphen{} Ticket times for acquired credentials - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The TGS request context must have completed obtaining credentials via either krb5\_tkt\_creds\_get() or krb5\_tkt\_creds\_step(). - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_tkt\_creds\_init \sphinxhyphen{} Create a context to get credentials from a KDC’s Ticket Granting Service.} -\label{\detokenize{appdev/refs/api/krb5_tkt_creds_init:krb5-tkt-creds-init-create-a-context-to-get-credentials-from-a-kdc-s-ticket-granting-service}}\label{\detokenize{appdev/refs/api/krb5_tkt_creds_init::doc}}\index{krb5\_tkt\_creds\_init (C function)@\spxentry{krb5\_tkt\_creds\_init}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_tkt_creds_init:c.krb5_tkt_creds_init}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_tkt\_creds\_init}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_tkt_creds_context:c.krb5_tkt_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_creds\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ctx}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache handle - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Input credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{options} \sphinxhyphen{} Options (see KRB5\_GC macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} New TGS request context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function prepares to obtain credentials matching \sphinxstyleemphasis{creds} , either by retrieving them from \sphinxstyleemphasis{ccache} or by making requests to ticket\sphinxhyphen{}granting services beginning with a ticket\sphinxhyphen{}granting ticket for the client principal’s realm. - -\sphinxAtStartPar -The resulting TGS acquisition context can be used asynchronously with krb5\_tkt\_creds\_step() or synchronously with krb5\_tkt\_creds\_get(). See also krb5\_get\_credentials() for synchronous use. - -\sphinxAtStartPar -Use krb5\_tkt\_creds\_free() to free \sphinxstyleemphasis{ctx} when it is no longer needed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_tkt\_creds\_step \sphinxhyphen{} Get the next KDC request in a TGS exchange.} -\label{\detokenize{appdev/refs/api/krb5_tkt_creds_step:krb5-tkt-creds-step-get-the-next-kdc-request-in-a-tgs-exchange}}\label{\detokenize{appdev/refs/api/krb5_tkt_creds_step::doc}}\index{krb5\_tkt\_creds\_step (C function)@\spxentry{krb5\_tkt\_creds\_step}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_tkt_creds_step:c.krb5_tkt_creds_step}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_tkt\_creds\_step}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_tkt_creds_context:c.krb5_tkt_creds_context}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_creds\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{out}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{flags}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} TGS request context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in} \sphinxhyphen{} KDC response (empty on the first call) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} Next KDC request - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{realm} \sphinxhyphen{} Realm for next KDC request - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Output flags - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function constructs the next KDC request for a TGS exchange, allowing the caller to control the transport of KDC requests and replies. On the first call, \sphinxstyleemphasis{in} should be set to an empty buffer; on subsequent calls, it should be set to the KDC’s reply to the previous request. - -\sphinxAtStartPar -If more requests are needed, \sphinxstyleemphasis{flags} will be set to KRB5\_TKT\_CREDS\_STEP\_FLAG\_CONTINUE and the next request will be placed in \sphinxstyleemphasis{out} . If no more requests are needed, \sphinxstyleemphasis{flags} will not contain KRB5\_TKT\_CREDS\_STEP\_FLAG\_CONTINUE and \sphinxstyleemphasis{out} will be empty. - -\sphinxAtStartPar -If this function returns \sphinxstylestrong{KRB5KRB\_ERR\_RESPONSE\_TOO\_BIG} , the caller should transmit the next request using TCP rather than UDP. If this function returns any other error, the TGS exchange has failed. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_unmarshal\_credentials \sphinxhyphen{} Deserialize a krb5\_creds object.} -\label{\detokenize{appdev/refs/api/krb5_unmarshal_credentials:krb5-unmarshal-credentials-deserialize-a-krb5-creds-object}}\label{\detokenize{appdev/refs/api/krb5_unmarshal_credentials::doc}}\index{krb5\_unmarshal\_credentials (C function)@\spxentry{krb5\_unmarshal\_credentials}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_unmarshal_credentials:c.krb5_unmarshal_credentials}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_unmarshal\_credentials}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{creds\_out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} The serialized credentials - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{creds\_out} \sphinxhyphen{} The resulting creds object - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Deserialize \sphinxstyleemphasis{data} to credentials in the format used by the FILE ccache format (vesion 4) and KCM ccache protocol. - -\sphinxAtStartPar -Use krb5\_free\_creds() to free \sphinxstyleemphasis{creds\_out} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_verify\_init\_creds \sphinxhyphen{} Verify initial credentials against a keytab.} -\label{\detokenize{appdev/refs/api/krb5_verify_init_creds:krb5-verify-init-creds-verify-initial-credentials-against-a-keytab}}\label{\detokenize{appdev/refs/api/krb5_verify_init_creds::doc}}\index{krb5\_verify\_init\_creds (C function)@\spxentry{krb5\_verify\_init\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_verify_init_creds:c.krb5_verify_init_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_verify\_init\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{server}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:c.krb5_verify_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_verify\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{options}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{creds} \sphinxhyphen{} Initial credentials to be verified - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Server principal (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table (NULL to use default keytab) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache for fetched creds (or NULL) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{options} \sphinxhyphen{} Verification options (NULL for default options) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function attempts to verify that \sphinxstyleemphasis{creds} were obtained from a KDC with knowledge of a key in \sphinxstyleemphasis{keytab} , or the default keytab if \sphinxstyleemphasis{keytab} is NULL. If \sphinxstyleemphasis{server} is provided, the highest\sphinxhyphen{}kvno key entry for that principal name is used to verify the credentials; otherwise, all unique”host”service principals in the keytab are tried. - -\sphinxAtStartPar -If the specified keytab does not exist, or is empty, or cannot be read, or does not contain an entry for \sphinxstyleemphasis{server} , then credential verification may be skipped unless configuration demands that it succeed. The caller can control this behavior by providing a verification options structure; see krb5\_verify\_init\_creds\_opt\_init() and krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail(). - -\sphinxAtStartPar -If \sphinxstyleemphasis{ccache} is NULL, any additional credentials fetched during the verification process will be destroyed. If \sphinxstyleemphasis{ccache} points to NULL, a memory ccache will be created for the additional credentials and returned in \sphinxstyleemphasis{ccache} . If \sphinxstyleemphasis{ccache} points to a valid credential cache handle, the additional credentials will be stored in that cache. - -\sphinxstepscope - - -\subsubsection{krb5\_verify\_init\_creds\_opt\_init \sphinxhyphen{} Initialize a credential verification options structure.} -\label{\detokenize{appdev/refs/api/krb5_verify_init_creds_opt_init:krb5-verify-init-creds-opt-init-initialize-a-credential-verification-options-structure}}\label{\detokenize{appdev/refs/api/krb5_verify_init_creds_opt_init::doc}}\index{krb5\_verify\_init\_creds\_opt\_init (C function)@\spxentry{krb5\_verify\_init\_creds\_opt\_init}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_verify_init_creds_opt_init:c.krb5_verify_init_creds_opt_init}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_verify\_init\_creds\_opt\_init}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:c.krb5_verify_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_verify\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k5\_vic\_options}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{k5\_vic\_options} \sphinxhyphen{} Verification options structure - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail \sphinxhyphen{} Set whether credential verification is required.} -\label{\detokenize{appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail:krb5-verify-init-creds-opt-set-ap-req-nofail-set-whether-credential-verification-is-required}}\label{\detokenize{appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail::doc}}\index{krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail (C function)@\spxentry{krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_verify_init_creds_opt_set_ap_req_nofail:c.krb5_verify_init_creds_opt_set_ap_req_nofail}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:c.krb5_verify_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_verify\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k5\_vic\_options}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{ap\_req\_nofail}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{k5\_vic\_options} \sphinxhyphen{} Verification options structure - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ap\_req\_nofail} \sphinxhyphen{} Whether to require successful verification - -\end{description}\end{quote} - -\sphinxAtStartPar -This function determines how krb5\_verify\_init\_creds() behaves if no keytab information is available. If \sphinxstyleemphasis{ap\_req\_nofail} is \sphinxstylestrong{FALSE} , verification will be skipped in this case and krb5\_verify\_init\_creds() will return successfully. If \sphinxstyleemphasis{ap\_req\_nofail} is \sphinxstylestrong{TRUE} , krb5\_verify\_init\_creds() will not return successfully unless verification can be performed. - -\sphinxAtStartPar -If this function is not used, the behavior of krb5\_verify\_init\_creds() is determined through configuration. - -\sphinxstepscope - - -\subsubsection{krb5\_vprepend\_error\_message \sphinxhyphen{} Add a prefix to the message for an error code using a va\_list.} -\label{\detokenize{appdev/refs/api/krb5_vprepend_error_message:krb5-vprepend-error-message-add-a-prefix-to-the-message-for-an-error-code-using-a-va-list}}\label{\detokenize{appdev/refs/api/krb5_vprepend_error_message::doc}}\index{krb5\_vprepend\_error\_message (C function)@\spxentry{krb5\_vprepend\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_vprepend_error_message:c.krb5_vprepend_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_vprepend\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{code}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{fmt}\sphinxparamcomma \DUrole{n}{va\_list}\DUrole{w}{ }\DUrole{n}{args}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{code} \sphinxhyphen{} Error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fmt} \sphinxhyphen{} Format string for error message prefix - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{args} \sphinxhyphen{} List of vprintf(3) style arguments - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_prepend\_error\_message(), but uses a va\_list instead of variadic arguments. - -\sphinxstepscope - - -\subsubsection{krb5\_vset\_error\_message \sphinxhyphen{} Set an extended error message for an error code using a va\_list.} -\label{\detokenize{appdev/refs/api/krb5_vset_error_message:krb5-vset-error-message-set-an-extended-error-message-for-an-error-code-using-a-va-list}}\label{\detokenize{appdev/refs/api/krb5_vset_error_message::doc}}\index{krb5\_vset\_error\_message (C function)@\spxentry{krb5\_vset\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_vset_error_message:c.krb5_vset_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_vset\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{code}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{fmt}\sphinxparamcomma \DUrole{n}{va\_list}\DUrole{w}{ }\DUrole{n}{args}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{code} \sphinxhyphen{} Error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fmt} \sphinxhyphen{} Error string for the error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{args} \sphinxhyphen{} List of vprintf(3) style arguments - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_vwrap\_error\_message \sphinxhyphen{} Add a prefix to a different error code’s message using a va\_list.} -\label{\detokenize{appdev/refs/api/krb5_vwrap_error_message:krb5-vwrap-error-message-add-a-prefix-to-a-different-error-code-s-message-using-a-va-list}}\label{\detokenize{appdev/refs/api/krb5_vwrap_error_message::doc}}\index{krb5\_vwrap\_error\_message (C function)@\spxentry{krb5\_vwrap\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_vwrap_error_message:c.krb5_vwrap_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_vwrap\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{old\_code}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{code}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{fmt}\sphinxparamcomma \DUrole{n}{va\_list}\DUrole{w}{ }\DUrole{n}{args}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{old\_code} \sphinxhyphen{} Previous error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{code} \sphinxhyphen{} Error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fmt} \sphinxhyphen{} Format string for error message prefix - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{args} \sphinxhyphen{} List of vprintf(3) style arguments - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_wrap\_error\_message(), but uses a va\_list instead of variadic arguments. - -\sphinxstepscope - - -\subsubsection{krb5\_wrap\_error\_message \sphinxhyphen{} Add a prefix to a different error code’s message.} -\label{\detokenize{appdev/refs/api/krb5_wrap_error_message:krb5-wrap-error-message-add-a-prefix-to-a-different-error-code-s-message}}\label{\detokenize{appdev/refs/api/krb5_wrap_error_message::doc}}\index{krb5\_wrap\_error\_message (C function)@\spxentry{krb5\_wrap\_error\_message}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_wrap_error_message:c.krb5_wrap_error_message}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_wrap\_error\_message}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{ctx}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{old\_code}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\DUrole{n}{code}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{fmt}\sphinxparamcomma \DUrole{p}{...}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctx} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{old\_code} \sphinxhyphen{} Previous error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{code} \sphinxhyphen{} Error code - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fmt} \sphinxhyphen{} Format string for error message prefix - -\end{description}\end{quote} - -\sphinxAtStartPar -Format a message and prepend it to the message for \sphinxstyleemphasis{old\_code} . The prefix will be separated from the old message with a colon and space. Set the resulting message as the extended error message for \sphinxstyleemphasis{code} . - - -\subsection{Public interfaces that should not be called directly} -\label{\detokenize{appdev/refs/api/index:public-interfaces-that-should-not-be-called-directly}} -\sphinxstepscope - - -\subsubsection{krb5\_c\_block\_size \sphinxhyphen{} Return cipher block size.} -\label{\detokenize{appdev/refs/api/krb5_c_block_size:krb5-c-block-size-return-cipher-block-size}}\label{\detokenize{appdev/refs/api/krb5_c_block_size::doc}}\index{krb5\_c\_block\_size (C function)@\spxentry{krb5\_c\_block\_size}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_block_size:c.krb5_c_block_size}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_block\_size}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{blocksize}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{blocksize} \sphinxhyphen{} Block size for \sphinxstyleemphasis{enctype} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_checksum\_length \sphinxhyphen{} Return the length of checksums for a checksum type.} -\label{\detokenize{appdev/refs/api/krb5_c_checksum_length:krb5-c-checksum-length-return-the-length-of-checksums-for-a-checksum-type}}\label{\detokenize{appdev/refs/api/krb5_c_checksum_length::doc}}\index{krb5\_c\_checksum\_length (C function)@\spxentry{krb5\_c\_checksum\_length}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_checksum_length:c.krb5_c_checksum_length}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_checksum\_length}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{length}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{length} \sphinxhyphen{} Checksum length - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_crypto\_length \sphinxhyphen{} Return a length of a message field specific to the encryption type.} -\label{\detokenize{appdev/refs/api/krb5_c_crypto_length:krb5-c-crypto-length-return-a-length-of-a-message-field-specific-to-the-encryption-type}}\label{\detokenize{appdev/refs/api/krb5_c_crypto_length::doc}}\index{krb5\_c\_crypto\_length (C function)@\spxentry{krb5\_c\_crypto\_length}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_crypto_length:c.krb5_c_crypto_length}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_crypto\_length}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cryptotype:c.krb5_cryptotype}]{\sphinxcrossref{\DUrole{n}{krb5\_cryptotype}}}}\DUrole{w}{ }\DUrole{n}{type}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{size}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{type} \sphinxhyphen{} Type field (See KRB5\_CRYPTO\_TYPE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{size} \sphinxhyphen{} Length of the \sphinxstyleemphasis{type} specific to \sphinxstyleemphasis{enctype} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_crypto\_length\_iov \sphinxhyphen{} Fill in lengths for header, trailer and padding in a IOV array.} -\label{\detokenize{appdev/refs/api/krb5_c_crypto_length_iov:krb5-c-crypto-length-iov-fill-in-lengths-for-header-trailer-and-padding-in-a-iov-array}}\label{\detokenize{appdev/refs/api/krb5_c_crypto_length_iov::doc}}\index{krb5\_c\_crypto\_length\_iov (C function)@\spxentry{krb5\_c\_crypto\_length\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_crypto_length_iov:c.krb5_c_crypto_length_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_crypto\_length\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Padding is set to the actual padding required based on the provided \sphinxstyleemphasis{data} buffers. Typically this API is used after setting up the data buffers and KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY buffers, but before actually allocating header, trailer and padding. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_decrypt \sphinxhyphen{} Decrypt data using a key (operates on keyblock).} -\label{\detokenize{appdev/refs/api/krb5_c_decrypt:krb5-c-decrypt-decrypt-data-using-a-key-operates-on-keyblock}}\label{\detokenize{appdev/refs/api/krb5_c_decrypt::doc}}\index{krb5\_c\_decrypt (C function)@\spxentry{krb5\_c\_decrypt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_decrypt:c.krb5_c_decrypt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_decrypt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cipher\_state}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{output}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{cipher\_state} \sphinxhyphen{} Cipher state; specify NULL if not needed - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Encrypted data - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{output} \sphinxhyphen{} Decrypted data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function decrypts the data block \sphinxstyleemphasis{input} and stores the output into \sphinxstyleemphasis{output} . The actual decryption key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the encryption type. If non\sphinxhyphen{}null, \sphinxstyleemphasis{cipher\_state} specifies the beginning state for the decryption operation, and is updated with the state to be passed as input to the next operation. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The caller must initialize \sphinxstyleemphasis{output} and allocate at least enough space for the result. The usual practice is to allocate an output buffer as long as the ciphertext, and let krb5\_c\_decrypt() trim \sphinxstyleemphasis{output\sphinxhyphen{}\textgreater{}length} . For some enctypes, the resulting \sphinxstyleemphasis{output\sphinxhyphen{}\textgreater{}length} may include padding bytes. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_decrypt\_iov \sphinxhyphen{} Decrypt data in place supporting AEAD (operates on keyblock).} -\label{\detokenize{appdev/refs/api/krb5_c_decrypt_iov:krb5-c-decrypt-iov-decrypt-data-in-place-supporting-aead-operates-on-keyblock}}\label{\detokenize{appdev/refs/api/krb5_c_decrypt_iov::doc}}\index{krb5\_c\_decrypt\_iov (C function)@\spxentry{krb5\_c\_decrypt\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_decrypt_iov:c.krb5_c_decrypt_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_decrypt\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keyblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cipher\_state}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} Encryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cipher\_state} \sphinxhyphen{} Cipher state; specify NULL if not needed - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array. Modified in\sphinxhyphen{}place. - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function decrypts the data block \sphinxstyleemphasis{data} and stores the output in\sphinxhyphen{}place. The actual decryption key will be derived from \sphinxstyleemphasis{keyblock} and \sphinxstyleemphasis{usage} if key derivation is specified for the encryption type. If non\sphinxhyphen{}null, \sphinxstyleemphasis{cipher\_state} specifies the beginning state for the decryption operation, and is updated with the state to be passed as input to the next operation. The caller must allocate the right number of krb5\_crypto\_iov structures before calling into this API. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_c\_decrypt\_iov() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -On return from a krb5\_c\_decrypt\_iov() call, the \sphinxstyleemphasis{data\sphinxhyphen{}\textgreater{}length} in the iov structure are adjusted to reflect actual lengths of the ciphertext used. For example, if the padding length is too large, the length will be reduced. Lengths are never increased. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_derive\_prfplus \sphinxhyphen{} Derive a key using some input data (via RFC 6113 PRF+).} -\label{\detokenize{appdev/refs/api/krb5_c_derive_prfplus:krb5-c-derive-prfplus-derive-a-key-using-some-input-data-via-rfc-6113-prf}}\label{\detokenize{appdev/refs/api/krb5_c_derive_prfplus::doc}}\index{krb5\_c\_derive\_prfplus (C function)@\spxentry{krb5\_c\_derive\_prfplus}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_derive_prfplus:c.krb5_c_derive_prfplus}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_derive\_prfplus}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{k} \sphinxhyphen{} KDC contribution key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Input string - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Output key enctype (or \sphinxstylestrong{ENCTYPE\_NULL} ) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} Derived keyblock - -\end{description}\end{quote} - -\sphinxAtStartPar -This function uses PRF+ as defined in RFC 6113 to derive a key from another key and an input string. If \sphinxstyleemphasis{enctype} is \sphinxstylestrong{ENCTYPE\_NULL} , the output key will have the same enctype as the input key. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_encrypt \sphinxhyphen{} Encrypt data using a key (operates on keyblock).} -\label{\detokenize{appdev/refs/api/krb5_c_encrypt:krb5-c-encrypt-encrypt-data-using-a-key-operates-on-keyblock}}\label{\detokenize{appdev/refs/api/krb5_c_encrypt::doc}}\index{krb5\_c\_encrypt (C function)@\spxentry{krb5\_c\_encrypt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_encrypt:c.krb5_c_encrypt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_encrypt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cipher\_state}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{output}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{cipher\_state} \sphinxhyphen{} Cipher state; specify NULL if not needed - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Data to be encrypted - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{output} \sphinxhyphen{} Encrypted data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function encrypts the data block \sphinxstyleemphasis{input} and stores the output into \sphinxstyleemphasis{output} . The actual encryption key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the encryption type. If non\sphinxhyphen{}null, \sphinxstyleemphasis{cipher\_state} specifies the beginning state for the encryption operation, and is updated with the state to be passed as input to the next operation. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The caller must initialize \sphinxstyleemphasis{output} and allocate at least enough space for the result (using krb5\_c\_encrypt\_length() to determine the amount of space needed). \sphinxstyleemphasis{output\sphinxhyphen{}\textgreater{}length} will be set to the actual length of the ciphertext. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_encrypt\_iov \sphinxhyphen{} Encrypt data in place supporting AEAD (operates on keyblock).} -\label{\detokenize{appdev/refs/api/krb5_c_encrypt_iov:krb5-c-encrypt-iov-encrypt-data-in-place-supporting-aead-operates-on-keyblock}}\label{\detokenize{appdev/refs/api/krb5_c_encrypt_iov::doc}}\index{krb5\_c\_encrypt\_iov (C function)@\spxentry{krb5\_c\_encrypt\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_encrypt_iov:c.krb5_c_encrypt_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_encrypt\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keyblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cipher\_state}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} Encryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cipher\_state} \sphinxhyphen{} Cipher state; specify NULL if not needed - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array. Modified in\sphinxhyphen{}place. - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function encrypts the data block \sphinxstyleemphasis{data} and stores the output in\sphinxhyphen{}place. The actual encryption key will be derived from \sphinxstyleemphasis{keyblock} and \sphinxstyleemphasis{usage} if key derivation is specified for the encryption type. If non\sphinxhyphen{}null, \sphinxstyleemphasis{cipher\_state} specifies the beginning state for the encryption operation, and is updated with the state to be passed as input to the next operation. The caller must allocate the right number of krb5\_crypto\_iov structures before calling into this API. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_c\_decrypt\_iov() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -On return from a krb5\_c\_encrypt\_iov() call, the \sphinxstyleemphasis{data\sphinxhyphen{}\textgreater{}length} in the iov structure are adjusted to reflect actual lengths of the ciphertext used. For example, if the padding length is too large, the length will be reduced. Lengths are never increased. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_encrypt\_length \sphinxhyphen{} Compute encrypted data length.} -\label{\detokenize{appdev/refs/api/krb5_c_encrypt_length:krb5-c-encrypt-length-compute-encrypted-data-length}}\label{\detokenize{appdev/refs/api/krb5_c_encrypt_length::doc}}\index{krb5\_c\_encrypt\_length (C function)@\spxentry{krb5\_c\_encrypt\_length}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_encrypt_length:c.krb5_c_encrypt_length}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_encrypt\_length}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{inputlen}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{length}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{inputlen} \sphinxhyphen{} Length of the data to be encrypted - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{length} \sphinxhyphen{} Length of the encrypted data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function computes the length of the ciphertext produced by encrypting \sphinxstyleemphasis{inputlen} bytes including padding, confounder, and checksum. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_enctype\_compare \sphinxhyphen{} Compare two encryption types.} -\label{\detokenize{appdev/refs/api/krb5_c_enctype_compare:krb5-c-enctype-compare-compare-two-encryption-types}}\label{\detokenize{appdev/refs/api/krb5_c_enctype_compare::doc}}\index{krb5\_c\_enctype\_compare (C function)@\spxentry{krb5\_c\_enctype\_compare}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_enctype_compare:c.krb5_c_enctype_compare}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_enctype\_compare}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{e1}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{e2}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{similar}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{e1} \sphinxhyphen{} First encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{e2} \sphinxhyphen{} Second encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{similar} \sphinxhyphen{} \sphinxstylestrong{TRUE} if types are similar, \sphinxstylestrong{FALSE} if not - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function determines whether two encryption types use the same kind of keys. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_free\_state \sphinxhyphen{} Free a cipher state previously allocated by krb5\_c\_init\_state().} -\label{\detokenize{appdev/refs/api/krb5_c_free_state:krb5-c-free-state-free-a-cipher-state-previously-allocated-by-krb5-c-init-state}}\label{\detokenize{appdev/refs/api/krb5_c_free_state::doc}}\index{krb5\_c\_free\_state (C function)@\spxentry{krb5\_c\_free\_state}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_free_state:c.krb5_c_free_state}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_free\_state}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{state}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{state} \sphinxhyphen{} Cipher state to be freed - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_fx\_cf2\_simple \sphinxhyphen{} Compute the KRB\sphinxhyphen{}FX\sphinxhyphen{}CF2 combination of two keys and pepper strings.} -\label{\detokenize{appdev/refs/api/krb5_c_fx_cf2_simple:krb5-c-fx-cf2-simple-compute-the-krb-fx-cf2-combination-of-two-keys-and-pepper-strings}}\label{\detokenize{appdev/refs/api/krb5_c_fx_cf2_simple::doc}}\index{krb5\_c\_fx\_cf2\_simple (C function)@\spxentry{krb5\_c\_fx\_cf2\_simple}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_fx_cf2_simple:c.krb5_c_fx_cf2_simple}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_fx\_cf2\_simple}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k1}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pepper1}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k2}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pepper2}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{k1} \sphinxhyphen{} KDC contribution key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pepper1} \sphinxhyphen{} String”PKINIT” - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{k2} \sphinxhyphen{} Reply key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{pepper2} \sphinxhyphen{} String”KeyExchange” - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} Output key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function computes the KRB\sphinxhyphen{}FX\sphinxhyphen{}CF2 function over its inputs and places the results in a newly allocated keyblock. This function is simple in that it assumes that \sphinxstyleemphasis{pepper1} and \sphinxstyleemphasis{pepper2} are C strings with no internal nulls and that the enctype of the result will be the same as that of \sphinxstyleemphasis{k1} . \sphinxstyleemphasis{k1} and \sphinxstyleemphasis{k2} may be of different enctypes. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_init\_state \sphinxhyphen{} Initialize a new cipher state.} -\label{\detokenize{appdev/refs/api/krb5_c_init_state:krb5-c-init-state-initialize-a-new-cipher-state}}\label{\detokenize{appdev/refs/api/krb5_c_init_state::doc}}\index{krb5\_c\_init\_state (C function)@\spxentry{krb5\_c\_init\_state}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_init_state:c.krb5_c_init_state}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_init\_state}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{new\_state}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{new\_state} \sphinxhyphen{} New cipher state - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_is\_coll\_proof\_cksum \sphinxhyphen{} Test whether a checksum type is collision\sphinxhyphen{}proof.} -\label{\detokenize{appdev/refs/api/krb5_c_is_coll_proof_cksum:krb5-c-is-coll-proof-cksum-test-whether-a-checksum-type-is-collision-proof}}\label{\detokenize{appdev/refs/api/krb5_c_is_coll_proof_cksum::doc}}\index{krb5\_c\_is\_coll\_proof\_cksum (C function)@\spxentry{krb5\_c\_is\_coll\_proof\_cksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_is_coll_proof_cksum:c.krb5_c_is_coll_proof_cksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_is\_coll\_proof\_cksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{ctype}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctype} \sphinxhyphen{} Checksum type - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if ctype is collision\sphinxhyphen{}proof, FALSE if it is not collision\sphinxhyphen{}proof or not a valid checksum type. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_is\_keyed\_cksum \sphinxhyphen{} Test whether a checksum type is keyed.} -\label{\detokenize{appdev/refs/api/krb5_c_is_keyed_cksum:krb5-c-is-keyed-cksum-test-whether-a-checksum-type-is-keyed}}\label{\detokenize{appdev/refs/api/krb5_c_is_keyed_cksum::doc}}\index{krb5\_c\_is\_keyed\_cksum (C function)@\spxentry{krb5\_c\_is\_keyed\_cksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_is_keyed_cksum:c.krb5_c_is_keyed_cksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_is\_keyed\_cksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{ctype}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctype} \sphinxhyphen{} Checksum type - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if ctype is a keyed checksum type, FALSE otherwise. - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_keyed\_checksum\_types \sphinxhyphen{} Return a list of keyed checksum types usable with an encryption type.} -\label{\detokenize{appdev/refs/api/krb5_c_keyed_checksum_types:krb5-c-keyed-checksum-types-return-a-list-of-keyed-checksum-types-usable-with-an-encryption-type}}\label{\detokenize{appdev/refs/api/krb5_c_keyed_checksum_types::doc}}\index{krb5\_c\_keyed\_checksum\_types (C function)@\spxentry{krb5\_c\_keyed\_checksum\_types}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_keyed_checksum_types:c.krb5_c_keyed_checksum_types}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_keyed\_checksum\_types}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{count}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{cksumtypes}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{count} \sphinxhyphen{} Count of allowable checksum types - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cksumtypes} \sphinxhyphen{} Array of allowable checksum types - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_cksumtypes() to free \sphinxstyleemphasis{cksumtypes} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_keylengths \sphinxhyphen{} Return length of the specified key in bytes.} -\label{\detokenize{appdev/refs/api/krb5_c_keylengths:krb5-c-keylengths-return-length-of-the-specified-key-in-bytes}}\label{\detokenize{appdev/refs/api/krb5_c_keylengths::doc}}\index{krb5\_c\_keylengths (C function)@\spxentry{krb5\_c\_keylengths}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_keylengths:c.krb5_c_keylengths}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_keylengths}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keybytes}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keylength}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{keybytes} \sphinxhyphen{} Number of bytes required to make a key - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{keylength} \sphinxhyphen{} Length of final key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_make\_checksum \sphinxhyphen{} Compute a checksum (operates on keyblock).} -\label{\detokenize{appdev/refs/api/krb5_c_make_checksum:krb5-c-make-checksum-compute-a-checksum-operates-on-keyblock}}\label{\detokenize{appdev/refs/api/krb5_c_make_checksum::doc}}\index{krb5\_c\_make\_checksum (C function)@\spxentry{krb5\_c\_make\_checksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_make_checksum:c.krb5_c_make_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_make\_checksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cksum}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type (0 for mandatory type) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key for a keyed checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Input data - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cksum} \sphinxhyphen{} Generated checksum - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function computes a checksum of type \sphinxstyleemphasis{cksumtype} over \sphinxstyleemphasis{input} , using \sphinxstyleemphasis{key} if the checksum type is a keyed checksum. If \sphinxstyleemphasis{cksumtype} is 0 and \sphinxstyleemphasis{key} is non\sphinxhyphen{}null, the checksum type will be the mandatory\sphinxhyphen{}to\sphinxhyphen{}implement checksum type for the key’s encryption type. The actual checksum key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the checksum type. The newly created \sphinxstyleemphasis{cksum} must be released by calling krb5\_free\_checksum\_contents() when it is no longer needed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_c\_verify\_checksum() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_k\_make\_checksum(), but operates on keyblock \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_make\_checksum\_iov \sphinxhyphen{} Fill in a checksum element in IOV array (operates on keyblock)} -\label{\detokenize{appdev/refs/api/krb5_c_make_checksum_iov:krb5-c-make-checksum-iov-fill-in-a-checksum-element-in-iov-array-operates-on-keyblock}}\label{\detokenize{appdev/refs/api/krb5_c_make_checksum_iov::doc}}\index{krb5\_c\_make\_checksum\_iov (C function)@\spxentry{krb5\_c\_make\_checksum\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_make_checksum_iov:c.krb5_c_make_checksum_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_make\_checksum\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type (0 for mandatory type) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key for a keyed checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Create a checksum in the KRB5\_CRYPTO\_TYPE\_CHECKSUM element over KRB5\_CRYPTO\_TYPE\_DATA and KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY chunks in \sphinxstyleemphasis{data} . Only the KRB5\_CRYPTO\_TYPE\_CHECKSUM region is modified. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_c\_verify\_checksum\_iov() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_k\_make\_checksum\_iov(), but operates on keyblock \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_make\_random\_key \sphinxhyphen{} Generate an enctype\sphinxhyphen{}specific random encryption key.} -\label{\detokenize{appdev/refs/api/krb5_c_make_random_key:krb5-c-make-random-key-generate-an-enctype-specific-random-encryption-key}}\label{\detokenize{appdev/refs/api/krb5_c_make_random_key::doc}}\index{krb5\_c\_make\_random\_key (C function)@\spxentry{krb5\_c\_make\_random\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_make_random_key:c.krb5_c_make_random_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_make\_random\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k5\_random\_key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type of the generated key - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{k5\_random\_key} \sphinxhyphen{} An allocated and initialized keyblock - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_keyblock\_contents() to free \sphinxstyleemphasis{k5\_random\_key} when no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_padding\_length \sphinxhyphen{} Return a number of padding octets.} -\label{\detokenize{appdev/refs/api/krb5_c_padding_length:krb5-c-padding-length-return-a-number-of-padding-octets}}\label{\detokenize{appdev/refs/api/krb5_c_padding_length::doc}}\index{krb5\_c\_padding\_length (C function)@\spxentry{krb5\_c\_padding\_length}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_padding_length:c.krb5_c_padding_length}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_padding\_length}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{data\_length}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{size}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data\_length} \sphinxhyphen{} Length of the plaintext to pad - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{size} \sphinxhyphen{} Number of padding octets - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} KRB5\_BAD\_ENCTYPE - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function returns the number of the padding octets required to pad \sphinxstyleemphasis{data\_length} octets of plaintext. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_prf \sphinxhyphen{} Generate enctype\sphinxhyphen{}specific pseudo\sphinxhyphen{}random bytes.} -\label{\detokenize{appdev/refs/api/krb5_c_prf:krb5-c-prf-generate-enctype-specific-pseudo-random-bytes}}\label{\detokenize{appdev/refs/api/krb5_c_prf::doc}}\index{krb5\_c\_prf (C function)@\spxentry{krb5\_c\_prf}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_prf:c.krb5_c_prf}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_prf}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keyblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{output}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keyblock} \sphinxhyphen{} Key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Input data - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{output} \sphinxhyphen{} Output data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function selects a pseudo\sphinxhyphen{}random function based on \sphinxstyleemphasis{keyblock} and computes its value over \sphinxstyleemphasis{input} , placing the result into \sphinxstyleemphasis{output} . The caller must preinitialize \sphinxstyleemphasis{output} and allocate space for the result, using krb5\_c\_prf\_length() to determine the required length. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_prfplus \sphinxhyphen{} Generate pseudo\sphinxhyphen{}random bytes using RFC 6113 PRF+.} -\label{\detokenize{appdev/refs/api/krb5_c_prfplus:krb5-c-prfplus-generate-pseudo-random-bytes-using-rfc-6113-prf}}\label{\detokenize{appdev/refs/api/krb5_c_prfplus::doc}}\index{krb5\_c\_prfplus (C function)@\spxentry{krb5\_c\_prfplus}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_prfplus:c.krb5_c_prfplus}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_prfplus}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{output}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{k} \sphinxhyphen{} KDC contribution key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Input data - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{output} \sphinxhyphen{} Pseudo\sphinxhyphen{}random output buffer - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -0 on success, E2BIG if output\sphinxhyphen{}\textgreater{}length is too large for PRF+ to generate, ENOMEM on allocation failure, or an error code from krb5\_c\_prf() - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function fills \sphinxstyleemphasis{output} with PRF+(k, input) as defined in RFC 6113 section 5.1. The caller must preinitialize \sphinxstyleemphasis{output} and allocate the desired amount of space. The length of the pseudo\sphinxhyphen{}random output will match the length of \sphinxstyleemphasis{output} . - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -RFC 4402 defines a different PRF+ operation. This function does not implement that operation. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_prf\_length \sphinxhyphen{} Get the output length of pseudo\sphinxhyphen{}random functions for an encryption type.} -\label{\detokenize{appdev/refs/api/krb5_c_prf_length:krb5-c-prf-length-get-the-output-length-of-pseudo-random-functions-for-an-encryption-type}}\label{\detokenize{appdev/refs/api/krb5_c_prf_length::doc}}\index{krb5\_c\_prf\_length (C function)@\spxentry{krb5\_c\_prf\_length}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_prf_length:c.krb5_c_prf_length}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_prf\_length}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{len}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{len} \sphinxhyphen{} Length of PRF output - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_random\_add\_entropy} -\label{\detokenize{appdev/refs/api/krb5_c_random_add_entropy:krb5-c-random-add-entropy}}\label{\detokenize{appdev/refs/api/krb5_c_random_add_entropy::doc}}\index{krb5\_c\_random\_add\_entropy (C function)@\spxentry{krb5\_c\_random\_add\_entropy}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_random_add_entropy:c.krb5_c_random_add_entropy}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_random\_add\_entropy}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{randsource}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{randsource} - -\sphinxAtStartPar -\sphinxstylestrong{data} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED This call is no longer necessary. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_random\_make\_octets \sphinxhyphen{} Generate pseudo\sphinxhyphen{}random bytes.} -\label{\detokenize{appdev/refs/api/krb5_c_random_make_octets:krb5-c-random-make-octets-generate-pseudo-random-bytes}}\label{\detokenize{appdev/refs/api/krb5_c_random_make_octets::doc}}\index{krb5\_c\_random\_make\_octets (C function)@\spxentry{krb5\_c\_random\_make\_octets}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_random_make_octets:c.krb5_c_random_make_octets}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_random\_make\_octets}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{data} \sphinxhyphen{} Random data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Fills in \sphinxstyleemphasis{data} with bytes from the PRNG used by krb5 crypto operations. The caller must preinitialize \sphinxstyleemphasis{data} and allocate the desired amount of space. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_random\_os\_entropy} -\label{\detokenize{appdev/refs/api/krb5_c_random_os_entropy:krb5-c-random-os-entropy}}\label{\detokenize{appdev/refs/api/krb5_c_random_os_entropy::doc}}\index{krb5\_c\_random\_os\_entropy (C function)@\spxentry{krb5\_c\_random\_os\_entropy}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_random_os_entropy:c.krb5_c_random_os_entropy}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_random\_os\_entropy}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{strong}\sphinxparamcomma \DUrole{kt}{int}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{success}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{strong} - -\sphinxAtStartPar -\sphinxstylestrong{success} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED This call is no longer necessary. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_random\_to\_key \sphinxhyphen{} Generate an enctype\sphinxhyphen{}specific key from random data.} -\label{\detokenize{appdev/refs/api/krb5_c_random_to_key:krb5-c-random-to-key-generate-an-enctype-specific-key-from-random-data}}\label{\detokenize{appdev/refs/api/krb5_c_random_to_key::doc}}\index{krb5\_c\_random\_to\_key (C function)@\spxentry{krb5\_c\_random\_to\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_random_to_key:c.krb5_c_random_to_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_random\_to\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{random\_data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{k5\_random\_key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{random\_data} \sphinxhyphen{} Random input data - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{k5\_random\_key} \sphinxhyphen{} Resulting key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function takes random input data \sphinxstyleemphasis{random\_data} and produces a valid key \sphinxstyleemphasis{k5\_random\_key} for a given \sphinxstyleemphasis{enctype} . - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_c\_keylengths() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -It is assumed that \sphinxstyleemphasis{k5\_random\_key} has already been initialized and \sphinxstyleemphasis{k5\_random\_key\sphinxhyphen{}\textgreater{}contents} has been allocated with the correct length. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_string\_to\_key \sphinxhyphen{} Convert a string (such a password) to a key.} -\label{\detokenize{appdev/refs/api/krb5_c_string_to_key:krb5-c-string-to-key-convert-a-string-such-a-password-to-a-key}}\label{\detokenize{appdev/refs/api/krb5_c_string_to_key::doc}}\index{krb5\_c\_string\_to\_key (C function)@\spxentry{krb5\_c\_string\_to\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_string_to_key:c.krb5_c_string_to_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_string\_to\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{string}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{salt}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{string} \sphinxhyphen{} String to be converted - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{salt} \sphinxhyphen{} Salt value - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{key} \sphinxhyphen{} Generated key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function converts \sphinxstyleemphasis{string} to a \sphinxstyleemphasis{key} of encryption type \sphinxstyleemphasis{enctype} , using the specified \sphinxstyleemphasis{salt} . The newly created \sphinxstyleemphasis{key} must be released by calling krb5\_free\_keyblock\_contents() when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_string\_to\_key\_with\_params \sphinxhyphen{} Convert a string (such as a password) to a key with additional parameters.} -\label{\detokenize{appdev/refs/api/krb5_c_string_to_key_with_params:krb5-c-string-to-key-with-params-convert-a-string-such-as-a-password-to-a-key-with-additional-parameters}}\label{\detokenize{appdev/refs/api/krb5_c_string_to_key_with_params::doc}}\index{krb5\_c\_string\_to\_key\_with\_params (C function)@\spxentry{krb5\_c\_string\_to\_key\_with\_params}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_string_to_key_with_params:c.krb5_c_string_to_key_with_params}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_string\_to\_key\_with\_params}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{string}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{salt}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{params}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{string} \sphinxhyphen{} String to be converted - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{salt} \sphinxhyphen{} Salt value - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{params} \sphinxhyphen{} Parameters - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{key} \sphinxhyphen{} Generated key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_c\_string\_to\_key(), but also takes parameters which may affect the algorithm in an enctype\sphinxhyphen{}dependent way. The newly created \sphinxstyleemphasis{key} must be released by calling krb5\_free\_keyblock\_contents() when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_c\_valid\_cksumtype \sphinxhyphen{} Verify that specified checksum type is a valid Kerberos checksum type.} -\label{\detokenize{appdev/refs/api/krb5_c_valid_cksumtype:krb5-c-valid-cksumtype-verify-that-specified-checksum-type-is-a-valid-kerberos-checksum-type}}\label{\detokenize{appdev/refs/api/krb5_c_valid_cksumtype::doc}}\index{krb5\_c\_valid\_cksumtype (C function)@\spxentry{krb5\_c\_valid\_cksumtype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_valid_cksumtype:c.krb5_c_valid_cksumtype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_valid\_cksumtype}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{ctype}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ctype} \sphinxhyphen{} Checksum type - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if ctype is valid, FALSE if not - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_valid\_enctype \sphinxhyphen{} Verify that a specified encryption type is a valid Kerberos encryption type.} -\label{\detokenize{appdev/refs/api/krb5_c_valid_enctype:krb5-c-valid-enctype-verify-that-a-specified-encryption-type-is-a-valid-kerberos-encryption-type}}\label{\detokenize{appdev/refs/api/krb5_c_valid_enctype::doc}}\index{krb5\_c\_valid\_enctype (C function)@\spxentry{krb5\_c\_valid\_enctype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_valid_enctype:c.krb5_c_valid_enctype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_valid\_enctype}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{ktype}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ktype} \sphinxhyphen{} Encryption type - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{return}\begin{itemize} -\item {} -\sphinxAtStartPar -TRUE if ktype is valid, FALSE if not - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_verify\_checksum \sphinxhyphen{} Verify a checksum (operates on keyblock).} -\label{\detokenize{appdev/refs/api/krb5_c_verify_checksum:krb5-c-verify-checksum-verify-a-checksum-operates-on-keyblock}}\label{\detokenize{appdev/refs/api/krb5_c_verify_checksum::doc}}\index{krb5\_c\_verify\_checksum (C function)@\spxentry{krb5\_c\_verify\_checksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_verify_checksum:c.krb5_c_verify_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_verify\_checksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cksum}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{valid}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key for a keyed checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} \sphinxstyleemphasis{key} usage - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Data to be used to compute a new checksum using \sphinxstyleemphasis{key} to compare \sphinxstyleemphasis{cksum} against - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksum} \sphinxhyphen{} Checksum to be verified - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{valid} \sphinxhyphen{} Non\sphinxhyphen{}zero for success, zero for failure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function verifies that \sphinxstyleemphasis{cksum} is a valid checksum for \sphinxstyleemphasis{data} . If the checksum type of \sphinxstyleemphasis{cksum} is a keyed checksum, \sphinxstyleemphasis{key} is used to verify the checksum. If the checksum type in \sphinxstyleemphasis{cksum} is 0 and \sphinxstyleemphasis{key} is not NULL, the mandatory checksum type for \sphinxstyleemphasis{key} will be used. The actual checksum key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the checksum type. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_k\_verify\_checksum(), but operates on keyblock \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_c\_verify\_checksum\_iov \sphinxhyphen{} Validate a checksum element in IOV array (operates on keyblock).} -\label{\detokenize{appdev/refs/api/krb5_c_verify_checksum_iov:krb5-c-verify-checksum-iov-validate-a-checksum-element-in-iov-array-operates-on-keyblock}}\label{\detokenize{appdev/refs/api/krb5_c_verify_checksum_iov::doc}}\index{krb5\_c\_verify\_checksum\_iov (C function)@\spxentry{krb5\_c\_verify\_checksum\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_verify_checksum_iov:c.krb5_c_verify_checksum_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_verify\_checksum\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{valid}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type (0 for mandatory type) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key for a keyed checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{valid} \sphinxhyphen{} Non\sphinxhyphen{}zero for success, zero for failure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Confirm that the checksum in the KRB5\_CRYPTO\_TYPE\_CHECKSUM element is a valid checksum of the KRB5\_CRYPTO\_TYPE\_DATA and KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY regions in the iov. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_c\_make\_checksum\_iov() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_k\_verify\_checksum\_iov(), but operates on keyblock \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_cksumtype\_to\_string \sphinxhyphen{} Convert a checksum type to a string.} -\label{\detokenize{appdev/refs/api/krb5_cksumtype_to_string:krb5-cksumtype-to-string-convert-a-checksum-type-to-a-string}}\label{\detokenize{appdev/refs/api/krb5_cksumtype_to_string::doc}}\index{krb5\_cksumtype\_to\_string (C function)@\spxentry{krb5\_cksumtype\_to\_string}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cksumtype_to_string:c.krb5_cksumtype_to_string}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cksumtype\_to\_string}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{buffer}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{buflen}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{buffer} \sphinxhyphen{} Buffer to hold converted checksum type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{buflen} \sphinxhyphen{} Storage available in \sphinxstyleemphasis{buffer} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_decode\_authdata\_container \sphinxhyphen{} Unwrap authorization data.} -\label{\detokenize{appdev/refs/api/krb5_decode_authdata_container:krb5-decode-authdata-container-unwrap-authorization-data}}\label{\detokenize{appdev/refs/api/krb5_decode_authdata_container::doc}}\index{krb5\_decode\_authdata\_container (C function)@\spxentry{krb5\_decode\_authdata\_container}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_decode_authdata_container:c.krb5_decode_authdata_container}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_decode\_authdata\_container}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdatatype:c.krb5_authdatatype}]{\sphinxcrossref{\DUrole{n}{krb5\_authdatatype}}}}\DUrole{w}{ }\DUrole{n}{type}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{container}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{authdata}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{type} \sphinxhyphen{} Container type (see KRB5\_AUTHDATA macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{container} \sphinxhyphen{} Authorization data to be decoded - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{authdata} \sphinxhyphen{} List of decoded authorization data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_encode\_authdata\_container() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_decode\_ticket \sphinxhyphen{} Decode an ASN.1\sphinxhyphen{}formatted ticket.} -\label{\detokenize{appdev/refs/api/krb5_decode_ticket:krb5-decode-ticket-decode-an-asn-1-formatted-ticket}}\label{\detokenize{appdev/refs/api/krb5_decode_ticket::doc}}\index{krb5\_decode\_ticket (C function)@\spxentry{krb5\_decode\_ticket}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_decode_ticket:c.krb5_decode_ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_decode\_ticket}}}}{\DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{code}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{rep}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{code} \sphinxhyphen{} ASN.1\sphinxhyphen{}formatted ticket - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rep} \sphinxhyphen{} Decoded ticket information - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_deltat\_to\_string \sphinxhyphen{} Convert a relative time value to a string.} -\label{\detokenize{appdev/refs/api/krb5_deltat_to_string:krb5-deltat-to-string-convert-a-relative-time-value-to-a-string}}\label{\detokenize{appdev/refs/api/krb5_deltat_to_string::doc}}\index{krb5\_deltat\_to\_string (C function)@\spxentry{krb5\_deltat\_to\_string}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_deltat_to_string:c.krb5_deltat_to_string}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_deltat\_to\_string}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\DUrole{n}{deltat}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{buffer}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{buflen}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{deltat} \sphinxhyphen{} Relative time value to convert - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{buffer} \sphinxhyphen{} Buffer to hold time string - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{buflen} \sphinxhyphen{} Storage available in \sphinxstyleemphasis{buffer} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_encode\_authdata\_container \sphinxhyphen{} Wrap authorization data in a container.} -\label{\detokenize{appdev/refs/api/krb5_encode_authdata_container:krb5-encode-authdata-container-wrap-authorization-data-in-a-container}}\label{\detokenize{appdev/refs/api/krb5_encode_authdata_container::doc}}\index{krb5\_encode\_authdata\_container (C function)@\spxentry{krb5\_encode\_authdata\_container}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_encode_authdata_container:c.krb5_encode_authdata_container}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_encode\_authdata\_container}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdatatype:c.krb5_authdatatype}]{\sphinxcrossref{\DUrole{n}{krb5\_authdatatype}}}}\DUrole{w}{ }\DUrole{n}{type}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{authdata}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{container}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{type} \sphinxhyphen{} Container type (see KRB5\_AUTHDATA macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{authdata} \sphinxhyphen{} List of authorization data to be encoded - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{container} \sphinxhyphen{} List of encoded authorization data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The result is returned in \sphinxstyleemphasis{container} as a single\sphinxhyphen{}element list. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_decode\_authdata\_container() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_enctype\_to\_name \sphinxhyphen{} Convert an encryption type to a name or alias.} -\label{\detokenize{appdev/refs/api/krb5_enctype_to_name:krb5-enctype-to-name-convert-an-encryption-type-to-a-name-or-alias}}\label{\detokenize{appdev/refs/api/krb5_enctype_to_name::doc}}\index{krb5\_enctype\_to\_name (C function)@\spxentry{krb5\_enctype\_to\_name}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_enctype_to_name:c.krb5_enctype_to_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_enctype\_to\_name}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{n}{shortest}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{buffer}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{buflen}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{shortest} \sphinxhyphen{} Flag - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{buffer} \sphinxhyphen{} Buffer to hold encryption type string - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{buflen} \sphinxhyphen{} Storage available in \sphinxstyleemphasis{buffer} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -If \sphinxstyleemphasis{shortest} is FALSE, this function returns the enctype’s canonical name (like”aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96”). If \sphinxstyleemphasis{shortest} is TRUE, it return the enctype’s shortest alias (like”aes128\sphinxhyphen{}cts”). - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -New in 1.9 -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_enctype\_to\_string \sphinxhyphen{} Convert an encryption type to a string.} -\label{\detokenize{appdev/refs/api/krb5_enctype_to_string:krb5-enctype-to-string-convert-an-encryption-type-to-a-string}}\label{\detokenize{appdev/refs/api/krb5_enctype_to_string::doc}}\index{krb5\_enctype\_to\_string (C function)@\spxentry{krb5\_enctype\_to\_string}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_enctype_to_string:c.krb5_enctype_to_string}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_enctype\_to\_string}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{buffer}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{buflen}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{enctype} \sphinxhyphen{} Encryption type - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{buffer} \sphinxhyphen{} Buffer to hold encryption type string - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{buflen} \sphinxhyphen{} Storage available in \sphinxstyleemphasis{buffer} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_checksum \sphinxhyphen{} Free a krb5\_checksum structure.} -\label{\detokenize{appdev/refs/api/krb5_free_checksum:krb5-free-checksum-free-a-krb5-checksum-structure}}\label{\detokenize{appdev/refs/api/krb5_free_checksum::doc}}\index{krb5\_free\_checksum (C function)@\spxentry{krb5\_free\_checksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_checksum:c.krb5_free_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_checksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Checksum structure to be freed - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} and the structure itself. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_checksum\_contents \sphinxhyphen{} Free the contents of a krb5\_checksum structure.} -\label{\detokenize{appdev/refs/api/krb5_free_checksum_contents:krb5-free-checksum-contents-free-the-contents-of-a-krb5-checksum-structure}}\label{\detokenize{appdev/refs/api/krb5_free_checksum_contents::doc}}\index{krb5\_free\_checksum\_contents (C function)@\spxentry{krb5\_free\_checksum\_contents}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_checksum_contents:c.krb5_free_checksum_contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_checksum\_contents}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Checksum structure to free contents of - -\end{description}\end{quote} - -\sphinxAtStartPar -This function frees the contents of \sphinxstyleemphasis{val} , but not the structure itself. It sets the checksum’s data pointer to null and (beginning in release 1.19) sets its length to zero. - -\sphinxstepscope - - -\subsubsection{krb5\_free\_cksumtypes \sphinxhyphen{} Free an array of checksum types.} -\label{\detokenize{appdev/refs/api/krb5_free_cksumtypes:krb5-free-cksumtypes-free-an-array-of-checksum-types}}\label{\detokenize{appdev/refs/api/krb5_free_cksumtypes::doc}}\index{krb5\_free\_cksumtypes (C function)@\spxentry{krb5\_free\_cksumtypes}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_cksumtypes:c.krb5_free_cksumtypes}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_cksumtypes}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{val}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{val} \sphinxhyphen{} Array of checksum types to be freed - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_free\_tgt\_creds \sphinxhyphen{} Free an array of credential structures.} -\label{\detokenize{appdev/refs/api/krb5_free_tgt_creds:krb5-free-tgt-creds-free-an-array-of-credential-structures}}\label{\detokenize{appdev/refs/api/krb5_free_tgt_creds::doc}}\index{krb5\_free\_tgt\_creds (C function)@\spxentry{krb5\_free\_tgt\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_free_tgt_creds:c.krb5_free_tgt_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_free\_tgt\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{tgts}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{tgts} \sphinxhyphen{} Null\sphinxhyphen{}terminated array of credentials to free - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The last entry in the array \sphinxstyleemphasis{tgts} must be a NULL pointer. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_create\_key \sphinxhyphen{} Create a krb5\_key from the enctype and key data in a keyblock.} -\label{\detokenize{appdev/refs/api/krb5_k_create_key:krb5-k-create-key-create-a-krb5-key-from-the-enctype-and-key-data-in-a-keyblock}}\label{\detokenize{appdev/refs/api/krb5_k_create_key::doc}}\index{krb5\_k\_create\_key (C function)@\spxentry{krb5\_k\_create\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_create_key:c.krb5_k_create_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_create\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key\_data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{out}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key\_data} \sphinxhyphen{} Keyblock - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out} \sphinxhyphen{} Opaque key - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} KRB5\_BAD\_ENCTYPE - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -The reference count on a key \sphinxstyleemphasis{out} is set to 1. Use krb5\_k\_free\_key() to free \sphinxstyleemphasis{out} when it is no longer needed. - -\sphinxstepscope - - -\subsubsection{krb5\_k\_decrypt \sphinxhyphen{} Decrypt data using a key (operates on opaque key).} -\label{\detokenize{appdev/refs/api/krb5_k_decrypt:krb5-k-decrypt-decrypt-data-using-a-key-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_decrypt::doc}}\index{krb5\_k\_decrypt (C function)@\spxentry{krb5\_k\_decrypt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_decrypt:c.krb5_k_decrypt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_decrypt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cipher\_state}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{output}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{cipher\_state} \sphinxhyphen{} Cipher state; specify NULL if not needed - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Encrypted data - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{output} \sphinxhyphen{} Decrypted data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function decrypts the data block \sphinxstyleemphasis{input} and stores the output into \sphinxstyleemphasis{output} . The actual decryption key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the encryption type. If non\sphinxhyphen{}null, \sphinxstyleemphasis{cipher\_state} specifies the beginning state for the decryption operation, and is updated with the state to be passed as input to the next operation. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The caller must initialize \sphinxstyleemphasis{output} and allocate at least enough space for the result. The usual practice is to allocate an output buffer as long as the ciphertext, and let krb5\_c\_decrypt() trim \sphinxstyleemphasis{output\sphinxhyphen{}\textgreater{}length} . For some enctypes, the resulting \sphinxstyleemphasis{output\sphinxhyphen{}\textgreater{}length} may include padding bytes. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_decrypt\_iov \sphinxhyphen{} Decrypt data in place supporting AEAD (operates on opaque key).} -\label{\detokenize{appdev/refs/api/krb5_k_decrypt_iov:krb5-k-decrypt-iov-decrypt-data-in-place-supporting-aead-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_decrypt_iov::doc}}\index{krb5\_k\_decrypt\_iov (C function)@\spxentry{krb5\_k\_decrypt\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_decrypt_iov:c.krb5_k_decrypt_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_decrypt\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cipher\_state}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cipher\_state} \sphinxhyphen{} Cipher state; specify NULL if not needed - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array. Modified in\sphinxhyphen{}place. - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function decrypts the data block \sphinxstyleemphasis{data} and stores the output in\sphinxhyphen{}place. The actual decryption key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the encryption type. If non\sphinxhyphen{}null, \sphinxstyleemphasis{cipher\_state} specifies the beginning state for the decryption operation, and is updated with the state to be passed as input to the next operation. The caller must allocate the right number of krb5\_crypto\_iov structures before calling into this API. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_k\_encrypt\_iov() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -On return from a krb5\_c\_decrypt\_iov() call, the \sphinxstyleemphasis{data\sphinxhyphen{}\textgreater{}length} in the iov structure are adjusted to reflect actual lengths of the ciphertext used. For example, if the padding length is too large, the length will be reduced. Lengths are never increased. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_encrypt \sphinxhyphen{} Encrypt data using a key (operates on opaque key).} -\label{\detokenize{appdev/refs/api/krb5_k_encrypt:krb5-k-encrypt-encrypt-data-using-a-key-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_encrypt::doc}}\index{krb5\_k\_encrypt (C function)@\spxentry{krb5\_k\_encrypt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_encrypt:c.krb5_k_encrypt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_encrypt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cipher\_state}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{output}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{cipher\_state} \sphinxhyphen{} Cipher state; specify NULL if not needed - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Data to be encrypted - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{output} \sphinxhyphen{} Encrypted data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function encrypts the data block \sphinxstyleemphasis{input} and stores the output into \sphinxstyleemphasis{output} . The actual encryption key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the encryption type. If non\sphinxhyphen{}null, \sphinxstyleemphasis{cipher\_state} specifies the beginning state for the encryption operation, and is updated with the state to be passed as input to the next operation. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The caller must initialize \sphinxstyleemphasis{output} and allocate at least enough space for the result (using krb5\_c\_encrypt\_length() to determine the amount of space needed). \sphinxstyleemphasis{output\sphinxhyphen{}\textgreater{}length} will be set to the actual length of the ciphertext. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_encrypt\_iov \sphinxhyphen{} Encrypt data in place supporting AEAD (operates on opaque key).} -\label{\detokenize{appdev/refs/api/krb5_k_encrypt_iov:krb5-k-encrypt-iov-encrypt-data-in-place-supporting-aead-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_encrypt_iov::doc}}\index{krb5\_k\_encrypt\_iov (C function)@\spxentry{krb5\_k\_encrypt\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_encrypt_iov:c.krb5_k_encrypt_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_encrypt\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cipher\_state}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cipher\_state} \sphinxhyphen{} Cipher state; specify NULL if not needed - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array. Modified in\sphinxhyphen{}place. - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function encrypts the data block \sphinxstyleemphasis{data} and stores the output in\sphinxhyphen{}place. The actual encryption key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the encryption type. If non\sphinxhyphen{}null, \sphinxstyleemphasis{cipher\_state} specifies the beginning state for the encryption operation, and is updated with the state to be passed as input to the next operation. The caller must allocate the right number of krb5\_crypto\_iov structures before calling into this API. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_k\_decrypt\_iov() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -On return from a krb5\_c\_encrypt\_iov() call, the \sphinxstyleemphasis{data\sphinxhyphen{}\textgreater{}length} in the iov structure are adjusted to reflect actual lengths of the ciphertext used. For example, if the padding length is too large, the length will be reduced. Lengths are never increased. -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_free\_key \sphinxhyphen{} Decrement the reference count on a key and free it if it hits zero.} -\label{\detokenize{appdev/refs/api/krb5_k_free_key:krb5-k-free-key-decrement-the-reference-count-on-a-key-and-free-it-if-it-hits-zero}}\label{\detokenize{appdev/refs/api/krb5_k_free_key::doc}}\index{krb5\_k\_free\_key (C function)@\spxentry{krb5\_k\_free\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_free_key:c.krb5_k_free_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_free\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{key} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_key\_enctype \sphinxhyphen{} Retrieve the enctype of a krb5\_key structure.} -\label{\detokenize{appdev/refs/api/krb5_k_key_enctype:krb5-k-key-enctype-retrieve-the-enctype-of-a-krb5-key-structure}}\label{\detokenize{appdev/refs/api/krb5_k_key_enctype::doc}}\index{krb5\_k\_key\_enctype (C function)@\spxentry{krb5\_k\_key\_enctype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_key_enctype:c.krb5_k_key_enctype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_key\_enctype}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{key} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_key\_keyblock \sphinxhyphen{} Retrieve a copy of the keyblock from a krb5\_key structure.} -\label{\detokenize{appdev/refs/api/krb5_k_key_keyblock:krb5-k-key-keyblock-retrieve-a-copy-of-the-keyblock-from-a-krb5-key-structure}}\label{\detokenize{appdev/refs/api/krb5_k_key_keyblock::doc}}\index{krb5\_k\_key\_keyblock (C function)@\spxentry{krb5\_k\_key\_keyblock}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_key_keyblock:c.krb5_k_key_keyblock}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_key\_keyblock}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{key\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{key} - -\sphinxAtStartPar -\sphinxstylestrong{key\_data} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_make\_checksum \sphinxhyphen{} Compute a checksum (operates on opaque key).} -\label{\detokenize{appdev/refs/api/krb5_k_make_checksum:krb5-k-make-checksum-compute-a-checksum-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_make_checksum::doc}}\index{krb5\_k\_make\_checksum (C function)@\spxentry{krb5\_k\_make\_checksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_make_checksum:c.krb5_k_make_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_make\_checksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cksum}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type (0 for mandatory type) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key for a keyed checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Input data - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{cksum} \sphinxhyphen{} Generated checksum - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function computes a checksum of type \sphinxstyleemphasis{cksumtype} over \sphinxstyleemphasis{input} , using \sphinxstyleemphasis{key} if the checksum type is a keyed checksum. If \sphinxstyleemphasis{cksumtype} is 0 and \sphinxstyleemphasis{key} is non\sphinxhyphen{}null, the checksum type will be the mandatory\sphinxhyphen{}to\sphinxhyphen{}implement checksum type for the key’s encryption type. The actual checksum key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the checksum type. The newly created \sphinxstyleemphasis{cksum} must be released by calling krb5\_free\_checksum\_contents() when it is no longer needed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_c\_verify\_checksum() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_c\_make\_checksum(), but operates on opaque \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_make\_checksum\_iov \sphinxhyphen{} Fill in a checksum element in IOV array (operates on opaque key)} -\label{\detokenize{appdev/refs/api/krb5_k_make_checksum_iov:krb5-k-make-checksum-iov-fill-in-a-checksum-element-in-iov-array-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_make_checksum_iov::doc}}\index{krb5\_k\_make\_checksum\_iov (C function)@\spxentry{krb5\_k\_make\_checksum\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_make_checksum_iov:c.krb5_k_make_checksum_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_make\_checksum\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type (0 for mandatory type) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key for a keyed checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Create a checksum in the KRB5\_CRYPTO\_TYPE\_CHECKSUM element over KRB5\_CRYPTO\_TYPE\_DATA and KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY chunks in \sphinxstyleemphasis{data} . Only the KRB5\_CRYPTO\_TYPE\_CHECKSUM region is modified. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_k\_verify\_checksum\_iov() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_c\_make\_checksum\_iov(), but operates on opaque \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_prf \sphinxhyphen{} Generate enctype\sphinxhyphen{}specific pseudo\sphinxhyphen{}random bytes (operates on opaque key).} -\label{\detokenize{appdev/refs/api/krb5_k_prf:krb5-k-prf-generate-enctype-specific-pseudo-random-bytes-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_prf::doc}}\index{krb5\_k\_prf (C function)@\spxentry{krb5\_k\_prf}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_prf:c.krb5_k_prf}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_prf}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{input}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{output}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Key - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{input} \sphinxhyphen{} Input data - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{output} \sphinxhyphen{} Output data - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function selects a pseudo\sphinxhyphen{}random function based on \sphinxstyleemphasis{key} and computes its value over \sphinxstyleemphasis{input} , placing the result into \sphinxstyleemphasis{output} . The caller must preinitialize \sphinxstyleemphasis{output} and allocate space for the result. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_c\_prf(), but operates on opaque \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_reference\_key \sphinxhyphen{} Increment the reference count on a key.} -\label{\detokenize{appdev/refs/api/krb5_k_reference_key:krb5-k-reference-key-increment-the-reference-count-on-a-key}}\label{\detokenize{appdev/refs/api/krb5_k_reference_key::doc}}\index{krb5\_k\_reference\_key (C function)@\spxentry{krb5\_k\_reference\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_reference_key:c.krb5_k_reference_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_reference\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{key} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_verify\_checksum \sphinxhyphen{} Verify a checksum (operates on opaque key).} -\label{\detokenize{appdev/refs/api/krb5_k_verify_checksum:krb5-k-verify-checksum-verify-a-checksum-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_verify_checksum::doc}}\index{krb5\_k\_verify\_checksum (C function)@\spxentry{krb5\_k\_verify\_checksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_verify_checksum:c.krb5_k_verify_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_verify\_checksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cksum}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{valid}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key for a keyed checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} \sphinxstyleemphasis{key} usage - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} Data to be used to compute a new checksum using \sphinxstyleemphasis{key} to compare \sphinxstyleemphasis{cksum} against - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksum} \sphinxhyphen{} Checksum to be verified - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{valid} \sphinxhyphen{} Non\sphinxhyphen{}zero for success, zero for failure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function verifies that \sphinxstyleemphasis{cksum} is a valid checksum for \sphinxstyleemphasis{data} . If the checksum type of \sphinxstyleemphasis{cksum} is a keyed checksum, \sphinxstyleemphasis{key} is used to verify the checksum. If the checksum type in \sphinxstyleemphasis{cksum} is 0 and \sphinxstyleemphasis{key} is not NULL, the mandatory checksum type for \sphinxstyleemphasis{key} will be used. The actual checksum key will be derived from \sphinxstyleemphasis{key} and \sphinxstyleemphasis{usage} if key derivation is specified for the checksum type. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_c\_verify\_checksum(), but operates on opaque \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_k\_verify\_checksum\_iov \sphinxhyphen{} Validate a checksum element in IOV array (operates on opaque key).} -\label{\detokenize{appdev/refs/api/krb5_k_verify_checksum_iov:krb5-k-verify-checksum-iov-validate-a-checksum-element-in-iov-array-operates-on-opaque-key}}\label{\detokenize{appdev/refs/api/krb5_k_verify_checksum_iov::doc}}\index{krb5\_k\_verify\_checksum\_iov (C function)@\spxentry{krb5\_k\_verify\_checksum\_iov}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_k_verify_checksum_iov:c.krb5_k_verify_checksum_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_k\_verify\_checksum\_iov}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{cksumtype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_key:c.krb5_key}]{\sphinxcrossref{\DUrole{n}{krb5\_key}}}}\DUrole{w}{ }\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}]{\sphinxcrossref{\DUrole{n}{krb5\_keyusage}}}}\DUrole{w}{ }\DUrole{n}{usage}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{num\_data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{valid}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{cksumtype} \sphinxhyphen{} Checksum type (0 for mandatory type) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{key} \sphinxhyphen{} Encryption key for a keyed checksum - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{usage} \sphinxhyphen{} Key usage (see KRB5\_KEYUSAGE macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{data} \sphinxhyphen{} IOV array - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{num\_data} \sphinxhyphen{} Size of \sphinxstyleemphasis{data} - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{valid} \sphinxhyphen{} Non\sphinxhyphen{}zero for success, zero for failure - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Confirm that the checksum in the KRB5\_CRYPTO\_TYPE\_CHECKSUM element is a valid checksum of the KRB5\_CRYPTO\_TYPE\_DATA and KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY regions in the iov. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_k\_make\_checksum\_iov() - - -\end{sphinxseealso} - - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -This function is similar to krb5\_c\_verify\_checksum\_iov(), but operates on opaque \sphinxstyleemphasis{key} . -\end{sphinxadmonition} - - -\subsection{Legacy convenience interfaces} -\label{\detokenize{appdev/refs/api/index:legacy-convenience-interfaces}} -\sphinxstepscope - - -\subsubsection{krb5\_recvauth \sphinxhyphen{} Server function for sendauth protocol.} -\label{\detokenize{appdev/refs/api/krb5_recvauth:krb5-recvauth-server-function-for-sendauth-protocol}}\label{\detokenize{appdev/refs/api/krb5_recvauth::doc}}\index{krb5\_recvauth (C function)@\spxentry{krb5\_recvauth}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_recvauth:c.krb5_recvauth}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_recvauth}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{fd}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{appl\_version}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{server}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{n}{flags}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ticket}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Pre\sphinxhyphen{}existing or newly created auth context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fd} \sphinxhyphen{} File descriptor - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{appl\_version} \sphinxhyphen{} Application protocol version to be matched against the client’s application version - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Server principal (NULL for any in \sphinxstyleemphasis{keytab} ) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Additional specifications - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Key table containing service keys - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ticket} \sphinxhyphen{} Ticket (NULL if not needed) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function performs the server side of a sendauth/recvauth exchange by sending and receiving messages over \sphinxstyleemphasis{fd} . - -\sphinxAtStartPar -Use krb5\_free\_ticket() to free \sphinxstyleemphasis{ticket} when it is no longer needed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_sendauth() - - -\end{sphinxseealso} - - -\sphinxstepscope - - -\subsubsection{krb5\_recvauth\_version \sphinxhyphen{} Server function for sendauth protocol with version parameter.} -\label{\detokenize{appdev/refs/api/krb5_recvauth_version:krb5-recvauth-version-server-function-for-sendauth-protocol-with-version-parameter}}\label{\detokenize{appdev/refs/api/krb5_recvauth_version::doc}}\index{krb5\_recvauth\_version (C function)@\spxentry{krb5\_recvauth\_version}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_recvauth_version:c.krb5_recvauth_version}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_recvauth\_version}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{fd}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{server}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\DUrole{n}{flags}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ticket}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{version}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Pre\sphinxhyphen{}existing or newly created auth context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fd} \sphinxhyphen{} File descriptor - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Server principal (NULL for any in \sphinxstyleemphasis{keytab} ) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{flags} \sphinxhyphen{} Additional specifications - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{keytab} \sphinxhyphen{} Decryption key - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{ticket} \sphinxhyphen{} Ticket (NULL if not needed) - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{version} \sphinxhyphen{} sendauth protocol version (NULL if not needed) - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function is similar to krb5\_recvauth() with the additional output information place into \sphinxstyleemphasis{version} . - -\sphinxstepscope - - -\subsubsection{krb5\_sendauth \sphinxhyphen{} Client function for sendauth protocol.} -\label{\detokenize{appdev/refs/api/krb5_sendauth:krb5-sendauth-client-function-for-sendauth-protocol}}\label{\detokenize{appdev/refs/api/krb5_sendauth::doc}}\index{krb5\_sendauth (C function)@\spxentry{krb5\_sendauth}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_sendauth:c.krb5_sendauth}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_sendauth}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{fd}\sphinxparamcomma \DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{appl\_version}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{client}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{server}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{ap\_req\_options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_data}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{error}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{rep\_result}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{out\_creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}inout{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Pre\sphinxhyphen{}existing or newly created auth context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{fd} \sphinxhyphen{} File descriptor that describes network socket - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{appl\_version} \sphinxhyphen{} Application protocol version to be matched with the receiver’s application version - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{client} \sphinxhyphen{} Client principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{server} \sphinxhyphen{} Server principal - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ap\_req\_options} \sphinxhyphen{} Options (see AP\_OPTS macros) - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_data} \sphinxhyphen{} Data to be sent to the server - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{in\_creds} \sphinxhyphen{} Input credentials, or NULL to use \sphinxstyleemphasis{ccache} - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{ccache} \sphinxhyphen{} Credential cache - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{error} \sphinxhyphen{} If non\sphinxhyphen{}null, contains KRB\_ERROR message returned from server - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{rep\_result} \sphinxhyphen{} If non\sphinxhyphen{}null and \sphinxstyleemphasis{ap\_req\_options} is AP\_OPTS\_MUTUAL\_REQUIRED, contains the result of mutual authentication exchange - -\sphinxAtStartPar -\sphinxstylestrong{{[}out{]}} \sphinxstylestrong{out\_creds} \sphinxhyphen{} If non\sphinxhyphen{}null, the retrieved credentials - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -This function performs the client side of a sendauth/recvauth exchange by sending and receiving messages over \sphinxstyleemphasis{fd} . - -\sphinxAtStartPar -Credentials may be specified in three ways: -\begin{quote} -\begin{itemize} -\item {} -\sphinxAtStartPar -If \sphinxstyleemphasis{in\_creds} is NULL, credentials are obtained with krb5\_get\_credentials() using the principals \sphinxstyleemphasis{client} and \sphinxstyleemphasis{server} . \sphinxstyleemphasis{server} must be non\sphinxhyphen{}null; \sphinxstyleemphasis{client} may NULL to use the default principal of \sphinxstyleemphasis{ccache} . - -\item {} -\sphinxAtStartPar -If \sphinxstyleemphasis{in\_creds} is non\sphinxhyphen{}null, but does not contain a ticket, credentials for the exchange are obtained with krb5\_get\_credentials() using \sphinxstyleemphasis{in\_creds} . In this case, the values of \sphinxstyleemphasis{client} and \sphinxstyleemphasis{server} are unused. - -\item {} -\sphinxAtStartPar -If \sphinxstyleemphasis{in\_creds} is a complete credentials structure, it used directly. In this case, the values of \sphinxstyleemphasis{client} , \sphinxstyleemphasis{server} , and \sphinxstyleemphasis{ccache} are unused. - -\end{itemize} - -\sphinxAtStartPar -If the server is using a different application protocol than that specified in \sphinxstyleemphasis{appl\_version} , an error will be returned. -\end{quote} - -\sphinxAtStartPar -Use krb5\_free\_creds() to free \sphinxstyleemphasis{out\_creds} , krb5\_free\_ap\_rep\_enc\_part() to free \sphinxstyleemphasis{rep\_result} , and krb5\_free\_error() to free \sphinxstyleemphasis{error} when they are no longer needed. - - -\begin{sphinxseealso}{See also:} - -\sphinxAtStartPar -krb5\_recvauth() - - -\end{sphinxseealso} - - - -\subsection{Deprecated public interfaces} -\label{\detokenize{appdev/refs/api/index:deprecated-public-interfaces}} -\sphinxstepscope - - -\subsubsection{krb5\_524\_convert\_creds \sphinxhyphen{} Convert a Kerberos V5 credentials to a Kerberos V4 credentials.} -\label{\detokenize{appdev/refs/api/krb5_524_convert_creds:krb5-524-convert-creds-convert-a-kerberos-v5-credentials-to-a-kerberos-v4-credentials}}\label{\detokenize{appdev/refs/api/krb5_524_convert_creds::doc}}\index{krb5\_524\_convert\_creds (C function)@\spxentry{krb5\_524\_convert\_creds}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_524_convert_creds:c.krb5_524_convert_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{int}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_524\_convert\_creds}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{v5creds}\sphinxparamcomma \DUrole{k}{struct}\DUrole{w}{ }\DUrole{n}{credentials}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{v4creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{v5creds} - -\sphinxAtStartPar -\sphinxstylestrong{v4creds} - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -KRB524\_KRB4\_DISABLED (always) - -\end{itemize} - -\end{description}\end{quote} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -Not implemented -\end{sphinxadmonition} - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getlocalsubkey} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getlocalsubkey:krb5-auth-con-getlocalsubkey}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getlocalsubkey::doc}}\index{krb5\_auth\_con\_getlocalsubkey (C function)@\spxentry{krb5\_auth\_con\_getlocalsubkey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getlocalsubkey:c.krb5_auth_con_getlocalsubkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getlocalsubkey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{auth\_context} - -\sphinxAtStartPar -\sphinxstylestrong{keyblock} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_auth\_con\_getsendsubkey(). - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_getremotesubkey} -\label{\detokenize{appdev/refs/api/krb5_auth_con_getremotesubkey:krb5-auth-con-getremotesubkey}}\label{\detokenize{appdev/refs/api/krb5_auth_con_getremotesubkey::doc}}\index{krb5\_auth\_con\_getremotesubkey (C function)@\spxentry{krb5\_auth\_con\_getremotesubkey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_getremotesubkey:c.krb5_auth_con_getremotesubkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_getremotesubkey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{auth\_context} - -\sphinxAtStartPar -\sphinxstylestrong{keyblock} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_auth\_con\_getrecvsubkey(). - -\sphinxstepscope - - -\subsubsection{krb5\_auth\_con\_initivector \sphinxhyphen{} Cause an auth context to use cipher state.} -\label{\detokenize{appdev/refs/api/krb5_auth_con_initivector:krb5-auth-con-initivector-cause-an-auth-context-to-use-cipher-state}}\label{\detokenize{appdev/refs/api/krb5_auth_con_initivector::doc}}\index{krb5\_auth\_con\_initivector (C function)@\spxentry{krb5\_auth\_con\_initivector}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_auth_con_initivector:c.krb5_auth_con_initivector}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_con\_initivector}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}]{\sphinxcrossref{\DUrole{n}{krb5\_auth\_context}}}}\DUrole{w}{ }\DUrole{n}{auth\_context}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{context} \sphinxhyphen{} Library context - -\sphinxAtStartPar -\sphinxstylestrong{{[}in{]}} \sphinxstylestrong{auth\_context} \sphinxhyphen{} Authentication context - -\end{description}\end{quote} -\begin{quote}\begin{description} -\sphinxlineitem{retval}\begin{itemize} -\item {} -\sphinxAtStartPar -0 Success; otherwise \sphinxhyphen{} Kerberos error codes - -\end{itemize} - -\end{description}\end{quote} - -\sphinxAtStartPar -Prepare \sphinxstyleemphasis{auth\_context} to use cipher state when krb5\_mk\_priv() or krb5\_rd\_priv() encrypt or decrypt data. - -\sphinxstepscope - - -\subsubsection{krb5\_build\_principal\_va} -\label{\detokenize{appdev/refs/api/krb5_build_principal_va:krb5-build-principal-va}}\label{\detokenize{appdev/refs/api/krb5_build_principal_va::doc}}\index{krb5\_build\_principal\_va (C function)@\spxentry{krb5\_build\_principal\_va}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_build_principal_va:c.krb5_build_principal_va}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_build\_principal\_va}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\DUrole{n}{princ}\sphinxparamcomma \DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\DUrole{n}{rlen}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{realm}\sphinxparamcomma \DUrole{n}{va\_list}\DUrole{w}{ }\DUrole{n}{ap}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{princ} - -\sphinxAtStartPar -\sphinxstylestrong{rlen} - -\sphinxAtStartPar -\sphinxstylestrong{realm} - -\sphinxAtStartPar -\sphinxstylestrong{ap} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_build\_principal\_alloc\_va(). - -\sphinxstepscope - - -\subsubsection{krb5\_c\_random\_seed} -\label{\detokenize{appdev/refs/api/krb5_c_random_seed:krb5-c-random-seed}}\label{\detokenize{appdev/refs/api/krb5_c_random_seed::doc}}\index{krb5\_c\_random\_seed (C function)@\spxentry{krb5\_c\_random\_seed}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_c_random_seed:c.krb5_c_random_seed}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_c\_random\_seed}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{data} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED This call is no longer necessary. - -\sphinxstepscope - - -\subsubsection{krb5\_calculate\_checksum} -\label{\detokenize{appdev/refs/api/krb5_calculate_checksum:krb5-calculate-checksum}}\label{\detokenize{appdev/refs/api/krb5_calculate_checksum::doc}}\index{krb5\_calculate\_checksum (C function)@\spxentry{krb5\_calculate\_checksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_calculate_checksum:c.krb5_calculate_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_calculate\_checksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{ctype}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_pointer:c.krb5_const_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_pointer}}}}\DUrole{w}{ }\DUrole{n}{in}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{in\_length}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_pointer:c.krb5_const_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_pointer}}}}\DUrole{w}{ }\DUrole{n}{seed}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{seed\_length}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{outcksum}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{ctype} - -\sphinxAtStartPar -\sphinxstylestrong{in} - -\sphinxAtStartPar -\sphinxstylestrong{in\_length} - -\sphinxAtStartPar -\sphinxstylestrong{seed} - -\sphinxAtStartPar -\sphinxstylestrong{seed\_length} - -\sphinxAtStartPar -\sphinxstylestrong{outcksum} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED See krb5\_c\_make\_checksum() - -\sphinxstepscope - - -\subsubsection{krb5\_checksum\_size} -\label{\detokenize{appdev/refs/api/krb5_checksum_size:krb5-checksum-size}}\label{\detokenize{appdev/refs/api/krb5_checksum_size::doc}}\index{krb5\_checksum\_size (C function)@\spxentry{krb5\_checksum\_size}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_checksum_size:c.krb5_checksum_size}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{n}{size\_t}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_checksum\_size}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{ctype}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{ctype} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED See krb5\_c\_checksum\_length() - -\sphinxstepscope - - -\subsubsection{krb5\_encrypt} -\label{\detokenize{appdev/refs/api/krb5_encrypt:krb5-encrypt}}\label{\detokenize{appdev/refs/api/krb5_encrypt::doc}}\index{krb5\_encrypt (C function)@\spxentry{krb5\_encrypt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_encrypt:c.krb5_encrypt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_encrypt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_pointer:c.krb5_const_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_pointer}}}}\DUrole{w}{ }\DUrole{n}{inptr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{outptr}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{size}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{ivec}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{inptr} - -\sphinxAtStartPar -\sphinxstylestrong{outptr} - -\sphinxAtStartPar -\sphinxstylestrong{size} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\sphinxAtStartPar -\sphinxstylestrong{ivec} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_decrypt} -\label{\detokenize{appdev/refs/api/krb5_decrypt:krb5-decrypt}}\label{\detokenize{appdev/refs/api/krb5_decrypt::doc}}\index{krb5\_decrypt (C function)@\spxentry{krb5\_decrypt}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_decrypt:c.krb5_decrypt}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_decrypt}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_pointer:c.krb5_const_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_pointer}}}}\DUrole{w}{ }\DUrole{n}{inptr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{outptr}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{size}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{ivec}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{inptr} - -\sphinxAtStartPar -\sphinxstylestrong{outptr} - -\sphinxAtStartPar -\sphinxstylestrong{size} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\sphinxAtStartPar -\sphinxstylestrong{ivec} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_eblock\_enctype} -\label{\detokenize{appdev/refs/api/krb5_eblock_enctype:krb5-eblock-enctype}}\label{\detokenize{appdev/refs/api/krb5_eblock_enctype::doc}}\index{krb5\_eblock\_enctype (C function)@\spxentry{krb5\_eblock\_enctype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_eblock_enctype:c.krb5_eblock_enctype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_eblock\_enctype}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_encrypt\_size} -\label{\detokenize{appdev/refs/api/krb5_encrypt_size:krb5-encrypt-size}}\label{\detokenize{appdev/refs/api/krb5_encrypt_size::doc}}\index{krb5\_encrypt\_size (C function)@\spxentry{krb5\_encrypt\_size}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_encrypt_size:c.krb5_encrypt_size}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{n}{size\_t}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_encrypt\_size}}}}{\DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{length}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{crypto}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{length} - -\sphinxAtStartPar -\sphinxstylestrong{crypto} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_finish\_key} -\label{\detokenize{appdev/refs/api/krb5_finish_key:krb5-finish-key}}\label{\detokenize{appdev/refs/api/krb5_finish_key::doc}}\index{krb5\_finish\_key (C function)@\spxentry{krb5\_finish\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_finish_key:c.krb5_finish_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_finish\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_finish\_random\_key} -\label{\detokenize{appdev/refs/api/krb5_finish_random_key:krb5-finish-random-key}}\label{\detokenize{appdev/refs/api/krb5_finish_random_key::doc}}\index{krb5\_finish\_random\_key (C function)@\spxentry{krb5\_finish\_random\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_finish_random_key:c.krb5_finish_random_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_finish\_random\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ptr}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\sphinxAtStartPar -\sphinxstylestrong{ptr} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_gen\_new} -\label{\detokenize{appdev/refs/api/krb5_cc_gen_new:krb5-cc-gen-new}}\label{\detokenize{appdev/refs/api/krb5_cc_gen_new::doc}}\index{krb5\_cc\_gen\_new (C function)@\spxentry{krb5\_cc\_gen\_new}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_cc_gen_new:c.krb5_cc_gen_new}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_gen\_new}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cache}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{cache} - -\end{description}\end{quote} - -\sphinxstepscope - - -\subsubsection{krb5\_get\_credentials\_renew} -\label{\detokenize{appdev/refs/api/krb5_get_credentials_renew:krb5-get-credentials-renew}}\label{\detokenize{appdev/refs/api/krb5_get_credentials_renew::doc}}\index{krb5\_get\_credentials\_renew (C function)@\spxentry{krb5\_get\_credentials\_renew}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_credentials_renew:c.krb5_get_credentials_renew}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_credentials\_renew}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{out\_creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{options} - -\sphinxAtStartPar -\sphinxstylestrong{ccache} - -\sphinxAtStartPar -\sphinxstylestrong{in\_creds} - -\sphinxAtStartPar -\sphinxstylestrong{out\_creds} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_get\_renewed\_creds. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_credentials\_validate} -\label{\detokenize{appdev/refs/api/krb5_get_credentials_validate:krb5-get-credentials-validate}}\label{\detokenize{appdev/refs/api/krb5_get_credentials_validate::doc}}\index{krb5\_get\_credentials\_validate (C function)@\spxentry{krb5\_get\_credentials\_validate}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_credentials_validate:c.krb5_get_credentials_validate}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_credentials\_validate}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{in\_creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{out\_creds}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{options} - -\sphinxAtStartPar -\sphinxstylestrong{ccache} - -\sphinxAtStartPar -\sphinxstylestrong{in\_creds} - -\sphinxAtStartPar -\sphinxstylestrong{out\_creds} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_get\_validated\_creds. - -\sphinxstepscope - - -\subsubsection{krb5\_get\_in\_tkt\_with\_password} -\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_password:krb5-get-in-tkt-with-password}}\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_password::doc}}\index{krb5\_get\_in\_tkt\_with\_password (C function)@\spxentry{krb5\_get\_in\_tkt\_with\_password}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_password:c.krb5_get_in_tkt_with_password}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_in\_tkt\_with\_password}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addrs}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ktypes}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_preauthtype:c.krb5_preauthtype}]{\sphinxcrossref{\DUrole{n}{krb5\_preauthtype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pre\_auth\_types}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{password}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ret\_as\_reply}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{options} - -\sphinxAtStartPar -\sphinxstylestrong{addrs} - -\sphinxAtStartPar -\sphinxstylestrong{ktypes} - -\sphinxAtStartPar -\sphinxstylestrong{pre\_auth\_types} - -\sphinxAtStartPar -\sphinxstylestrong{password} - -\sphinxAtStartPar -\sphinxstylestrong{ccache} - -\sphinxAtStartPar -\sphinxstylestrong{creds} - -\sphinxAtStartPar -\sphinxstylestrong{ret\_as\_reply} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_get\_init\_creds\_password(). - -\sphinxstepscope - - -\subsubsection{krb5\_get\_in\_tkt\_with\_skey} -\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_skey:krb5-get-in-tkt-with-skey}}\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_skey::doc}}\index{krb5\_get\_in\_tkt\_with\_skey (C function)@\spxentry{krb5\_get\_in\_tkt\_with\_skey}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_skey:c.krb5_get_in_tkt_with_skey}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_in\_tkt\_with\_skey}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addrs}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ktypes}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_preauthtype:c.krb5_preauthtype}]{\sphinxcrossref{\DUrole{n}{krb5\_preauthtype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pre\_auth\_types}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ret\_as\_reply}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{options} - -\sphinxAtStartPar -\sphinxstylestrong{addrs} - -\sphinxAtStartPar -\sphinxstylestrong{ktypes} - -\sphinxAtStartPar -\sphinxstylestrong{pre\_auth\_types} - -\sphinxAtStartPar -\sphinxstylestrong{key} - -\sphinxAtStartPar -\sphinxstylestrong{ccache} - -\sphinxAtStartPar -\sphinxstylestrong{creds} - -\sphinxAtStartPar -\sphinxstylestrong{ret\_as\_reply} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_get\_init\_creds(). - -\sphinxstepscope - - -\subsubsection{krb5\_get\_in\_tkt\_with\_keytab} -\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_keytab:krb5-get-in-tkt-with-keytab}}\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_keytab::doc}}\index{krb5\_get\_in\_tkt\_with\_keytab (C function)@\spxentry{krb5\_get\_in\_tkt\_with\_keytab}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_in_tkt_with_keytab:c.krb5_get_in_tkt_with_keytab}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_in\_tkt\_with\_keytab}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\DUrole{n}{options}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{k}{const}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{addrs}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ktypes}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_preauthtype:c.krb5_preauthtype}]{\sphinxcrossref{\DUrole{n}{krb5\_preauthtype}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{pre\_auth\_types}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab}}}}\DUrole{w}{ }\DUrole{n}{arg\_keytab}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}]{\sphinxcrossref{\DUrole{n}{krb5\_ccache}}}}\DUrole{w}{ }\DUrole{n}{ccache}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{creds}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{ret\_as\_reply}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{options} - -\sphinxAtStartPar -\sphinxstylestrong{addrs} - -\sphinxAtStartPar -\sphinxstylestrong{ktypes} - -\sphinxAtStartPar -\sphinxstylestrong{pre\_auth\_types} - -\sphinxAtStartPar -\sphinxstylestrong{arg\_keytab} - -\sphinxAtStartPar -\sphinxstylestrong{ccache} - -\sphinxAtStartPar -\sphinxstylestrong{creds} - -\sphinxAtStartPar -\sphinxstylestrong{ret\_as\_reply} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_get\_init\_creds\_keytab(). - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt\_init} -\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_init:krb5-get-init-creds-opt-init}}\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_init::doc}}\index{krb5\_get\_init\_creds\_opt\_init (C function)@\spxentry{krb5\_get\_init\_creds\_opt\_init}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_get_init_creds_opt_init:c.krb5_get_init_creds_opt_init}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{\DUrole{kt}{void}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt\_init}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{opt}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{opt} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Use krb5\_get\_init\_creds\_opt\_alloc() instead. - -\sphinxstepscope - - -\subsubsection{krb5\_init\_random\_key} -\label{\detokenize{appdev/refs/api/krb5_init_random_key:krb5-init-random-key}}\label{\detokenize{appdev/refs/api/krb5_init_random_key::doc}}\index{krb5\_init\_random\_key (C function)@\spxentry{krb5\_init\_random\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_init_random_key:c.krb5_init_random_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_random\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keyblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{ptr}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\sphinxAtStartPar -\sphinxstylestrong{keyblock} - -\sphinxAtStartPar -\sphinxstylestrong{ptr} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_free\_entry} -\label{\detokenize{appdev/refs/api/krb5_kt_free_entry:krb5-kt-free-entry}}\label{\detokenize{appdev/refs/api/krb5_kt_free_entry::doc}}\index{krb5\_kt\_free\_entry (C function)@\spxentry{krb5\_kt\_free\_entry}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_kt_free_entry:c.krb5_kt_free_entry}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_free\_entry}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{entry}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{entry} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Use krb5\_free\_keytab\_entry\_contents instead. - -\sphinxstepscope - - -\subsubsection{krb5\_random\_key} -\label{\detokenize{appdev/refs/api/krb5_random_key:krb5-random-key}}\label{\detokenize{appdev/refs/api/krb5_random_key::doc}}\index{krb5\_random\_key (C function)@\spxentry{krb5\_random\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_random_key:c.krb5_random_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_random\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_pointer}}}}\DUrole{w}{ }\DUrole{n}{ptr}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\DUrole{n}{keyblock}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\sphinxAtStartPar -\sphinxstylestrong{ptr} - -\sphinxAtStartPar -\sphinxstylestrong{keyblock} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_process\_key} -\label{\detokenize{appdev/refs/api/krb5_process_key:krb5-process-key}}\label{\detokenize{appdev/refs/api/krb5_process_key::doc}}\index{krb5\_process\_key (C function)@\spxentry{krb5\_process\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_process_key:c.krb5_process_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_process\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{key}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\sphinxAtStartPar -\sphinxstylestrong{key} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_string\_to\_key} -\label{\detokenize{appdev/refs/api/krb5_string_to_key:krb5-string-to-key}}\label{\detokenize{appdev/refs/api/krb5_string_to_key::doc}}\index{krb5\_string\_to\_key (C function)@\spxentry{krb5\_string\_to\_key}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_string_to_key:c.krb5_string_to_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_string\_to\_key}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{keyblock}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{data}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{salt}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\sphinxAtStartPar -\sphinxstylestrong{keyblock} - -\sphinxAtStartPar -\sphinxstylestrong{data} - -\sphinxAtStartPar -\sphinxstylestrong{salt} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED See krb5\_c\_string\_to\_key() - -\sphinxstepscope - - -\subsubsection{krb5\_use\_enctype} -\label{\detokenize{appdev/refs/api/krb5_use_enctype:krb5-use-enctype}}\label{\detokenize{appdev/refs/api/krb5_use_enctype::doc}}\index{krb5\_use\_enctype (C function)@\spxentry{krb5\_use\_enctype}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_use_enctype:c.krb5_use_enctype}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_use\_enctype}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{eblock}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{n}{enctype}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{eblock} - -\sphinxAtStartPar -\sphinxstylestrong{enctype} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED Replaced by krb5\_c\_* API family. - -\sphinxstepscope - - -\subsubsection{krb5\_verify\_checksum} -\label{\detokenize{appdev/refs/api/krb5_verify_checksum:krb5-verify-checksum}}\label{\detokenize{appdev/refs/api/krb5_verify_checksum::doc}}\index{krb5\_verify\_checksum (C function)@\spxentry{krb5\_verify\_checksum}\spxextra{C function}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/api/krb5_verify_checksum:c.krb5_verify_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysiglinewithargsret{{\hyperref[\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}]{\sphinxcrossref{\DUrole{n}{krb5\_error\_code}}}}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_verify\_checksum}}}}{{\hyperref[\detokenize{appdev/refs/types/krb5_context:c.krb5_context}]{\sphinxcrossref{\DUrole{n}{krb5\_context}}}}\DUrole{w}{ }\DUrole{n}{context}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\DUrole{n}{ctype}\sphinxparamcomma \DUrole{k}{const}\DUrole{w}{ }{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{n}{cksum}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_pointer:c.krb5_const_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_pointer}}}}\DUrole{w}{ }\DUrole{n}{in}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{in\_length}\sphinxparamcomma {\hyperref[\detokenize{appdev/refs/types/krb5_const_pointer:c.krb5_const_pointer}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_pointer}}}}\DUrole{w}{ }\DUrole{n}{seed}\sphinxparamcomma \DUrole{n}{size\_t}\DUrole{w}{ }\DUrole{n}{seed\_length}}{} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\begin{quote}\begin{description} -\sphinxlineitem{param} -\sphinxAtStartPar -\sphinxstylestrong{context} - -\sphinxAtStartPar -\sphinxstylestrong{ctype} - -\sphinxAtStartPar -\sphinxstylestrong{cksum} - -\sphinxAtStartPar -\sphinxstylestrong{in} - -\sphinxAtStartPar -\sphinxstylestrong{in\_length} - -\sphinxAtStartPar -\sphinxstylestrong{seed} - -\sphinxAtStartPar -\sphinxstylestrong{seed\_length} - -\end{description}\end{quote} - -\sphinxAtStartPar -DEPRECATED See krb5\_c\_verify\_checksum() - -\sphinxstepscope - - -\section{krb5 types and structures} -\label{\detokenize{appdev/refs/types/index:krb5-types-and-structures}}\label{\detokenize{appdev/refs/types/index::doc}} - -\subsection{Public} -\label{\detokenize{appdev/refs/types/index:public}} -\sphinxstepscope - - -\subsubsection{krb5\_address} -\label{\detokenize{appdev/refs/types/krb5_address:krb5-address}}\label{\detokenize{appdev/refs/types/krb5_address:krb5-address-struct}}\label{\detokenize{appdev/refs/types/krb5_address::doc}}\index{krb5\_address (C type)@\spxentry{krb5\_address}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_address:c.krb5_address}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_address}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Structure for address. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_address:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_address krb5\_address - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_address:members}}\index{krb5\_address.magic (C member)@\spxentry{krb5\_address.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_address:c.krb5_address.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_address.addrtype (C member)@\spxentry{krb5\_address.addrtype}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_address:c.krb5_address.addrtype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_addrtype:c.krb5_addrtype}]{\sphinxcrossref{\DUrole{n}{krb5\_addrtype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{addrtype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_address.length (C member)@\spxentry{krb5\_address.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_address:c.krb5_address.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_address.contents (C member)@\spxentry{krb5\_address.contents}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_address:c.krb5_address.contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}]{\sphinxcrossref{\DUrole{n}{krb5\_octet}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{contents}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_addrtype} -\label{\detokenize{appdev/refs/types/krb5_addrtype:krb5-addrtype}}\label{\detokenize{appdev/refs/types/krb5_addrtype:krb5-addrtype-struct}}\label{\detokenize{appdev/refs/types/krb5_addrtype::doc}}\index{krb5\_addrtype (C type)@\spxentry{krb5\_addrtype}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_addrtype:c.krb5_addrtype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_addrtype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_addrtype:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_addrtype - -\sphinxstepscope - - -\subsubsection{krb5\_ap\_req} -\label{\detokenize{appdev/refs/types/krb5_ap_req:krb5-ap-req}}\label{\detokenize{appdev/refs/types/krb5_ap_req:krb5-ap-req-struct}}\label{\detokenize{appdev/refs/types/krb5_ap_req::doc}}\index{krb5\_ap\_req (C type)@\spxentry{krb5\_ap\_req}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_ap\_req}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Authentication header. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_ap_req:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_ap\_req krb5\_ap\_req - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_ap_req:members}}\index{krb5\_ap\_req.magic (C member)@\spxentry{krb5\_ap\_req.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_ap\_req.ap\_options (C member)@\spxentry{krb5\_ap\_req.ap\_options}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req.ap_options}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ap\_options}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Requested options. - -\end{fulllineitems} - -\index{krb5\_ap\_req.ticket (C member)@\spxentry{krb5\_ap\_req.ticket}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req.ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ticket}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Ticket. - -\end{fulllineitems} - -\index{krb5\_ap\_req.authenticator (C member)@\spxentry{krb5\_ap\_req.authenticator}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req.authenticator}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_req:c.krb5_ap_req}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{authenticator}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Encrypted authenticator. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_ap\_rep} -\label{\detokenize{appdev/refs/types/krb5_ap_rep:krb5-ap-rep}}\label{\detokenize{appdev/refs/types/krb5_ap_rep:krb5-ap-rep-struct}}\label{\detokenize{appdev/refs/types/krb5_ap_rep::doc}}\index{krb5\_ap\_rep (C type)@\spxentry{krb5\_ap\_rep}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep:c.krb5_ap_rep}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_ap\_rep}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -C representaton of AP\sphinxhyphen{}REP message. - -\sphinxAtStartPar -The server’s response to a client’s request for mutual authentication. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_ap_rep:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_ap\_rep krb5\_ap\_rep - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_ap_rep:members}}\index{krb5\_ap\_rep.magic (C member)@\spxentry{krb5\_ap\_rep.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep:c.krb5_ap_rep.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep:c.krb5_ap_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_ap\_rep.enc\_part (C member)@\spxentry{krb5\_ap\_rep.enc\_part}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep:c.krb5_ap_rep.enc_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep:c.krb5_ap_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enc\_part}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Ciphertext of ApRepEncPart. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_ap\_rep\_enc\_part} -\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:krb5-ap-rep-enc-part}}\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:krb5-ap-rep-enc-part-struct}}\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part::doc}}\index{krb5\_ap\_rep\_enc\_part (C type)@\spxentry{krb5\_ap\_rep\_enc\_part}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Cleartext that is encrypted and put into \sphinxcode{\sphinxupquote{\_krb5\_ap\_rep}} . - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_ap\_rep\_enc\_part krb5\_ap\_rep\_enc\_part - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:members}}\index{krb5\_ap\_rep\_enc\_part.magic (C member)@\spxentry{krb5\_ap\_rep\_enc\_part.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_ap\_rep\_enc\_part.ctime (C member)@\spxentry{krb5\_ap\_rep\_enc\_part.ctime}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part.ctime}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ctime}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Client time, seconds portion. - -\end{fulllineitems} - -\index{krb5\_ap\_rep\_enc\_part.cusec (C member)@\spxentry{krb5\_ap\_rep\_enc\_part.cusec}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part.cusec}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{cusec}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Client time, microseconds portion. - -\end{fulllineitems} - -\index{krb5\_ap\_rep\_enc\_part.subkey (C member)@\spxentry{krb5\_ap\_rep\_enc\_part.subkey}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part.subkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{subkey}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Subkey (optional) - -\end{fulllineitems} - -\index{krb5\_ap\_rep\_enc\_part.seq\_number (C member)@\spxentry{krb5\_ap\_rep\_enc\_part.seq\_number}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part.seq_number}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}]{\sphinxcrossref{\DUrole{n}{krb5\_ui\_4}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ap_rep_enc_part:c.krb5_ap_rep_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_ap\_rep\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{seq\_number}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Sequence number. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_authdata} -\label{\detokenize{appdev/refs/types/krb5_authdata:krb5-authdata}}\label{\detokenize{appdev/refs/types/krb5_authdata:krb5-authdata-struct}}\label{\detokenize{appdev/refs/types/krb5_authdata::doc}}\index{krb5\_authdata (C type)@\spxentry{krb5\_authdata}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_authdata}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Structure for auth data. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_authdata:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_authdata krb5\_authdata - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_authdata:members}}\index{krb5\_authdata.magic (C member)@\spxentry{krb5\_authdata.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_authdata.ad\_type (C member)@\spxentry{krb5\_authdata.ad\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata.ad_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_authdatatype:c.krb5_authdatatype}]{\sphinxcrossref{\DUrole{n}{krb5\_authdatatype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ad\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -ADTYPE. - -\end{fulllineitems} - -\index{krb5\_authdata.length (C member)@\spxentry{krb5\_authdata.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Length of data. - -\end{fulllineitems} - -\index{krb5\_authdata.contents (C member)@\spxentry{krb5\_authdata.contents}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata.contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}]{\sphinxcrossref{\DUrole{n}{krb5\_octet}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{contents}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Data. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_authdatatype} -\label{\detokenize{appdev/refs/types/krb5_authdatatype:krb5-authdatatype}}\label{\detokenize{appdev/refs/types/krb5_authdatatype:krb5-authdatatype-struct}}\label{\detokenize{appdev/refs/types/krb5_authdatatype::doc}}\index{krb5\_authdatatype (C type)@\spxentry{krb5\_authdatatype}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authdatatype:c.krb5_authdatatype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_authdatatype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_authdatatype:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_authdatatype - -\sphinxstepscope - - -\subsubsection{krb5\_authenticator} -\label{\detokenize{appdev/refs/types/krb5_authenticator:krb5-authenticator}}\label{\detokenize{appdev/refs/types/krb5_authenticator:krb5-authenticator-struct}}\label{\detokenize{appdev/refs/types/krb5_authenticator::doc}}\index{krb5\_authenticator (C type)@\spxentry{krb5\_authenticator}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_authenticator}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Ticket authenticator. - -\sphinxAtStartPar -The C representation of an unencrypted authenticator. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_authenticator:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_authenticator krb5\_authenticator - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_authenticator:members}}\index{krb5\_authenticator.magic (C member)@\spxentry{krb5\_authenticator.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_authenticator.client (C member)@\spxentry{krb5\_authenticator.client}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator.client}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{client}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -client name/realm - -\end{fulllineitems} - -\index{krb5\_authenticator.checksum (C member)@\spxentry{krb5\_authenticator.checksum}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator.checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{checksum}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -checksum, includes type, optional - -\end{fulllineitems} - -\index{krb5\_authenticator.cusec (C member)@\spxentry{krb5\_authenticator.cusec}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator.cusec}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{cusec}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -client usec portion - -\end{fulllineitems} - -\index{krb5\_authenticator.ctime (C member)@\spxentry{krb5\_authenticator.ctime}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator.ctime}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ctime}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -client sec portion - -\end{fulllineitems} - -\index{krb5\_authenticator.subkey (C member)@\spxentry{krb5\_authenticator.subkey}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator.subkey}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{subkey}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -true session key, optional - -\end{fulllineitems} - -\index{krb5\_authenticator.seq\_number (C member)@\spxentry{krb5\_authenticator.seq\_number}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator.seq_number}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}]{\sphinxcrossref{\DUrole{n}{krb5\_ui\_4}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{seq\_number}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -sequence \#, optional - -\end{fulllineitems} - -\index{krb5\_authenticator.authorization\_data (C member)@\spxentry{krb5\_authenticator.authorization\_data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator.authorization_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{authorization\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -authoriazation data - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_boolean} -\label{\detokenize{appdev/refs/types/krb5_boolean:krb5-boolean}}\label{\detokenize{appdev/refs/types/krb5_boolean:krb5-boolean-struct}}\label{\detokenize{appdev/refs/types/krb5_boolean::doc}}\index{krb5\_boolean (C type)@\spxentry{krb5\_boolean}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_boolean}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_boolean:declaration}} -\sphinxAtStartPar -typedef unsigned int krb5\_boolean - -\sphinxstepscope - - -\subsubsection{krb5\_checksum} -\label{\detokenize{appdev/refs/types/krb5_checksum:krb5-checksum}}\label{\detokenize{appdev/refs/types/krb5_checksum:krb5-checksum-struct}}\label{\detokenize{appdev/refs/types/krb5_checksum::doc}}\index{krb5\_checksum (C type)@\spxentry{krb5\_checksum}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_checksum}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_checksum:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_checksum krb5\_checksum - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_checksum:members}}\index{krb5\_checksum.magic (C member)@\spxentry{krb5\_checksum.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_checksum.checksum\_type (C member)@\spxentry{krb5\_checksum.checksum\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum.checksum_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}]{\sphinxcrossref{\DUrole{n}{krb5\_cksumtype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{checksum\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_checksum.length (C member)@\spxentry{krb5\_checksum.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_checksum.contents (C member)@\spxentry{krb5\_checksum.contents}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum.contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}]{\sphinxcrossref{\DUrole{n}{krb5\_octet}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{contents}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_const\_pointer} -\label{\detokenize{appdev/refs/types/krb5_const_pointer:krb5-const-pointer}}\label{\detokenize{appdev/refs/types/krb5_const_pointer:krb5-const-pointer-struct}}\label{\detokenize{appdev/refs/types/krb5_const_pointer::doc}}\index{krb5\_const\_pointer (C type)@\spxentry{krb5\_const\_pointer}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_const_pointer:c.krb5_const_pointer}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_const\_pointer}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_const_pointer:declaration}} -\sphinxAtStartPar -typedef void const* krb5\_const\_pointer - -\sphinxstepscope - - -\subsubsection{krb5\_const\_principal} -\label{\detokenize{appdev/refs/types/krb5_const_principal:krb5-const-principal}}\label{\detokenize{appdev/refs/types/krb5_const_principal:krb5-const-principal-struct}}\label{\detokenize{appdev/refs/types/krb5_const_principal::doc}}\index{krb5\_const\_principal (C type)@\spxentry{krb5\_const\_principal}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_const\_principal}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Constant version of {\hyperref[\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data}]{\sphinxcrossref{\sphinxcode{\sphinxupquote{krb5\_principal\_data}}}}} . - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_const_principal:declaration}} -\sphinxAtStartPar -typedef const krb5\_principal\_data* krb5\_const\_principal - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_const_principal:members}}\index{krb5\_const\_principal.magic (C member)@\spxentry{krb5\_const\_principal.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_const\_principal.realm (C member)@\spxentry{krb5\_const\_principal.realm}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal.realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{realm}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_const\_principal.data (C member)@\spxentry{krb5\_const\_principal.data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal.data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{data}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -An array of strings. - -\end{fulllineitems} - -\index{krb5\_const\_principal.length (C member)@\spxentry{krb5\_const\_principal.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_const\_principal.type (C member)@\spxentry{krb5\_const\_principal.type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal.type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_const_principal:c.krb5_const_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_const\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{type}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_cred} -\label{\detokenize{appdev/refs/types/krb5_cred:krb5-cred}}\label{\detokenize{appdev/refs/types/krb5_cred:krb5-cred-struct}}\label{\detokenize{appdev/refs/types/krb5_cred::doc}}\index{krb5\_cred (C type)@\spxentry{krb5\_cred}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cred}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Credentials data structure. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_cred:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_cred krb5\_cred - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_cred:members}}\index{krb5\_cred.magic (C member)@\spxentry{krb5\_cred.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred}]{\sphinxcrossref{\DUrole{n}{krb5\_cred}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_cred.tickets (C member)@\spxentry{krb5\_cred.tickets}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred.tickets}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred}]{\sphinxcrossref{\DUrole{n}{krb5\_cred}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{tickets}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Tickets. - -\end{fulllineitems} - -\index{krb5\_cred.enc\_part (C member)@\spxentry{krb5\_cred.enc\_part}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred.enc_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred}]{\sphinxcrossref{\DUrole{n}{krb5\_cred}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enc\_part}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Encrypted part. - -\end{fulllineitems} - -\index{krb5\_cred.enc\_part2 (C member)@\spxentry{krb5\_cred.enc\_part2}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred.enc_part2}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_enc\_part}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred:c.krb5_cred}]{\sphinxcrossref{\DUrole{n}{krb5\_cred}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enc\_part2}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Unencrypted version, if available. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_cred\_enc\_part} -\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:krb5-cred-enc-part}}\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:krb5-cred-enc-part-struct}}\label{\detokenize{appdev/refs/types/krb5_cred_enc_part::doc}}\index{krb5\_cred\_enc\_part (C type)@\spxentry{krb5\_cred\_enc\_part}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cred\_enc\_part}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Cleartext credentials information. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_cred\_enc\_part krb5\_cred\_enc\_part - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:members}}\index{krb5\_cred\_enc\_part.magic (C member)@\spxentry{krb5\_cred\_enc\_part.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_cred\_enc\_part.nonce (C member)@\spxentry{krb5\_cred\_enc\_part.nonce}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part.nonce}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{nonce}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Nonce (optional) - -\end{fulllineitems} - -\index{krb5\_cred\_enc\_part.timestamp (C member)@\spxentry{krb5\_cred\_enc\_part.timestamp}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part.timestamp}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{timestamp}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Generation time, seconds portion. - -\end{fulllineitems} - -\index{krb5\_cred\_enc\_part.usec (C member)@\spxentry{krb5\_cred\_enc\_part.usec}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part.usec}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{usec}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Generation time, microseconds portion. - -\end{fulllineitems} - -\index{krb5\_cred\_enc\_part.s\_address (C member)@\spxentry{krb5\_cred\_enc\_part.s\_address}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part.s_address}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{s\_address}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Sender address (optional) - -\end{fulllineitems} - -\index{krb5\_cred\_enc\_part.r\_address (C member)@\spxentry{krb5\_cred\_enc\_part.r\_address}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part.r_address}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{r\_address}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Recipient address (optional) - -\end{fulllineitems} - -\index{krb5\_cred\_enc\_part.ticket\_info (C member)@\spxentry{krb5\_cred\_enc\_part.ticket\_info}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part.ticket_info}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_info}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_enc_part:c.krb5_cred_enc_part}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_enc\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ticket\_info}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_cred\_info} -\label{\detokenize{appdev/refs/types/krb5_cred_info:krb5-cred-info}}\label{\detokenize{appdev/refs/types/krb5_cred_info:krb5-cred-info-struct}}\label{\detokenize{appdev/refs/types/krb5_cred_info::doc}}\index{krb5\_cred\_info (C type)@\spxentry{krb5\_cred\_info}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cred\_info}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Credentials information inserted into \sphinxstyleemphasis{EncKrbCredPart} . - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_cred_info:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_cred\_info krb5\_cred\_info - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_cred_info:members}}\index{krb5\_cred\_info.magic (C member)@\spxentry{krb5\_cred\_info.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_info}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_cred\_info.session (C member)@\spxentry{krb5\_cred\_info.session}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info.session}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_info}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{session}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Session key used to encrypt ticket. - -\end{fulllineitems} - -\index{krb5\_cred\_info.client (C member)@\spxentry{krb5\_cred\_info.client}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info.client}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_info}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{client}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Client principal and realm. - -\end{fulllineitems} - -\index{krb5\_cred\_info.server (C member)@\spxentry{krb5\_cred\_info.server}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info.server}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_info}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{server}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Server principal and realm. - -\end{fulllineitems} - -\index{krb5\_cred\_info.flags (C member)@\spxentry{krb5\_cred\_info.flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info.flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_info}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Ticket flags. - -\end{fulllineitems} - -\index{krb5\_cred\_info.times (C member)@\spxentry{krb5\_cred\_info.times}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info.times}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_info}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{times}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Auth, start, end, renew\_till. - -\end{fulllineitems} - -\index{krb5\_cred\_info.caddrs (C member)@\spxentry{krb5\_cred\_info.caddrs}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info.caddrs}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_cred_info:c.krb5_cred_info}]{\sphinxcrossref{\DUrole{n}{krb5\_cred\_info}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{caddrs}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Array of pointers to addrs (optional) - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_creds} -\label{\detokenize{appdev/refs/types/krb5_creds:krb5-creds}}\label{\detokenize{appdev/refs/types/krb5_creds:krb5-creds-struct}}\label{\detokenize{appdev/refs/types/krb5_creds::doc}}\index{krb5\_creds (C type)@\spxentry{krb5\_creds}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_creds}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Credentials structure including ticket, session key, and lifetime info. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_creds:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_creds krb5\_creds - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_creds:members}}\index{krb5\_creds.magic (C member)@\spxentry{krb5\_creds.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_creds.client (C member)@\spxentry{krb5\_creds.client}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.client}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{client}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -client’s principal identifier - -\end{fulllineitems} - -\index{krb5\_creds.server (C member)@\spxentry{krb5\_creds.server}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.server}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{server}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -server’s principal identifier - -\end{fulllineitems} - -\index{krb5\_creds.keyblock (C member)@\spxentry{krb5\_creds.keyblock}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.keyblock}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{keyblock}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -session encryption key info - -\end{fulllineitems} - -\index{krb5\_creds.times (C member)@\spxentry{krb5\_creds.times}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.times}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{times}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -lifetime info - -\end{fulllineitems} - -\index{krb5\_creds.is\_skey (C member)@\spxentry{krb5\_creds.is\_skey}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.is_skey}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{is\_skey}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -true if ticket is encrypted in another ticket’s skey - -\end{fulllineitems} - -\index{krb5\_creds.ticket\_flags (C member)@\spxentry{krb5\_creds.ticket\_flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.ticket_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ticket\_flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -flags in ticket - -\end{fulllineitems} - -\index{krb5\_creds.addresses (C member)@\spxentry{krb5\_creds.addresses}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.addresses}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{addresses}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -addrs in ticket - -\end{fulllineitems} - -\index{krb5\_creds.ticket (C member)@\spxentry{krb5\_creds.ticket}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ticket}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -ticket string itself - -\end{fulllineitems} - -\index{krb5\_creds.second\_ticket (C member)@\spxentry{krb5\_creds.second\_ticket}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.second_ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{second\_ticket}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -second ticket, if related to ticket (via DUPLICATE\sphinxhyphen{}SKEY or ENC\sphinxhyphen{}TKT\sphinxhyphen{}IN\sphinxhyphen{}SKEY) - -\end{fulllineitems} - -\index{krb5\_creds.authdata (C member)@\spxentry{krb5\_creds.authdata}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds.authdata}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_creds:c.krb5_creds}]{\sphinxcrossref{\DUrole{n}{krb5\_creds}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{authdata}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -authorization data - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_crypto\_iov} -\label{\detokenize{appdev/refs/types/krb5_crypto_iov:krb5-crypto-iov}}\label{\detokenize{appdev/refs/types/krb5_crypto_iov:krb5-crypto-iov-struct}}\label{\detokenize{appdev/refs/types/krb5_crypto_iov::doc}}\index{krb5\_crypto\_iov (C type)@\spxentry{krb5\_crypto\_iov}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_crypto\_iov}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Structure to describe a region of text to be encrypted or decrypted. - -\sphinxAtStartPar -The \sphinxstyleemphasis{flags} member describes the type of the iov. The \sphinxstyleemphasis{data} member points to the memory that will be manipulated. All iov APIs take a pointer to the first element of an array of krb5\_crypto\_iov’s along with the size of that array. Buffer contents are manipulated in\sphinxhyphen{}place; data is overwritten. Callers must allocate the right number of krb5\_crypto\_iov structures before calling into an iov API. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_crypto_iov:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_crypto\_iov krb5\_crypto\_iov - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_crypto_iov:members}}\index{krb5\_crypto\_iov.flags (C member)@\spxentry{krb5\_crypto\_iov.flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov.flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_cryptotype:c.krb5_cryptotype}]{\sphinxcrossref{\DUrole{n}{krb5\_cryptotype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -iov type (see KRB5\_CRYPTO\_TYPE macros) - -\end{fulllineitems} - -\index{krb5\_crypto\_iov.data (C member)@\spxentry{krb5\_crypto\_iov.data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov.data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_crypto_iov:c.krb5_crypto_iov}]{\sphinxcrossref{\DUrole{n}{krb5\_crypto\_iov}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_cryptotype} -\label{\detokenize{appdev/refs/types/krb5_cryptotype:krb5-cryptotype}}\label{\detokenize{appdev/refs/types/krb5_cryptotype:krb5-cryptotype-struct}}\label{\detokenize{appdev/refs/types/krb5_cryptotype::doc}}\index{krb5\_cryptotype (C type)@\spxentry{krb5\_cryptotype}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cryptotype:c.krb5_cryptotype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cryptotype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_cryptotype:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_cryptotype - -\sphinxstepscope - - -\subsubsection{krb5\_data} -\label{\detokenize{appdev/refs/types/krb5_data:krb5-data}}\label{\detokenize{appdev/refs/types/krb5_data:krb5-data-struct}}\label{\detokenize{appdev/refs/types/krb5_data::doc}}\index{krb5\_data (C type)@\spxentry{krb5\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_data:c.krb5_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_data:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_data krb5\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_data:members}}\index{krb5\_data.magic (C member)@\spxentry{krb5\_data.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_data:c.krb5_data.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_data.length (C member)@\spxentry{krb5\_data.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_data:c.krb5_data.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_data.data (C member)@\spxentry{krb5\_data.data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_data:c.krb5_data.data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_deltat} -\label{\detokenize{appdev/refs/types/krb5_deltat:krb5-deltat}}\label{\detokenize{appdev/refs/types/krb5_deltat:krb5-deltat-struct}}\label{\detokenize{appdev/refs/types/krb5_deltat::doc}}\index{krb5\_deltat (C type)@\spxentry{krb5\_deltat}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_deltat}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_deltat:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_deltat - -\sphinxstepscope - - -\subsubsection{krb5\_enc\_data} -\label{\detokenize{appdev/refs/types/krb5_enc_data:krb5-enc-data}}\label{\detokenize{appdev/refs/types/krb5_enc_data:krb5-enc-data-struct}}\label{\detokenize{appdev/refs/types/krb5_enc_data::doc}}\index{krb5\_enc\_data (C type)@\spxentry{krb5\_enc\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_enc\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_enc_data:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_enc\_data krb5\_enc\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_enc_data:members}}\index{krb5\_enc\_data.magic (C member)@\spxentry{krb5\_enc\_data.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_enc\_data.enctype (C member)@\spxentry{krb5\_enc\_data.enctype}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data.enctype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enctype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_enc\_data.kvno (C member)@\spxentry{krb5\_enc\_data.kvno}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data.kvno}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_kvno:c.krb5_kvno}]{\sphinxcrossref{\DUrole{n}{krb5\_kvno}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{kvno}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_enc\_data.ciphertext (C member)@\spxentry{krb5\_enc\_data.ciphertext}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data.ciphertext}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ciphertext}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_enc\_kdc\_rep\_part} -\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:krb5-enc-kdc-rep-part}}\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:krb5-enc-kdc-rep-part-struct}}\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part::doc}}\index{krb5\_enc\_kdc\_rep\_part (C type)@\spxentry{krb5\_enc\_kdc\_rep\_part}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -C representation of \sphinxstyleemphasis{EncKDCRepPart} protocol message. - -\sphinxAtStartPar -This is the cleartext message that is encrypted and inserted in \sphinxstyleemphasis{KDC\sphinxhyphen{}REP} . - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_enc\_kdc\_rep\_part krb5\_enc\_kdc\_rep\_part - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:members}}\index{krb5\_enc\_kdc\_rep\_part.magic (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.msg\_type (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.msg\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.msg_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_msgtype:c.krb5_msgtype}]{\sphinxcrossref{\DUrole{n}{krb5\_msgtype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{msg\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -krb5 message type - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.session (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.session}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.session}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{session}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Session key. - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.last\_req (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.last\_req}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.last_req}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_last_req_entry:c.krb5_last_req_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_last\_req\_entry}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{last\_req}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Array of pointers to entries. - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.nonce (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.nonce}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.nonce}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{nonce}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Nonce from request. - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.key\_exp (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.key\_exp}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.key_exp}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{key\_exp}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Expiration date. - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.flags (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Ticket flags. - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.times (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.times}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.times}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{times}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Lifetime info. - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.server (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.server}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.server}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{server}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Server’s principal identifier. - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.caddrs (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.caddrs}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.caddrs}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{caddrs}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Array of ptrs to addrs, optional. - -\end{fulllineitems} - -\index{krb5\_enc\_kdc\_rep\_part.enc\_padata (C member)@\spxentry{krb5\_enc\_kdc\_rep\_part.enc\_padata}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part.enc_padata}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enc\_padata}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Encrypted preauthentication data. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_enc\_tkt\_part} -\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:krb5-enc-tkt-part}}\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:krb5-enc-tkt-part-struct}}\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part::doc}}\index{krb5\_enc\_tkt\_part (C type)@\spxentry{krb5\_enc\_tkt\_part}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_enc\_tkt\_part}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Encrypted part of ticket. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_enc\_tkt\_part krb5\_enc\_tkt\_part - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:members}}\index{krb5\_enc\_tkt\_part.magic (C member)@\spxentry{krb5\_enc\_tkt\_part.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_enc\_tkt\_part.flags (C member)@\spxentry{krb5\_enc\_tkt\_part.flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part.flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -flags - -\end{fulllineitems} - -\index{krb5\_enc\_tkt\_part.session (C member)@\spxentry{krb5\_enc\_tkt\_part.session}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part.session}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{session}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -session key: includes enctype - -\end{fulllineitems} - -\index{krb5\_enc\_tkt\_part.client (C member)@\spxentry{krb5\_enc\_tkt\_part.client}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part.client}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{client}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -client name/realm - -\end{fulllineitems} - -\index{krb5\_enc\_tkt\_part.transited (C member)@\spxentry{krb5\_enc\_tkt\_part.transited}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part.transited}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_transited:c.krb5_transited}]{\sphinxcrossref{\DUrole{n}{krb5\_transited}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{transited}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -list of transited realms - -\end{fulllineitems} - -\index{krb5\_enc\_tkt\_part.times (C member)@\spxentry{krb5\_enc\_tkt\_part.times}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part.times}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{times}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -auth, start, end, renew\_till - -\end{fulllineitems} - -\index{krb5\_enc\_tkt\_part.caddrs (C member)@\spxentry{krb5\_enc\_tkt\_part.caddrs}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part.caddrs}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{caddrs}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -array of ptrs to addresses - -\end{fulllineitems} - -\index{krb5\_enc\_tkt\_part.authorization\_data (C member)@\spxentry{krb5\_enc\_tkt\_part.authorization\_data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part.authorization_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{authorization\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -auth data - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_encrypt\_block} -\label{\detokenize{appdev/refs/types/krb5_encrypt_block:krb5-encrypt-block}}\label{\detokenize{appdev/refs/types/krb5_encrypt_block:krb5-encrypt-block-struct}}\label{\detokenize{appdev/refs/types/krb5_encrypt_block::doc}}\index{krb5\_encrypt\_block (C type)@\spxentry{krb5\_encrypt\_block}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_encrypt\_block}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_encrypt_block:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_encrypt\_block krb5\_encrypt\_block - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_encrypt_block:members}}\index{krb5\_encrypt\_block.magic (C member)@\spxentry{krb5\_encrypt\_block.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_encrypt\_block.crypto\_entry (C member)@\spxentry{krb5\_encrypt\_block.crypto\_entry}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block.crypto_entry}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{crypto\_entry}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_encrypt\_block.key (C member)@\spxentry{krb5\_encrypt\_block.key}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block.key}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_encrypt_block:c.krb5_encrypt_block}]{\sphinxcrossref{\DUrole{n}{krb5\_encrypt\_block}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{key}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_enctype} -\label{\detokenize{appdev/refs/types/krb5_enctype:krb5-enctype}}\label{\detokenize{appdev/refs/types/krb5_enctype:krb5-enctype-struct}}\label{\detokenize{appdev/refs/types/krb5_enctype::doc}}\index{krb5\_enctype (C type)@\spxentry{krb5\_enctype}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_enctype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_enctype:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_enctype - -\sphinxstepscope - - -\subsubsection{krb5\_error} -\label{\detokenize{appdev/refs/types/krb5_error:krb5-error}}\label{\detokenize{appdev/refs/types/krb5_error:krb5-error-struct}}\label{\detokenize{appdev/refs/types/krb5_error::doc}}\index{krb5\_error (C type)@\spxentry{krb5\_error}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_error}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Error message structure. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_error:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_error krb5\_error - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_error:members}}\index{krb5\_error.magic (C member)@\spxentry{krb5\_error.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_error.ctime (C member)@\spxentry{krb5\_error.ctime}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.ctime}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ctime}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Client sec portion; optional. - -\end{fulllineitems} - -\index{krb5\_error.cusec (C member)@\spxentry{krb5\_error.cusec}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.cusec}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{cusec}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Client usec portion; optional. - -\end{fulllineitems} - -\index{krb5\_error.susec (C member)@\spxentry{krb5\_error.susec}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.susec}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{susec}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Server usec portion. - -\end{fulllineitems} - -\index{krb5\_error.stime (C member)@\spxentry{krb5\_error.stime}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.stime}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{stime}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Server sec portion. - -\end{fulllineitems} - -\index{krb5\_error.error (C member)@\spxentry{krb5\_error.error}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.error}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}]{\sphinxcrossref{\DUrole{n}{krb5\_ui\_4}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{error}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Error code (protocol error \#’s) - -\end{fulllineitems} - -\index{krb5\_error.client (C member)@\spxentry{krb5\_error.client}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.client}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{client}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Client principal and realm. - -\end{fulllineitems} - -\index{krb5\_error.server (C member)@\spxentry{krb5\_error.server}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.server}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{server}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Server principal and realm. - -\end{fulllineitems} - -\index{krb5\_error.text (C member)@\spxentry{krb5\_error.text}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.text}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{text}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Descriptive text. - -\end{fulllineitems} - -\index{krb5\_error.e\_data (C member)@\spxentry{krb5\_error.e\_data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error:c.krb5_error.e_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_error:c.krb5_error}]{\sphinxcrossref{\DUrole{n}{krb5\_error}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{e\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Additional error\sphinxhyphen{}describing data. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_error\_code} -\label{\detokenize{appdev/refs/types/krb5_error_code:krb5-error-code}}\label{\detokenize{appdev/refs/types/krb5_error_code:krb5-error-code-struct}}\label{\detokenize{appdev/refs/types/krb5_error_code::doc}}\index{krb5\_error\_code (C type)@\spxentry{krb5\_error\_code}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_error_code:c.krb5_error_code}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_error\_code}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Used to convey an operation status. - -\sphinxAtStartPar -The value 0 indicates success; any other values are com\_err codes. Use krb5\_get\_error\_message() to obtain a string describing the error. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_error_code:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_error\_code - -\sphinxstepscope - - -\subsubsection{krb5\_expire\_callback\_func} -\label{\detokenize{appdev/refs/types/krb5_expire_callback_func:krb5-expire-callback-func}}\label{\detokenize{appdev/refs/types/krb5_expire_callback_func:krb5-expire-callback-func-struct}}\label{\detokenize{appdev/refs/types/krb5_expire_callback_func::doc}}\index{krb5\_expire\_callback\_func (C type)@\spxentry{krb5\_expire\_callback\_func}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_expire_callback_func:c.krb5_expire_callback_func}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_expire\_callback\_func}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_expire_callback_func:declaration}} -\sphinxAtStartPar -typedef void( * krb5\_expire\_callback\_func) (krb5\_context context, void *data, krb5\_timestamp password\_expiration, krb5\_timestamp account\_expiration, krb5\_boolean is\_last\_req) - -\sphinxstepscope - - -\subsubsection{krb5\_flags} -\label{\detokenize{appdev/refs/types/krb5_flags:krb5-flags}}\label{\detokenize{appdev/refs/types/krb5_flags:krb5-flags-struct}}\label{\detokenize{appdev/refs/types/krb5_flags::doc}}\index{krb5\_flags (C type)@\spxentry{krb5\_flags}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_flags:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_flags - -\sphinxstepscope - - -\subsubsection{krb5\_get\_init\_creds\_opt} -\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:krb5-get-init-creds-opt}}\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:krb5-get-init-creds-opt-struct}}\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt::doc}}\index{krb5\_get\_init\_creds\_opt (C type)@\spxentry{krb5\_get\_init\_creds\_opt}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Store options for \sphinxstyleemphasis{\_krb5\_get\_init\_creds} . - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_get\_init\_creds\_opt krb5\_get\_init\_creds\_opt - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:members}}\index{krb5\_get\_init\_creds\_opt.flags (C member)@\spxentry{krb5\_get\_init\_creds\_opt.flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.tkt\_life (C member)@\spxentry{krb5\_get\_init\_creds\_opt.tkt\_life}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.tkt_life}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{tkt\_life}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.renew\_life (C member)@\spxentry{krb5\_get\_init\_creds\_opt.renew\_life}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.renew_life}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_deltat:c.krb5_deltat}]{\sphinxcrossref{\DUrole{n}{krb5\_deltat}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{renew\_life}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.forwardable (C member)@\spxentry{krb5\_get\_init\_creds\_opt.forwardable}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.forwardable}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{forwardable}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.proxiable (C member)@\spxentry{krb5\_get\_init\_creds\_opt.proxiable}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.proxiable}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{proxiable}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.etype\_list (C member)@\spxentry{krb5\_get\_init\_creds\_opt.etype\_list}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.etype_list}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{etype\_list}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.etype\_list\_length (C member)@\spxentry{krb5\_get\_init\_creds\_opt.etype\_list\_length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.etype_list_length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{etype\_list\_length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.address\_list (C member)@\spxentry{krb5\_get\_init\_creds\_opt.address\_list}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.address_list}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{address\_list}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.preauth\_list (C member)@\spxentry{krb5\_get\_init\_creds\_opt.preauth\_list}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.preauth_list}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_preauthtype:c.krb5_preauthtype}]{\sphinxcrossref{\DUrole{n}{krb5\_preauthtype}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{preauth\_list}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.preauth\_list\_length (C member)@\spxentry{krb5\_get\_init\_creds\_opt.preauth\_list\_length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.preauth_list_length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{preauth\_list\_length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_get\_init\_creds\_opt.salt (C member)@\spxentry{krb5\_get\_init\_creds\_opt.salt}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt.salt}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_get_init_creds_opt:c.krb5_get_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_get\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{salt}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_gic\_opt\_pa\_data} -\label{\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:krb5-gic-opt-pa-data}}\label{\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:krb5-gic-opt-pa-data-struct}}\label{\detokenize{appdev/refs/types/krb5_gic_opt_pa_data::doc}}\index{krb5\_gic\_opt\_pa\_data (C type)@\spxentry{krb5\_gic\_opt\_pa\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:c.krb5_gic_opt_pa_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_gic\_opt\_pa\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Generic preauth option attribute/value pairs. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_gic\_opt\_pa\_data krb5\_gic\_opt\_pa\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:members}}\index{krb5\_gic\_opt\_pa\_data.attr (C member)@\spxentry{krb5\_gic\_opt\_pa\_data.attr}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:c.krb5_gic_opt_pa_data.attr}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:c.krb5_gic_opt_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_gic\_opt\_pa\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{attr}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_gic\_opt\_pa\_data.value (C member)@\spxentry{krb5\_gic\_opt\_pa\_data.value}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:c.krb5_gic_opt_pa_data.value}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_gic_opt_pa_data:c.krb5_gic_opt_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_gic\_opt\_pa\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{value}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_int16} -\label{\detokenize{appdev/refs/types/krb5_int16:krb5-int16}}\label{\detokenize{appdev/refs/types/krb5_int16:krb5-int16-struct}}\label{\detokenize{appdev/refs/types/krb5_int16::doc}}\index{krb5\_int16 (C type)@\spxentry{krb5\_int16}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_int16:c.krb5_int16}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_int16}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_int16:declaration}} -\sphinxAtStartPar -typedef int16\_t krb5\_int16 - -\sphinxstepscope - - -\subsubsection{krb5\_int32} -\label{\detokenize{appdev/refs/types/krb5_int32:krb5-int32}}\label{\detokenize{appdev/refs/types/krb5_int32:krb5-int32-struct}}\label{\detokenize{appdev/refs/types/krb5_int32::doc}}\index{krb5\_int32 (C type)@\spxentry{krb5\_int32}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_int32}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_int32:declaration}} -\sphinxAtStartPar -typedef int32\_t krb5\_int32 - -\sphinxstepscope - - -\subsubsection{krb5\_kdc\_rep} -\label{\detokenize{appdev/refs/types/krb5_kdc_rep:krb5-kdc-rep}}\label{\detokenize{appdev/refs/types/krb5_kdc_rep:krb5-kdc-rep-struct}}\label{\detokenize{appdev/refs/types/krb5_kdc_rep::doc}}\index{krb5\_kdc\_rep (C type)@\spxentry{krb5\_kdc\_rep}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kdc\_rep}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Representation of the \sphinxstyleemphasis{KDC\sphinxhyphen{}REP} protocol message. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_kdc_rep:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_kdc\_rep krb5\_kdc\_rep - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_kdc_rep:members}}\index{krb5\_kdc\_rep.magic (C member)@\spxentry{krb5\_kdc\_rep.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_kdc\_rep.msg\_type (C member)@\spxentry{krb5\_kdc\_rep.msg\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep.msg_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_msgtype:c.krb5_msgtype}]{\sphinxcrossref{\DUrole{n}{krb5\_msgtype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{msg\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -KRB5\_AS\_REP or KRB5\_KDC\_REP. - -\end{fulllineitems} - -\index{krb5\_kdc\_rep.padata (C member)@\spxentry{krb5\_kdc\_rep.padata}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep.padata}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{padata}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Preauthentication data from KDC. - -\end{fulllineitems} - -\index{krb5\_kdc\_rep.client (C member)@\spxentry{krb5\_kdc\_rep.client}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep.client}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{client}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Client principal and realm. - -\end{fulllineitems} - -\index{krb5\_kdc\_rep.ticket (C member)@\spxentry{krb5\_kdc\_rep.ticket}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep.ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ticket}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Ticket. - -\end{fulllineitems} - -\index{krb5\_kdc\_rep.enc\_part (C member)@\spxentry{krb5\_kdc\_rep.enc\_part}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep.enc_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enc\_part}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Encrypted part of reply. - -\end{fulllineitems} - -\index{krb5\_kdc\_rep.enc\_part2 (C member)@\spxentry{krb5\_kdc\_rep.enc\_part2}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep.enc_part2}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_kdc_rep_part:c.krb5_enc_kdc_rep_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_kdc\_rep\_part}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_rep:c.krb5_kdc_rep}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_rep}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enc\_part2}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Unencrypted version, if available. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_kdc\_req} -\label{\detokenize{appdev/refs/types/krb5_kdc_req:krb5-kdc-req}}\label{\detokenize{appdev/refs/types/krb5_kdc_req:krb5-kdc-req-struct}}\label{\detokenize{appdev/refs/types/krb5_kdc_req::doc}}\index{krb5\_kdc\_req (C type)@\spxentry{krb5\_kdc\_req}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kdc\_req}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -C representation of KDC\sphinxhyphen{}REQ protocol message, including KDC\sphinxhyphen{}REQ\sphinxhyphen{}BODY. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_kdc_req:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_kdc\_req krb5\_kdc\_req - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_kdc_req:members}}\index{krb5\_kdc\_req.magic (C member)@\spxentry{krb5\_kdc\_req.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_kdc\_req.msg\_type (C member)@\spxentry{krb5\_kdc\_req.msg\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.msg_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_msgtype:c.krb5_msgtype}]{\sphinxcrossref{\DUrole{n}{krb5\_msgtype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{msg\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -KRB5\_AS\_REQ or KRB5\_TGS\_REQ. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.padata (C member)@\spxentry{krb5\_kdc\_req.padata}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.padata}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{padata}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Preauthentication data. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.kdc\_options (C member)@\spxentry{krb5\_kdc\_req.kdc\_options}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.kdc_options}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{kdc\_options}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Requested options. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.client (C member)@\spxentry{krb5\_kdc\_req.client}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.client}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{client}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Client principal and realm. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.server (C member)@\spxentry{krb5\_kdc\_req.server}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.server}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{server}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Server principal and realm. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.from (C member)@\spxentry{krb5\_kdc\_req.from}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.from}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{from}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Requested start time. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.till (C member)@\spxentry{krb5\_kdc\_req.till}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.till}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{till}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Requested end time. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.rtime (C member)@\spxentry{krb5\_kdc\_req.rtime}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.rtime}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{rtime}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Requested renewable end time. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.nonce (C member)@\spxentry{krb5\_kdc\_req.nonce}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.nonce}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{nonce}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Nonce to match request and response. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.nktypes (C member)@\spxentry{krb5\_kdc\_req.nktypes}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.nktypes}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{nktypes}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Number of enctypes. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.ktype (C member)@\spxentry{krb5\_kdc\_req.ktype}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.ktype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ktype}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Requested enctypes. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.addresses (C member)@\spxentry{krb5\_kdc\_req.addresses}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.addresses}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_address:c.krb5_address}]{\sphinxcrossref{\DUrole{n}{krb5\_address}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{addresses}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Requested addresses (optional) - -\end{fulllineitems} - -\index{krb5\_kdc\_req.authorization\_data (C member)@\spxentry{krb5\_kdc\_req.authorization\_data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.authorization_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{authorization\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Encrypted authz data (optional) - -\end{fulllineitems} - -\index{krb5\_kdc\_req.unenc\_authdata (C member)@\spxentry{krb5\_kdc\_req.unenc\_authdata}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.unenc_authdata}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_authdata:c.krb5_authdata}]{\sphinxcrossref{\DUrole{n}{krb5\_authdata}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{unenc\_authdata}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Unencrypted authz data. - -\end{fulllineitems} - -\index{krb5\_kdc\_req.second\_ticket (C member)@\spxentry{krb5\_kdc\_req.second\_ticket}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req.second_ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_kdc_req:c.krb5_kdc_req}]{\sphinxcrossref{\DUrole{n}{krb5\_kdc\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{second\_ticket}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Second ticket array (optional) - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_keyblock} -\label{\detokenize{appdev/refs/types/krb5_keyblock:krb5-keyblock}}\label{\detokenize{appdev/refs/types/krb5_keyblock:krb5-keyblock-struct}}\label{\detokenize{appdev/refs/types/krb5_keyblock::doc}}\index{krb5\_keyblock (C type)@\spxentry{krb5\_keyblock}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_keyblock}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Exposed contents of a key. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_keyblock:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_keyblock krb5\_keyblock - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_keyblock:members}}\index{krb5\_keyblock.magic (C member)@\spxentry{krb5\_keyblock.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_keyblock.enctype (C member)@\spxentry{krb5\_keyblock.enctype}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock.enctype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enctype:c.krb5_enctype}]{\sphinxcrossref{\DUrole{n}{krb5\_enctype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enctype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_keyblock.length (C member)@\spxentry{krb5\_keyblock.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_keyblock.contents (C member)@\spxentry{krb5\_keyblock.contents}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock.contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}]{\sphinxcrossref{\DUrole{n}{krb5\_octet}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{contents}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_keytab\_entry} -\label{\detokenize{appdev/refs/types/krb5_keytab_entry:krb5-keytab-entry}}\label{\detokenize{appdev/refs/types/krb5_keytab_entry:krb5-keytab-entry-struct}}\label{\detokenize{appdev/refs/types/krb5_keytab_entry::doc}}\index{krb5\_keytab\_entry (C type)@\spxentry{krb5\_keytab\_entry}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_keytab\_entry}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -A key table entry. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_keytab_entry:declaration}} -\sphinxAtStartPar -typedef struct krb5\_keytab\_entry\_st krb5\_keytab\_entry - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_keytab_entry:members}}\index{krb5\_keytab\_entry.magic (C member)@\spxentry{krb5\_keytab\_entry.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_keytab\_entry.principal (C member)@\spxentry{krb5\_keytab\_entry.principal}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry.principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{principal}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Principal of this key. - -\end{fulllineitems} - -\index{krb5\_keytab\_entry.timestamp (C member)@\spxentry{krb5\_keytab\_entry.timestamp}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry.timestamp}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{timestamp}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Time entry written to keytable. - -\end{fulllineitems} - -\index{krb5\_keytab\_entry.vno (C member)@\spxentry{krb5\_keytab\_entry.vno}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry.vno}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_kvno:c.krb5_kvno}]{\sphinxcrossref{\DUrole{n}{krb5\_kvno}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{vno}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Key version number. - -\end{fulllineitems} - -\index{krb5\_keytab\_entry.key (C member)@\spxentry{krb5\_keytab\_entry.key}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry.key}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_keyblock:c.krb5_keyblock}]{\sphinxcrossref{\DUrole{n}{krb5\_keyblock}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_keytab_entry:c.krb5_keytab_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_keytab\_entry}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{key}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -The secret key. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_keyusage} -\label{\detokenize{appdev/refs/types/krb5_keyusage:krb5-keyusage}}\label{\detokenize{appdev/refs/types/krb5_keyusage:krb5-keyusage-struct}}\label{\detokenize{appdev/refs/types/krb5_keyusage::doc}}\index{krb5\_keyusage (C type)@\spxentry{krb5\_keyusage}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keyusage:c.krb5_keyusage}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_keyusage}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_keyusage:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_keyusage - -\sphinxstepscope - - -\subsubsection{krb5\_kt\_cursor} -\label{\detokenize{appdev/refs/types/krb5_kt_cursor:krb5-kt-cursor}}\label{\detokenize{appdev/refs/types/krb5_kt_cursor:krb5-kt-cursor-struct}}\label{\detokenize{appdev/refs/types/krb5_kt_cursor::doc}}\index{krb5\_kt\_cursor (C type)@\spxentry{krb5\_kt\_cursor}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kt_cursor:c.krb5_kt_cursor}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kt\_cursor}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_kt_cursor:declaration}} -\sphinxAtStartPar -typedef krb5\_pointer krb5\_kt\_cursor - -\sphinxstepscope - - -\subsubsection{krb5\_kvno} -\label{\detokenize{appdev/refs/types/krb5_kvno:krb5-kvno}}\label{\detokenize{appdev/refs/types/krb5_kvno:krb5-kvno-struct}}\label{\detokenize{appdev/refs/types/krb5_kvno::doc}}\index{krb5\_kvno (C type)@\spxentry{krb5\_kvno}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_kvno:c.krb5_kvno}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_kvno}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_kvno:declaration}} -\sphinxAtStartPar -typedef unsigned int krb5\_kvno - -\sphinxstepscope - - -\subsubsection{krb5\_last\_req\_entry} -\label{\detokenize{appdev/refs/types/krb5_last_req_entry:krb5-last-req-entry}}\label{\detokenize{appdev/refs/types/krb5_last_req_entry:krb5-last-req-entry-struct}}\label{\detokenize{appdev/refs/types/krb5_last_req_entry::doc}}\index{krb5\_last\_req\_entry (C type)@\spxentry{krb5\_last\_req\_entry}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_last_req_entry:c.krb5_last_req_entry}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_last\_req\_entry}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Last request entry. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_last_req_entry:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_last\_req\_entry krb5\_last\_req\_entry - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_last_req_entry:members}}\index{krb5\_last\_req\_entry.magic (C member)@\spxentry{krb5\_last\_req\_entry.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_last_req_entry:c.krb5_last_req_entry.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_last_req_entry:c.krb5_last_req_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_last\_req\_entry}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_last\_req\_entry.lr\_type (C member)@\spxentry{krb5\_last\_req\_entry.lr\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_last_req_entry:c.krb5_last_req_entry.lr_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_last_req_entry:c.krb5_last_req_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_last\_req\_entry}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{lr\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -LR type. - -\end{fulllineitems} - -\index{krb5\_last\_req\_entry.value (C member)@\spxentry{krb5\_last\_req\_entry.value}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_last_req_entry:c.krb5_last_req_entry.value}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_last_req_entry:c.krb5_last_req_entry}]{\sphinxcrossref{\DUrole{n}{krb5\_last\_req\_entry}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{value}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Timestamp. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_magic} -\label{\detokenize{appdev/refs/types/krb5_magic:krb5-magic}}\label{\detokenize{appdev/refs/types/krb5_magic:krb5-magic-struct}}\label{\detokenize{appdev/refs/types/krb5_magic::doc}}\index{krb5\_magic (C type)@\spxentry{krb5\_magic}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_magic:declaration}} -\sphinxAtStartPar -typedef krb5\_error\_code krb5\_magic - -\sphinxstepscope - - -\subsubsection{krb5\_mk\_req\_checksum\_func} -\label{\detokenize{appdev/refs/types/krb5_mk_req_checksum_func:krb5-mk-req-checksum-func}}\label{\detokenize{appdev/refs/types/krb5_mk_req_checksum_func:krb5-mk-req-checksum-func-struct}}\label{\detokenize{appdev/refs/types/krb5_mk_req_checksum_func::doc}}\index{krb5\_mk\_req\_checksum\_func (C type)@\spxentry{krb5\_mk\_req\_checksum\_func}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_mk_req_checksum_func:c.krb5_mk_req_checksum_func}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_mk\_req\_checksum\_func}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Type of function used as a callback to generate checksum data for mk\_req. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_mk_req_checksum_func:declaration}} -\sphinxAtStartPar -typedef krb5\_error\_code( * krb5\_mk\_req\_checksum\_func) (krb5\_context, krb5\_auth\_context, void *, krb5\_data **) - -\sphinxstepscope - - -\subsubsection{krb5\_msgtype} -\label{\detokenize{appdev/refs/types/krb5_msgtype:krb5-msgtype}}\label{\detokenize{appdev/refs/types/krb5_msgtype:krb5-msgtype-struct}}\label{\detokenize{appdev/refs/types/krb5_msgtype::doc}}\index{krb5\_msgtype (C type)@\spxentry{krb5\_msgtype}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_msgtype:c.krb5_msgtype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_msgtype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_msgtype:declaration}} -\sphinxAtStartPar -typedef unsigned int krb5\_msgtype - -\sphinxstepscope - - -\subsubsection{krb5\_octet} -\label{\detokenize{appdev/refs/types/krb5_octet:krb5-octet}}\label{\detokenize{appdev/refs/types/krb5_octet:krb5-octet-struct}}\label{\detokenize{appdev/refs/types/krb5_octet::doc}}\index{krb5\_octet (C type)@\spxentry{krb5\_octet}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_octet}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_octet:declaration}} -\sphinxAtStartPar -typedef uint8\_t krb5\_octet - -\sphinxstepscope - - -\subsubsection{krb5\_pa\_pac\_req} -\label{\detokenize{appdev/refs/types/krb5_pa_pac_req:krb5-pa-pac-req}}\label{\detokenize{appdev/refs/types/krb5_pa_pac_req:krb5-pa-pac-req-struct}}\label{\detokenize{appdev/refs/types/krb5_pa_pac_req::doc}}\index{krb5\_pa\_pac\_req (C type)@\spxentry{krb5\_pa\_pac\_req}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_pac_req:c.krb5_pa_pac_req}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pa\_pac\_req}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_pa_pac_req:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_pa\_pac\_req krb5\_pa\_pac\_req - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_pa_pac_req:members}}\index{krb5\_pa\_pac\_req.include\_pac (C member)@\spxentry{krb5\_pa\_pac\_req.include\_pac}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_pac_req:c.krb5_pa_pac_req.include_pac}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_boolean:c.krb5_boolean}]{\sphinxcrossref{\DUrole{n}{krb5\_boolean}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_pac_req:c.krb5_pa_pac_req}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_pac\_req}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{include\_pac}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -TRUE if a PAC should be included in TGS\sphinxhyphen{}REP. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_pa\_server\_referral\_data} -\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:krb5-pa-server-referral-data}}\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:krb5-pa-server-referral-data-struct}}\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data::doc}}\index{krb5\_pa\_server\_referral\_data (C type)@\spxentry{krb5\_pa\_server\_referral\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pa\_server\_referral\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_pa\_server\_referral\_data krb5\_pa\_server\_referral\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:members}}\index{krb5\_pa\_server\_referral\_data.referred\_realm (C member)@\spxentry{krb5\_pa\_server\_referral\_data.referred\_realm}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data.referred_realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_server\_referral\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{referred\_realm}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_pa\_server\_referral\_data.true\_principal\_name (C member)@\spxentry{krb5\_pa\_server\_referral\_data.true\_principal\_name}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data.true_principal_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_server\_referral\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{true\_principal\_name}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_pa\_server\_referral\_data.requested\_principal\_name (C member)@\spxentry{krb5\_pa\_server\_referral\_data.requested\_principal\_name}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data.requested_principal_name}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_server\_referral\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{requested\_principal\_name}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_pa\_server\_referral\_data.referral\_valid\_until (C member)@\spxentry{krb5\_pa\_server\_referral\_data.referral\_valid\_until}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data.referral_valid_until}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_server\_referral\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{referral\_valid\_until}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_pa\_server\_referral\_data.rep\_cksum (C member)@\spxentry{krb5\_pa\_server\_referral\_data.rep\_cksum}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data.rep_cksum}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_checksum:c.krb5_checksum}]{\sphinxcrossref{\DUrole{n}{krb5\_checksum}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_server_referral_data:c.krb5_pa_server_referral_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_server\_referral\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{rep\_cksum}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_pa\_svr\_referral\_data} -\label{\detokenize{appdev/refs/types/krb5_pa_svr_referral_data:krb5-pa-svr-referral-data}}\label{\detokenize{appdev/refs/types/krb5_pa_svr_referral_data:krb5-pa-svr-referral-data-struct}}\label{\detokenize{appdev/refs/types/krb5_pa_svr_referral_data::doc}}\index{krb5\_pa\_svr\_referral\_data (C type)@\spxentry{krb5\_pa\_svr\_referral\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_svr_referral_data:c.krb5_pa_svr_referral_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pa\_svr\_referral\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_pa_svr_referral_data:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_pa\_svr\_referral\_data krb5\_pa\_svr\_referral\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_pa_svr_referral_data:members}}\index{krb5\_pa\_svr\_referral\_data.principal (C member)@\spxentry{krb5\_pa\_svr\_referral\_data.principal}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_svr_referral_data:c.krb5_pa_svr_referral_data.principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_svr_referral_data:c.krb5_pa_svr_referral_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_svr\_referral\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{principal}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Referred name, only realm is required. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_pa\_data} -\label{\detokenize{appdev/refs/types/krb5_pa_data:krb5-pa-data}}\label{\detokenize{appdev/refs/types/krb5_pa_data:krb5-pa-data-struct}}\label{\detokenize{appdev/refs/types/krb5_pa_data::doc}}\index{krb5\_pa\_data (C type)@\spxentry{krb5\_pa\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pa\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Pre\sphinxhyphen{}authentication data. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_pa_data:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_pa\_data krb5\_pa\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_pa_data:members}}\index{krb5\_pa\_data.magic (C member)@\spxentry{krb5\_pa\_data.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_pa\_data.pa\_type (C member)@\spxentry{krb5\_pa\_data.pa\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data.pa_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_preauthtype:c.krb5_preauthtype}]{\sphinxcrossref{\DUrole{n}{krb5\_preauthtype}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{pa\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Preauthentication data type. - -\end{fulllineitems} - -\index{krb5\_pa\_data.length (C member)@\spxentry{krb5\_pa\_data.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Length of data. - -\end{fulllineitems} - -\index{krb5\_pa\_data.contents (C member)@\spxentry{krb5\_pa\_data.contents}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data.contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}]{\sphinxcrossref{\DUrole{n}{krb5\_octet}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pa_data:c.krb5_pa_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pa\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{contents}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Data. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_pointer} -\label{\detokenize{appdev/refs/types/krb5_pointer:krb5-pointer}}\label{\detokenize{appdev/refs/types/krb5_pointer:krb5-pointer-struct}}\label{\detokenize{appdev/refs/types/krb5_pointer::doc}}\index{krb5\_pointer (C type)@\spxentry{krb5\_pointer}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pointer:c.krb5_pointer}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pointer}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_pointer:declaration}} -\sphinxAtStartPar -typedef void* krb5\_pointer - -\sphinxstepscope - - -\subsubsection{krb5\_post\_recv\_fn} -\label{\detokenize{appdev/refs/types/krb5_post_recv_fn:krb5-post-recv-fn}}\label{\detokenize{appdev/refs/types/krb5_post_recv_fn:krb5-post-recv-fn-struct}}\label{\detokenize{appdev/refs/types/krb5_post_recv_fn::doc}}\index{krb5\_post\_recv\_fn (C type)@\spxentry{krb5\_post\_recv\_fn}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_post_recv_fn:c.krb5_post_recv_fn}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_post\_recv\_fn}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Hook function for inspecting or overriding KDC replies. - -\sphinxAtStartPar -If \sphinxstyleemphasis{code} is non\sphinxhyphen{}zero, KDC communication failed and \sphinxstyleemphasis{reply} should be ignored. The hook function may return \sphinxstyleemphasis{code} or a different error code, or may synthesize a reply by setting \sphinxstyleemphasis{new\_reply\_out} and return successfully. -The hook function should use krb5\_copy\_data() to construct the value for \sphinxstyleemphasis{new\_reply\_out} , to ensure that it can be freed correctly by the library. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_post_recv_fn:declaration}} -\sphinxAtStartPar -typedef krb5\_error\_code( * krb5\_post\_recv\_fn) (krb5\_context context, void *data, krb5\_error\_code code, const krb5\_data *realm, const krb5\_data *message, const krb5\_data *reply, krb5\_data **new\_reply\_out) - -\sphinxstepscope - - -\subsubsection{krb5\_pre\_send\_fn} -\label{\detokenize{appdev/refs/types/krb5_pre_send_fn:krb5-pre-send-fn}}\label{\detokenize{appdev/refs/types/krb5_pre_send_fn:krb5-pre-send-fn-struct}}\label{\detokenize{appdev/refs/types/krb5_pre_send_fn::doc}}\index{krb5\_pre\_send\_fn (C type)@\spxentry{krb5\_pre\_send\_fn}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pre_send_fn:c.krb5_pre_send_fn}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pre\_send\_fn}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Hook function for inspecting or modifying messages sent to KDCs. - -\sphinxAtStartPar -If the hook function sets \sphinxstyleemphasis{new\_reply\_out} , \sphinxstyleemphasis{message} will not be sent to the KDC, and the given reply will used instead. -If the hook function sets \sphinxstyleemphasis{new\_message\_out} , the given message will be sent to the KDC in place of \sphinxstyleemphasis{message} . -If the hook function returns successfully without setting either output, \sphinxstyleemphasis{message} will be sent to the KDC normally. -The hook function should use krb5\_copy\_data() to construct the value for \sphinxstyleemphasis{new\_message\_out} or \sphinxstyleemphasis{reply\_out} , to ensure that it can be freed correctly by the library. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_pre_send_fn:declaration}} -\sphinxAtStartPar -typedef krb5\_error\_code( * krb5\_pre\_send\_fn) (krb5\_context context, void *data, const krb5\_data *realm, const krb5\_data *message, krb5\_data **new\_message\_out, krb5\_data **new\_reply\_out) - -\sphinxstepscope - - -\subsubsection{krb5\_preauthtype} -\label{\detokenize{appdev/refs/types/krb5_preauthtype:krb5-preauthtype}}\label{\detokenize{appdev/refs/types/krb5_preauthtype:krb5-preauthtype-struct}}\label{\detokenize{appdev/refs/types/krb5_preauthtype::doc}}\index{krb5\_preauthtype (C type)@\spxentry{krb5\_preauthtype}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_preauthtype:c.krb5_preauthtype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_preauthtype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_preauthtype:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_preauthtype - -\sphinxstepscope - - -\subsubsection{krb5\_principal} -\label{\detokenize{appdev/refs/types/krb5_principal:krb5-principal}}\label{\detokenize{appdev/refs/types/krb5_principal:krb5-principal-struct}}\label{\detokenize{appdev/refs/types/krb5_principal::doc}}\index{krb5\_principal (C type)@\spxentry{krb5\_principal}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_principal}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_principal:declaration}} -\sphinxAtStartPar -typedef krb5\_principal\_data* krb5\_principal - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_principal:members}}\index{krb5\_principal.magic (C member)@\spxentry{krb5\_principal.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_principal.realm (C member)@\spxentry{krb5\_principal.realm}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal.realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{realm}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_principal.data (C member)@\spxentry{krb5\_principal.data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal.data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{data}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -An array of strings. - -\end{fulllineitems} - -\index{krb5\_principal.length (C member)@\spxentry{krb5\_principal.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_principal.type (C member)@\spxentry{krb5\_principal.type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal.type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{type}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_principal\_data} -\label{\detokenize{appdev/refs/types/krb5_principal_data:krb5-principal-data}}\label{\detokenize{appdev/refs/types/krb5_principal_data:krb5-principal-data-struct}}\label{\detokenize{appdev/refs/types/krb5_principal_data::doc}}\index{krb5\_principal\_data (C type)@\spxentry{krb5\_principal\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_principal\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_principal_data:declaration}} -\sphinxAtStartPar -typedef struct krb5\_principal\_data krb5\_principal\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_principal_data:members}}\index{krb5\_principal\_data.magic (C member)@\spxentry{krb5\_principal\_data.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data}]{\sphinxcrossref{\DUrole{n}{krb5\_principal\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_principal\_data.realm (C member)@\spxentry{krb5\_principal\_data.realm}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data.realm}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data}]{\sphinxcrossref{\DUrole{n}{krb5\_principal\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{realm}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_principal\_data.data (C member)@\spxentry{krb5\_principal\_data.data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data.data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data}]{\sphinxcrossref{\DUrole{n}{krb5\_principal\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{data}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -An array of strings. - -\end{fulllineitems} - -\index{krb5\_principal\_data.length (C member)@\spxentry{krb5\_principal\_data.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data}]{\sphinxcrossref{\DUrole{n}{krb5\_principal\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_principal\_data.type (C member)@\spxentry{krb5\_principal\_data.type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data.type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_principal_data:c.krb5_principal_data}]{\sphinxcrossref{\DUrole{n}{krb5\_principal\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{type}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_prompt} -\label{\detokenize{appdev/refs/types/krb5_prompt:krb5-prompt}}\label{\detokenize{appdev/refs/types/krb5_prompt:krb5-prompt-struct}}\label{\detokenize{appdev/refs/types/krb5_prompt::doc}}\index{krb5\_prompt (C type)@\spxentry{krb5\_prompt}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_prompt:c.krb5_prompt}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_prompt}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Text for prompt used in prompter callback function. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_prompt:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_prompt krb5\_prompt - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_prompt:members}}\index{krb5\_prompt.prompt (C member)@\spxentry{krb5\_prompt.prompt}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_prompt:c.krb5_prompt.prompt}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_prompt:c.krb5_prompt}]{\sphinxcrossref{\DUrole{n}{krb5\_prompt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{prompt}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -The prompt to show to the user. - -\end{fulllineitems} - -\index{krb5\_prompt.hidden (C member)@\spxentry{krb5\_prompt.hidden}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_prompt:c.krb5_prompt.hidden}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_prompt:c.krb5_prompt}]{\sphinxcrossref{\DUrole{n}{krb5\_prompt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{hidden}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Boolean; informative prompt or hidden (e.g. -PIN) - -\end{fulllineitems} - -\index{krb5\_prompt.reply (C member)@\spxentry{krb5\_prompt.reply}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_prompt:c.krb5_prompt.reply}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_prompt:c.krb5_prompt}]{\sphinxcrossref{\DUrole{n}{krb5\_prompt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{reply}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Must be allocated before call to prompt routine. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_prompt\_type} -\label{\detokenize{appdev/refs/types/krb5_prompt_type:krb5-prompt-type}}\label{\detokenize{appdev/refs/types/krb5_prompt_type:krb5-prompt-type-struct}}\label{\detokenize{appdev/refs/types/krb5_prompt_type::doc}}\index{krb5\_prompt\_type (C type)@\spxentry{krb5\_prompt\_type}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_prompt_type:c.krb5_prompt_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_prompt\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_prompt_type:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_prompt\_type - -\sphinxstepscope - - -\subsubsection{krb5\_prompter\_fct} -\label{\detokenize{appdev/refs/types/krb5_prompter_fct:krb5-prompter-fct}}\label{\detokenize{appdev/refs/types/krb5_prompter_fct:krb5-prompter-fct-struct}}\label{\detokenize{appdev/refs/types/krb5_prompter_fct::doc}}\index{krb5\_prompter\_fct (C type)@\spxentry{krb5\_prompter\_fct}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_prompter_fct:c.krb5_prompter_fct}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_prompter\_fct}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Pointer to a prompter callback function. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_prompter_fct:declaration}} -\sphinxAtStartPar -typedef krb5\_error\_code( * krb5\_prompter\_fct) (krb5\_context context, void *data, const char *name, const char *banner, int num\_prompts, krb5\_prompt prompts{[}{]}) - -\sphinxstepscope - - -\subsubsection{krb5\_pwd\_data} -\label{\detokenize{appdev/refs/types/krb5_pwd_data:krb5-pwd-data}}\label{\detokenize{appdev/refs/types/krb5_pwd_data:krb5-pwd-data-struct}}\label{\detokenize{appdev/refs/types/krb5_pwd_data::doc}}\index{krb5\_pwd\_data (C type)@\spxentry{krb5\_pwd\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pwd_data:c.krb5_pwd_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pwd\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_pwd_data:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_pwd\_data krb5\_pwd\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_pwd_data:members}}\index{krb5\_pwd\_data.magic (C member)@\spxentry{krb5\_pwd\_data.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pwd_data:c.krb5_pwd_data.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pwd_data:c.krb5_pwd_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pwd\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_pwd\_data.sequence\_count (C member)@\spxentry{krb5\_pwd\_data.sequence\_count}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pwd_data:c.krb5_pwd_data.sequence_count}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pwd_data:c.krb5_pwd_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pwd\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{sequence\_count}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_pwd\_data.element (C member)@\spxentry{krb5\_pwd\_data.element}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pwd_data:c.krb5_pwd_data.element}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/passwd_phrase_element:c.passwd_phrase_element}]{\sphinxcrossref{\DUrole{n}{passwd\_phrase\_element}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_pwd_data:c.krb5_pwd_data}]{\sphinxcrossref{\DUrole{n}{krb5\_pwd\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{element}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_context} -\label{\detokenize{appdev/refs/types/krb5_responder_context:krb5-responder-context}}\label{\detokenize{appdev/refs/types/krb5_responder_context:krb5-responder-context-struct}}\label{\detokenize{appdev/refs/types/krb5_responder_context::doc}}\index{krb5\_responder\_context (C type)@\spxentry{krb5\_responder\_context}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_context:c.krb5_responder_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_context}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -A container for a set of preauthentication questions and answers. - -\sphinxAtStartPar -A responder context is supplied by the krb5 authentication system to a krb5\_responder\_fn callback. It contains a list of questions and can receive answers. Questions contained in a responder context can be listed using krb5\_responder\_list\_questions(), retrieved using krb5\_responder\_get\_challenge(), or answered using krb5\_responder\_set\_answer(). The form of a question’s challenge and answer depend on the question name. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_responder_context:declaration}} -\sphinxAtStartPar -typedef struct krb5\_responder\_context\_st* krb5\_responder\_context - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_fn} -\label{\detokenize{appdev/refs/types/krb5_responder_fn:krb5-responder-fn}}\label{\detokenize{appdev/refs/types/krb5_responder_fn:krb5-responder-fn-struct}}\label{\detokenize{appdev/refs/types/krb5_responder_fn::doc}}\index{krb5\_responder\_fn (C type)@\spxentry{krb5\_responder\_fn}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_fn:c.krb5_responder_fn}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_fn}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Responder function for an initial credential exchange. - -\sphinxAtStartPar -If a required question is unanswered, the prompter may be called. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_responder_fn:declaration}} -\sphinxAtStartPar -typedef krb5\_error\_code( * krb5\_responder\_fn) (krb5\_context ctx, void *data, krb5\_responder\_context rctx) - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_otp\_challenge} -\label{\detokenize{appdev/refs/types/krb5_responder_otp_challenge:krb5-responder-otp-challenge}}\label{\detokenize{appdev/refs/types/krb5_responder_otp_challenge:krb5-responder-otp-challenge-struct}}\label{\detokenize{appdev/refs/types/krb5_responder_otp_challenge::doc}}\index{krb5\_responder\_otp\_challenge (C type)@\spxentry{krb5\_responder\_otp\_challenge}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_challenge:c.krb5_responder_otp_challenge}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_otp\_challenge}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_responder_otp_challenge:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_responder\_otp\_challenge krb5\_responder\_otp\_challenge - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_responder_otp_challenge:members}}\index{krb5\_responder\_otp\_challenge.service (C member)@\spxentry{krb5\_responder\_otp\_challenge.service}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_challenge:c.krb5_responder_otp_challenge.service}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_challenge:c.krb5_responder_otp_challenge}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_challenge}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{service}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_responder\_otp\_challenge.tokeninfo (C member)@\spxentry{krb5\_responder\_otp\_challenge.tokeninfo}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_challenge:c.krb5_responder_otp_challenge.tokeninfo}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_challenge:c.krb5_responder_otp_challenge}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_challenge}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{tokeninfo}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_otp\_tokeninfo} -\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:krb5-responder-otp-tokeninfo}}\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:krb5-responder-otp-tokeninfo-struct}}\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo::doc}}\index{krb5\_responder\_otp\_tokeninfo (C type)@\spxentry{krb5\_responder\_otp\_tokeninfo}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_responder\_otp\_tokeninfo krb5\_responder\_otp\_tokeninfo - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:members}}\index{krb5\_responder\_otp\_tokeninfo.flags (C member)@\spxentry{krb5\_responder\_otp\_tokeninfo.flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo.flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_responder\_otp\_tokeninfo.format (C member)@\spxentry{krb5\_responder\_otp\_tokeninfo.format}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo.format}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{format}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_responder\_otp\_tokeninfo.length (C member)@\spxentry{krb5\_responder\_otp\_tokeninfo.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_responder\_otp\_tokeninfo.vendor (C member)@\spxentry{krb5\_responder\_otp\_tokeninfo.vendor}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo.vendor}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{vendor}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_responder\_otp\_tokeninfo.challenge (C member)@\spxentry{krb5\_responder\_otp\_tokeninfo.challenge}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo.challenge}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{challenge}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_responder\_otp\_tokeninfo.token\_id (C member)@\spxentry{krb5\_responder\_otp\_tokeninfo.token\_id}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo.token_id}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{token\_id}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_responder\_otp\_tokeninfo.alg\_id (C member)@\spxentry{krb5\_responder\_otp\_tokeninfo.alg\_id}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo.alg_id}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_otp_tokeninfo:c.krb5_responder_otp_tokeninfo}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_otp\_tokeninfo}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{alg\_id}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_pkinit\_challenge} -\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:krb5-responder-pkinit-challenge}}\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:krb5-responder-pkinit-challenge-struct}}\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge::doc}}\index{krb5\_responder\_pkinit\_challenge (C type)@\spxentry{krb5\_responder\_pkinit\_challenge}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:c.krb5_responder_pkinit_challenge}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_pkinit\_challenge}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_responder\_pkinit\_challenge krb5\_responder\_pkinit\_challenge - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:members}}\index{krb5\_responder\_pkinit\_challenge.identities (C member)@\spxentry{krb5\_responder\_pkinit\_challenge.identities}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:c.krb5_responder_pkinit_challenge.identities}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:c.krb5_responder_pkinit_identity}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_pkinit\_identity}}}}\DUrole{w}{ }\DUrole{p}{*}\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_pkinit_challenge:c.krb5_responder_pkinit_challenge}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_pkinit\_challenge}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{identities}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_responder\_pkinit\_identity} -\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:krb5-responder-pkinit-identity}}\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:krb5-responder-pkinit-identity-struct}}\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_identity::doc}}\index{krb5\_responder\_pkinit\_identity (C type)@\spxentry{krb5\_responder\_pkinit\_identity}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:c.krb5_responder_pkinit_identity}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_responder\_pkinit\_identity}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_responder\_pkinit\_identity krb5\_responder\_pkinit\_identity - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:members}}\index{krb5\_responder\_pkinit\_identity.identity (C member)@\spxentry{krb5\_responder\_pkinit\_identity.identity}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:c.krb5_responder_pkinit_identity.identity}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:c.krb5_responder_pkinit_identity}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_pkinit\_identity}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{identity}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_responder\_pkinit\_identity.token\_flags (C member)@\spxentry{krb5\_responder\_pkinit\_identity.token\_flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:c.krb5_responder_pkinit_identity.token_flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_responder_pkinit_identity:c.krb5_responder_pkinit_identity}]{\sphinxcrossref{\DUrole{n}{krb5\_responder\_pkinit\_identity}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{token\_flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_response} -\label{\detokenize{appdev/refs/types/krb5_response:krb5-response}}\label{\detokenize{appdev/refs/types/krb5_response:krb5-response-struct}}\label{\detokenize{appdev/refs/types/krb5_response::doc}}\index{krb5\_response (C type)@\spxentry{krb5\_response}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_response:c.krb5_response}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_response}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_response:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_response krb5\_response - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_response:members}}\index{krb5\_response.magic (C member)@\spxentry{krb5\_response.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_response:c.krb5_response.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_response:c.krb5_response}]{\sphinxcrossref{\DUrole{n}{krb5\_response}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_response.message\_type (C member)@\spxentry{krb5\_response.message\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_response:c.krb5_response.message_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}]{\sphinxcrossref{\DUrole{n}{krb5\_octet}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_response:c.krb5_response}]{\sphinxcrossref{\DUrole{n}{krb5\_response}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{message\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_response.response (C member)@\spxentry{krb5\_response.response}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_response:c.krb5_response.response}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_response:c.krb5_response}]{\sphinxcrossref{\DUrole{n}{krb5\_response}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{response}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_response.expected\_nonce (C member)@\spxentry{krb5\_response.expected\_nonce}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_response:c.krb5_response.expected_nonce}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_response:c.krb5_response}]{\sphinxcrossref{\DUrole{n}{krb5\_response}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{expected\_nonce}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_response.request\_time (C member)@\spxentry{krb5\_response.request\_time}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_response:c.krb5_response.request_time}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_response:c.krb5_response}]{\sphinxcrossref{\DUrole{n}{krb5\_response}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{request\_time}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_replay\_data} -\label{\detokenize{appdev/refs/types/krb5_replay_data:krb5-replay-data}}\label{\detokenize{appdev/refs/types/krb5_replay_data:krb5-replay-data-struct}}\label{\detokenize{appdev/refs/types/krb5_replay_data::doc}}\index{krb5\_replay\_data (C type)@\spxentry{krb5\_replay\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_replay\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Replay data. - -\sphinxAtStartPar -Sequence number and timestamp information output by krb5\_rd\_priv() and krb5\_rd\_safe(). - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_replay_data:declaration}} -\sphinxAtStartPar -typedef struct krb5\_replay\_data krb5\_replay\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_replay_data:members}}\index{krb5\_replay\_data.timestamp (C member)@\spxentry{krb5\_replay\_data.timestamp}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data.timestamp}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{timestamp}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Timestamp, seconds portion. - -\end{fulllineitems} - -\index{krb5\_replay\_data.usec (C member)@\spxentry{krb5\_replay\_data.usec}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data.usec}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{usec}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Timestamp, microseconds portion. - -\end{fulllineitems} - -\index{krb5\_replay\_data.seq (C member)@\spxentry{krb5\_replay\_data.seq}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data.seq}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}]{\sphinxcrossref{\DUrole{n}{krb5\_ui\_4}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_replay_data:c.krb5_replay_data}]{\sphinxcrossref{\DUrole{n}{krb5\_replay\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{seq}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Sequence number. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_ticket} -\label{\detokenize{appdev/refs/types/krb5_ticket:krb5-ticket}}\label{\detokenize{appdev/refs/types/krb5_ticket:krb5-ticket-struct}}\label{\detokenize{appdev/refs/types/krb5_ticket::doc}}\index{krb5\_ticket (C type)@\spxentry{krb5\_ticket}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_ticket}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Ticket structure. - -\sphinxAtStartPar -The C representation of the ticket message, with a pointer to the C representation of the encrypted part. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_ticket:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_ticket krb5\_ticket - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_ticket:members}}\index{krb5\_ticket.magic (C member)@\spxentry{krb5\_ticket.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_ticket.server (C member)@\spxentry{krb5\_ticket.server}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket.server}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_principal:c.krb5_principal}]{\sphinxcrossref{\DUrole{n}{krb5\_principal}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{server}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -server name/realm - -\end{fulllineitems} - -\index{krb5\_ticket.enc\_part (C member)@\spxentry{krb5\_ticket.enc\_part}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket.enc_part}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_data:c.krb5_enc_data}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enc\_part}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -encryption type, kvno, encrypted encoding - -\end{fulllineitems} - -\index{krb5\_ticket.enc\_part2 (C member)@\spxentry{krb5\_ticket.enc\_part2}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket.enc_part2}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_enc_tkt_part:c.krb5_enc_tkt_part}]{\sphinxcrossref{\DUrole{n}{krb5\_enc\_tkt\_part}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{enc\_part2}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -ptr to decrypted version, if available - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_ticket\_times} -\label{\detokenize{appdev/refs/types/krb5_ticket_times:krb5-ticket-times}}\label{\detokenize{appdev/refs/types/krb5_ticket_times:krb5-ticket-times-struct}}\label{\detokenize{appdev/refs/types/krb5_ticket_times::doc}}\index{krb5\_ticket\_times (C type)@\spxentry{krb5\_ticket\_times}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_ticket\_times}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Ticket start time, end time, and renewal duration. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_ticket_times:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_ticket\_times krb5\_ticket\_times - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_ticket_times:members}}\index{krb5\_ticket\_times.authtime (C member)@\spxentry{krb5\_ticket\_times.authtime}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times.authtime}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{authtime}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Time at which KDC issued the initial ticket that corresponds to this ticket. - -\end{fulllineitems} - -\index{krb5\_ticket\_times.starttime (C member)@\spxentry{krb5\_ticket\_times.starttime}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times.starttime}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{starttime}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -optional in ticket, if not present, use \sphinxstyleemphasis{authtime} - -\end{fulllineitems} - -\index{krb5\_ticket\_times.endtime (C member)@\spxentry{krb5\_ticket\_times.endtime}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times.endtime}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{endtime}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Ticket expiration time. - -\end{fulllineitems} - -\index{krb5\_ticket\_times.renew\_till (C member)@\spxentry{krb5\_ticket\_times.renew\_till}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times.renew_till}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}]{\sphinxcrossref{\DUrole{n}{krb5\_timestamp}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket_times:c.krb5_ticket_times}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket\_times}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{renew\_till}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Latest time at which renewal of ticket can be valid. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_timestamp} -\label{\detokenize{appdev/refs/types/krb5_timestamp:krb5-timestamp}}\label{\detokenize{appdev/refs/types/krb5_timestamp:krb5-timestamp-struct}}\label{\detokenize{appdev/refs/types/krb5_timestamp::doc}}\index{krb5\_timestamp (C type)@\spxentry{krb5\_timestamp}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_timestamp:c.krb5_timestamp}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_timestamp}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Represents a timestamp in seconds since the POSIX epoch. - -\sphinxAtStartPar -This legacy type is used frequently in the ABI, but cannot represent timestamps after 2038 as a positive number. Code which uses this type should cast values of it to uint32\_t so that negative values are treated as timestamps between 2038 and 2106 on platforms with 64\sphinxhyphen{}bit time\_t. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_timestamp:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_timestamp - -\sphinxstepscope - - -\subsubsection{krb5\_tkt\_authent} -\label{\detokenize{appdev/refs/types/krb5_tkt_authent:krb5-tkt-authent}}\label{\detokenize{appdev/refs/types/krb5_tkt_authent:krb5-tkt-authent-struct}}\label{\detokenize{appdev/refs/types/krb5_tkt_authent::doc}}\index{krb5\_tkt\_authent (C type)@\spxentry{krb5\_tkt\_authent}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_tkt\_authent}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Ticket authentication data. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_tkt_authent:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_tkt\_authent krb5\_tkt\_authent - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_tkt_authent:members}}\index{krb5\_tkt\_authent.magic (C member)@\spxentry{krb5\_tkt\_authent.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_authent}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_tkt\_authent.ticket (C member)@\spxentry{krb5\_tkt\_authent.ticket}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent.ticket}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_ticket:c.krb5_ticket}]{\sphinxcrossref{\DUrole{n}{krb5\_ticket}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_authent}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ticket}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_tkt\_authent.authenticator (C member)@\spxentry{krb5\_tkt\_authent.authenticator}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent.authenticator}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_authenticator:c.krb5_authenticator}]{\sphinxcrossref{\DUrole{n}{krb5\_authenticator}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_authent}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{authenticator}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_tkt\_authent.ap\_options (C member)@\spxentry{krb5\_tkt\_authent.ap\_options}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent.ap_options}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_tkt_authent:c.krb5_tkt_authent}]{\sphinxcrossref{\DUrole{n}{krb5\_tkt\_authent}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ap\_options}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_trace\_callback} -\label{\detokenize{appdev/refs/types/krb5_trace_callback:krb5-trace-callback}}\label{\detokenize{appdev/refs/types/krb5_trace_callback:krb5-trace-callback-struct}}\label{\detokenize{appdev/refs/types/krb5_trace_callback::doc}}\index{krb5\_trace\_callback (C type)@\spxentry{krb5\_trace\_callback}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_trace_callback:c.krb5_trace_callback}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_trace\_callback}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_trace_callback:declaration}} -\sphinxAtStartPar -typedef void( * krb5\_trace\_callback) (krb5\_context context, const krb5\_trace\_info *info, void *cb\_data) - -\sphinxstepscope - - -\subsubsection{krb5\_trace\_info} -\label{\detokenize{appdev/refs/types/krb5_trace_info:krb5-trace-info}}\label{\detokenize{appdev/refs/types/krb5_trace_info:krb5-trace-info-struct}}\label{\detokenize{appdev/refs/types/krb5_trace_info::doc}}\index{krb5\_trace\_info (C type)@\spxentry{krb5\_trace\_info}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_trace_info:c.krb5_trace_info}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_trace\_info}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -A wrapper for passing information to a \sphinxstyleemphasis{krb5\_trace\_callback} . - -\sphinxAtStartPar -Currently, it only contains the formatted message as determined the the format string and arguments of the tracing macro, but it may be extended to contain more fields in the future. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_trace_info:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_trace\_info krb5\_trace\_info - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_trace_info:members}}\index{krb5\_trace\_info.message (C member)@\spxentry{krb5\_trace\_info.message}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_trace_info:c.krb5_trace_info.message}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{const}\DUrole{w}{ }\DUrole{kt}{char}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_trace_info:c.krb5_trace_info}]{\sphinxcrossref{\DUrole{n}{krb5\_trace\_info}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{message}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_transited} -\label{\detokenize{appdev/refs/types/krb5_transited:krb5-transited}}\label{\detokenize{appdev/refs/types/krb5_transited:krb5-transited-struct}}\label{\detokenize{appdev/refs/types/krb5_transited::doc}}\index{krb5\_transited (C type)@\spxentry{krb5\_transited}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_transited:c.krb5_transited}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_transited}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Structure for transited encoding. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_transited:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_transited krb5\_transited - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_transited:members}}\index{krb5\_transited.magic (C member)@\spxentry{krb5\_transited.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_transited:c.krb5_transited.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_transited:c.krb5_transited}]{\sphinxcrossref{\DUrole{n}{krb5\_transited}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_transited.tr\_type (C member)@\spxentry{krb5\_transited.tr\_type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_transited:c.krb5_transited.tr_type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}]{\sphinxcrossref{\DUrole{n}{krb5\_octet}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_transited:c.krb5_transited}]{\sphinxcrossref{\DUrole{n}{krb5\_transited}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{tr\_type}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Transited encoding type. - -\end{fulllineitems} - -\index{krb5\_transited.tr\_contents (C member)@\spxentry{krb5\_transited.tr\_contents}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_transited:c.krb5_transited.tr_contents}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_transited:c.krb5_transited}]{\sphinxcrossref{\DUrole{n}{krb5\_transited}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{tr\_contents}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -Contents. - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_typed\_data} -\label{\detokenize{appdev/refs/types/krb5_typed_data:krb5-typed-data}}\label{\detokenize{appdev/refs/types/krb5_typed_data:krb5-typed-data-struct}}\label{\detokenize{appdev/refs/types/krb5_typed_data::doc}}\index{krb5\_typed\_data (C type)@\spxentry{krb5\_typed\_data}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_typed\_data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_typed_data:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_typed\_data krb5\_typed\_data - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_typed_data:members}}\index{krb5\_typed\_data.magic (C member)@\spxentry{krb5\_typed\_data.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data}]{\sphinxcrossref{\DUrole{n}{krb5\_typed\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_typed\_data.type (C member)@\spxentry{krb5\_typed\_data.type}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data.type}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_int32:c.krb5_int32}]{\sphinxcrossref{\DUrole{n}{krb5\_int32}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data}]{\sphinxcrossref{\DUrole{n}{krb5\_typed\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{type}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_typed\_data.length (C member)@\spxentry{krb5\_typed\_data.length}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data.length}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{unsigned}\DUrole{w}{ }\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data}]{\sphinxcrossref{\DUrole{n}{krb5\_typed\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{length}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_typed\_data.data (C member)@\spxentry{krb5\_typed\_data.data}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data.data}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_octet:c.krb5_octet}]{\sphinxcrossref{\DUrole{n}{krb5\_octet}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_typed_data:c.krb5_typed_data}]{\sphinxcrossref{\DUrole{n}{krb5\_typed\_data}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{data}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{krb5\_ui\_2} -\label{\detokenize{appdev/refs/types/krb5_ui_2:krb5-ui-2}}\label{\detokenize{appdev/refs/types/krb5_ui_2:krb5-ui-2-struct}}\label{\detokenize{appdev/refs/types/krb5_ui_2::doc}}\index{krb5\_ui\_2 (C type)@\spxentry{krb5\_ui\_2}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ui_2:c.krb5_ui_2}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_ui\_2}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_ui_2:declaration}} -\sphinxAtStartPar -typedef uint16\_t krb5\_ui\_2 - -\sphinxstepscope - - -\subsubsection{krb5\_ui\_4} -\label{\detokenize{appdev/refs/types/krb5_ui_4:krb5-ui-4}}\label{\detokenize{appdev/refs/types/krb5_ui_4:krb5-ui-4-struct}}\label{\detokenize{appdev/refs/types/krb5_ui_4::doc}}\index{krb5\_ui\_4 (C type)@\spxentry{krb5\_ui\_4}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ui_4:c.krb5_ui_4}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_ui\_4}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_ui_4:declaration}} -\sphinxAtStartPar -typedef uint32\_t krb5\_ui\_4 - -\sphinxstepscope - - -\subsubsection{krb5\_verify\_init\_creds\_opt} -\label{\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:krb5-verify-init-creds-opt}}\label{\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:krb5-verify-init-creds-opt-struct}}\label{\detokenize{appdev/refs/types/krb5_verify_init_creds_opt::doc}}\index{krb5\_verify\_init\_creds\_opt (C type)@\spxentry{krb5\_verify\_init\_creds\_opt}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:c.krb5_verify_init_creds_opt}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_verify\_init\_creds\_opt}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_verify\_init\_creds\_opt krb5\_verify\_init\_creds\_opt - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:members}}\index{krb5\_verify\_init\_creds\_opt.flags (C member)@\spxentry{krb5\_verify\_init\_creds\_opt.flags}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:c.krb5_verify_init_creds_opt.flags}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_flags:c.krb5_flags}]{\sphinxcrossref{\DUrole{n}{krb5\_flags}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:c.krb5_verify_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_verify\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{flags}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{krb5\_verify\_init\_creds\_opt.ap\_req\_nofail (C member)@\spxentry{krb5\_verify\_init\_creds\_opt.ap\_req\_nofail}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:c.krb5_verify_init_creds_opt.ap_req_nofail}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{kt}{int}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/krb5_verify_init_creds_opt:c.krb5_verify_init_creds_opt}]{\sphinxcrossref{\DUrole{n}{krb5\_verify\_init\_creds\_opt}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{ap\_req\_nofail}}}} -\pysigstopmultiline -\pysigstopsignatures -\sphinxAtStartPar -boolean - -\end{fulllineitems} - - -\sphinxstepscope - - -\subsubsection{passwd\_phrase\_element} -\label{\detokenize{appdev/refs/types/passwd_phrase_element:passwd-phrase-element}}\label{\detokenize{appdev/refs/types/passwd_phrase_element:passwd-phrase-element-struct}}\label{\detokenize{appdev/refs/types/passwd_phrase_element::doc}}\index{passwd\_phrase\_element (C type)@\spxentry{passwd\_phrase\_element}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/passwd_phrase_element:c.passwd_phrase_element}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{passwd\_phrase\_element}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/passwd_phrase_element:declaration}} -\sphinxAtStartPar -typedef struct \_passwd\_phrase\_element passwd\_phrase\_element - - -\paragraph{Members} -\label{\detokenize{appdev/refs/types/passwd_phrase_element:members}}\index{passwd\_phrase\_element.magic (C member)@\spxentry{passwd\_phrase\_element.magic}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/passwd_phrase_element:c.passwd_phrase_element.magic}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_magic:c.krb5_magic}]{\sphinxcrossref{\DUrole{n}{krb5\_magic}}}}\DUrole{w}{ }\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/passwd_phrase_element:c.passwd_phrase_element}]{\sphinxcrossref{\DUrole{n}{passwd\_phrase\_element}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{magic}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{passwd\_phrase\_element.passwd (C member)@\spxentry{passwd\_phrase\_element.passwd}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/passwd_phrase_element:c.passwd_phrase_element.passwd}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/passwd_phrase_element:c.passwd_phrase_element}]{\sphinxcrossref{\DUrole{n}{passwd\_phrase\_element}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{passwd}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - -\index{passwd\_phrase\_element.phrase (C member)@\spxentry{passwd\_phrase\_element.phrase}\spxextra{C member}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/passwd_phrase_element:c.passwd_phrase_element.phrase}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{{\hyperref[\detokenize{appdev/refs/types/krb5_data:c.krb5_data}]{\sphinxcrossref{\DUrole{n}{krb5\_data}}}}\DUrole{w}{ }\DUrole{p}{*}\sphinxcode{\sphinxupquote{{\hyperref[\detokenize{appdev/refs/types/passwd_phrase_element:c.passwd_phrase_element}]{\sphinxcrossref{\DUrole{n}{passwd\_phrase\_element}}}}\DUrole{p}{.}}}\sphinxbfcode{\sphinxupquote{\DUrole{n}{phrase}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\subsection{Internal} -\label{\detokenize{appdev/refs/types/index:internal}} -\sphinxstepscope - - -\subsubsection{krb5\_auth\_context} -\label{\detokenize{appdev/refs/types/krb5_auth_context:krb5-auth-context}}\label{\detokenize{appdev/refs/types/krb5_auth_context:krb5-auth-context-struct}}\label{\detokenize{appdev/refs/types/krb5_auth_context::doc}}\index{krb5\_auth\_context (C type)@\spxentry{krb5\_auth\_context}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_auth_context:c.krb5_auth_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_auth\_context}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_auth_context:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_auth\_context* krb5\_auth\_context - -\sphinxstepscope - - -\subsubsection{krb5\_cksumtype} -\label{\detokenize{appdev/refs/types/krb5_cksumtype:krb5-cksumtype}}\label{\detokenize{appdev/refs/types/krb5_cksumtype:krb5-cksumtype-struct}}\label{\detokenize{appdev/refs/types/krb5_cksumtype::doc}}\index{krb5\_cksumtype (C type)@\spxentry{krb5\_cksumtype}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cksumtype:c.krb5_cksumtype}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cksumtype}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_cksumtype:declaration}} -\sphinxAtStartPar -typedef krb5\_int32 krb5\_cksumtype - -\sphinxstepscope - - -\subsubsection{krb5\_context} -\label{\detokenize{appdev/refs/types/krb5_context:krb5-context}}\label{\detokenize{appdev/refs/types/krb5_context:krb5-context-struct}}\label{\detokenize{appdev/refs/types/krb5_context::doc}}\index{krb5\_context (C type)@\spxentry{krb5\_context}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_context:c.krb5_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_context}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_context:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_context* krb5\_context - -\sphinxstepscope - - -\subsubsection{krb5\_cc\_cursor} -\label{\detokenize{appdev/refs/types/krb5_cc_cursor:krb5-cc-cursor}}\label{\detokenize{appdev/refs/types/krb5_cc_cursor:krb5-cc-cursor-struct}}\label{\detokenize{appdev/refs/types/krb5_cc_cursor::doc}}\index{krb5\_cc\_cursor (C type)@\spxentry{krb5\_cc\_cursor}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cc_cursor:c.krb5_cc_cursor}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cc\_cursor}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Cursor for sequential lookup. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_cc_cursor:declaration}} -\sphinxAtStartPar -typedef krb5\_pointer krb5\_cc\_cursor - -\sphinxstepscope - - -\subsubsection{krb5\_ccache} -\label{\detokenize{appdev/refs/types/krb5_ccache:krb5-ccache}}\label{\detokenize{appdev/refs/types/krb5_ccache:krb5-ccache-struct}}\label{\detokenize{appdev/refs/types/krb5_ccache::doc}}\index{krb5\_ccache (C type)@\spxentry{krb5\_ccache}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_ccache:c.krb5_ccache}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_ccache}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_ccache:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_ccache* krb5\_ccache - -\sphinxstepscope - - -\subsubsection{krb5\_cccol\_cursor} -\label{\detokenize{appdev/refs/types/krb5_cccol_cursor:krb5-cccol-cursor}}\label{\detokenize{appdev/refs/types/krb5_cccol_cursor:krb5-cccol-cursor-struct}}\label{\detokenize{appdev/refs/types/krb5_cccol_cursor::doc}}\index{krb5\_cccol\_cursor (C type)@\spxentry{krb5\_cccol\_cursor}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_cccol_cursor:c.krb5_cccol_cursor}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_cccol\_cursor}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Cursor for iterating over all ccaches. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_cccol_cursor:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_cccol\_cursor* krb5\_cccol\_cursor - -\sphinxstepscope - - -\subsubsection{krb5\_init\_creds\_context} -\label{\detokenize{appdev/refs/types/krb5_init_creds_context:krb5-init-creds-context}}\label{\detokenize{appdev/refs/types/krb5_init_creds_context:krb5-init-creds-context-struct}}\label{\detokenize{appdev/refs/types/krb5_init_creds_context::doc}}\index{krb5\_init\_creds\_context (C type)@\spxentry{krb5\_init\_creds\_context}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_init_creds_context:c.krb5_init_creds_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_init\_creds\_context}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_init_creds_context:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_init\_creds\_context* krb5\_init\_creds\_context - -\sphinxstepscope - - -\subsubsection{krb5\_key} -\label{\detokenize{appdev/refs/types/krb5_key:krb5-key}}\label{\detokenize{appdev/refs/types/krb5_key:krb5-key-struct}}\label{\detokenize{appdev/refs/types/krb5_key::doc}}\index{krb5\_key (C type)@\spxentry{krb5\_key}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_key:c.krb5_key}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_key}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Opaque identifier for a key. - -\sphinxAtStartPar -Use with the krb5\_k APIs for better performance for repeated operations with the same key and usage. Key identifiers must not be used simultaneously within multiple threads, as they may contain mutable internal state and are not mutex\sphinxhyphen{}protected. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_key:declaration}} -\sphinxAtStartPar -typedef struct krb5\_key\_st* krb5\_key - -\sphinxstepscope - - -\subsubsection{krb5\_keytab} -\label{\detokenize{appdev/refs/types/krb5_keytab:krb5-keytab}}\label{\detokenize{appdev/refs/types/krb5_keytab:krb5-keytab-struct}}\label{\detokenize{appdev/refs/types/krb5_keytab::doc}}\index{krb5\_keytab (C type)@\spxentry{krb5\_keytab}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_keytab:c.krb5_keytab}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_keytab}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_keytab:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_kt* krb5\_keytab - -\sphinxstepscope - - -\subsubsection{krb5\_pac} -\label{\detokenize{appdev/refs/types/krb5_pac:krb5-pac}}\label{\detokenize{appdev/refs/types/krb5_pac:krb5-pac-struct}}\label{\detokenize{appdev/refs/types/krb5_pac::doc}}\index{krb5\_pac (C type)@\spxentry{krb5\_pac}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_pac:c.krb5_pac}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_pac}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PAC data structure to convey authorization information. - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_pac:declaration}} -\sphinxAtStartPar -typedef struct krb5\_pac\_data* krb5\_pac - -\sphinxstepscope - - -\subsubsection{krb5\_rcache} -\label{\detokenize{appdev/refs/types/krb5_rcache:krb5-rcache}}\label{\detokenize{appdev/refs/types/krb5_rcache:krb5-rcache-struct}}\label{\detokenize{appdev/refs/types/krb5_rcache::doc}}\index{krb5\_rcache (C type)@\spxentry{krb5\_rcache}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_rcache:c.krb5_rcache}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_rcache}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_rcache:declaration}} -\sphinxAtStartPar -typedef struct krb5\_rc\_st* krb5\_rcache - -\sphinxstepscope - - -\subsubsection{krb5\_tkt\_creds\_context} -\label{\detokenize{appdev/refs/types/krb5_tkt_creds_context:krb5-tkt-creds-context}}\label{\detokenize{appdev/refs/types/krb5_tkt_creds_context:krb5-tkt-creds-context-struct}}\label{\detokenize{appdev/refs/types/krb5_tkt_creds_context::doc}}\index{krb5\_tkt\_creds\_context (C type)@\spxentry{krb5\_tkt\_creds\_context}\spxextra{C type}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/types/krb5_tkt_creds_context:c.krb5_tkt_creds_context}} -\pysigstartsignatures -\pysigstartmultiline -\pysigline{\DUrole{k}{type}\DUrole{w}{ }\sphinxbfcode{\sphinxupquote{\DUrole{n}{krb5\_tkt\_creds\_context}}}} -\pysigstopmultiline -\pysigstopsignatures -\end{fulllineitems} - - - -\paragraph{Declaration} -\label{\detokenize{appdev/refs/types/krb5_tkt_creds_context:declaration}} -\sphinxAtStartPar -typedef struct \_krb5\_tkt\_creds\_context* krb5\_tkt\_creds\_context - -\sphinxstepscope - - -\section{krb5 simple macros} -\label{\detokenize{appdev/refs/macros/index:krb5-simple-macros}}\label{\detokenize{appdev/refs/macros/index::doc}} - -\subsection{Public} -\label{\detokenize{appdev/refs/macros/index:public}} -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_ADDRPORT} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_ADDRPORT:addrtype-addrport}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_ADDRPORT:addrtype-addrport-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_ADDRPORT::doc}}\index{ADDRTYPE\_ADDRPORT (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_ADDRPORT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_ADDRPORT:ADDRTYPE_ADDRPORT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_ADDRPORT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_ADDRPORT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0100}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_CHAOS} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_CHAOS:addrtype-chaos}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_CHAOS:addrtype-chaos-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_CHAOS::doc}}\index{ADDRTYPE\_CHAOS (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_CHAOS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_CHAOS:ADDRTYPE_CHAOS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_CHAOS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_CHAOS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0005}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_DIRECTIONAL} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_DIRECTIONAL:addrtype-directional}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_DIRECTIONAL:addrtype-directional-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_DIRECTIONAL::doc}}\index{ADDRTYPE\_DIRECTIONAL (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_DIRECTIONAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_DIRECTIONAL:ADDRTYPE_DIRECTIONAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_DIRECTIONAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_DIRECTIONAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0003}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_DDP} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_DDP:addrtype-ddp}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_DDP:addrtype-ddp-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_DDP::doc}}\index{ADDRTYPE\_DDP (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_DDP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_DDP:ADDRTYPE_DDP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_DDP}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_DDP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0010}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_INET} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_INET:addrtype-inet}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_INET:addrtype-inet-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_INET::doc}}\index{ADDRTYPE\_INET (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_INET}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_INET:ADDRTYPE_INET}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_INET}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_INET}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_INET6} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_INET6:addrtype-inet6}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_INET6:addrtype-inet6-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_INET6::doc}}\index{ADDRTYPE\_INET6 (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_INET6}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_INET6:ADDRTYPE_INET6}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_INET6}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_INET6}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0018}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_IPPORT} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_IPPORT:addrtype-ipport}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_IPPORT:addrtype-ipport-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_IPPORT::doc}}\index{ADDRTYPE\_IPPORT (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_IPPORT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_IPPORT:ADDRTYPE_IPPORT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_IPPORT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_IPPORT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0101}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_ISO} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_ISO:addrtype-iso}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_ISO:addrtype-iso-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_ISO::doc}}\index{ADDRTYPE\_ISO (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_ISO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_ISO:ADDRTYPE_ISO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_ISO}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_ISO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0007}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_IS\_LOCAL} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_IS_LOCAL:addrtype-is-local}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_IS_LOCAL:addrtype-is-local-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_IS_LOCAL::doc}}\index{ADDRTYPE\_IS\_LOCAL (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_IS\_LOCAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_IS_LOCAL:ADDRTYPE_IS_LOCAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_IS\_LOCAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_IS\_LOCAL (addrtype)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(addrtype \& 0x8000)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_NETBIOS} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_NETBIOS:addrtype-netbios}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_NETBIOS:addrtype-netbios-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_NETBIOS::doc}}\index{ADDRTYPE\_NETBIOS (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_NETBIOS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_NETBIOS:ADDRTYPE_NETBIOS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_NETBIOS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_NETBIOS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0014}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_XNS} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_XNS:addrtype-xns}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_XNS:addrtype-xns-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_XNS::doc}}\index{ADDRTYPE\_XNS (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_XNS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_XNS:ADDRTYPE_XNS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_XNS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_XNS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0006}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ADDRTYPE\_UNIXSOCK} -\label{\detokenize{appdev/refs/macros/ADDRTYPE_UNIXSOCK:addrtype-unixsock}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_UNIXSOCK:addrtype-unixsock-data}}\label{\detokenize{appdev/refs/macros/ADDRTYPE_UNIXSOCK::doc}}\index{ADDRTYPE\_UNIXSOCK (built\sphinxhyphen{}in variable)@\spxentry{ADDRTYPE\_UNIXSOCK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ADDRTYPE_UNIXSOCK:ADDRTYPE_UNIXSOCK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ADDRTYPE\_UNIXSOCK}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ADDRTYPE\_UNIXSOCK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(0x8000 | 0x0001)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AD\_TYPE\_EXTERNAL} -\label{\detokenize{appdev/refs/macros/AD_TYPE_EXTERNAL:ad-type-external}}\label{\detokenize{appdev/refs/macros/AD_TYPE_EXTERNAL:ad-type-external-data}}\label{\detokenize{appdev/refs/macros/AD_TYPE_EXTERNAL::doc}}\index{AD\_TYPE\_EXTERNAL (built\sphinxhyphen{}in variable)@\spxentry{AD\_TYPE\_EXTERNAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AD_TYPE_EXTERNAL:AD_TYPE_EXTERNAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AD\_TYPE\_EXTERNAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AD\_TYPE\_EXTERNAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x4000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AD\_TYPE\_FIELD\_TYPE\_MASK} -\label{\detokenize{appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK:ad-type-field-type-mask}}\label{\detokenize{appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK:ad-type-field-type-mask-data}}\label{\detokenize{appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK::doc}}\index{AD\_TYPE\_FIELD\_TYPE\_MASK (built\sphinxhyphen{}in variable)@\spxentry{AD\_TYPE\_FIELD\_TYPE\_MASK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AD_TYPE_FIELD_TYPE_MASK:AD_TYPE_FIELD_TYPE_MASK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AD\_TYPE\_FIELD\_TYPE\_MASK}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AD\_TYPE\_FIELD\_TYPE\_MASK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x1fff}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AD\_TYPE\_REGISTERED} -\label{\detokenize{appdev/refs/macros/AD_TYPE_REGISTERED:ad-type-registered}}\label{\detokenize{appdev/refs/macros/AD_TYPE_REGISTERED:ad-type-registered-data}}\label{\detokenize{appdev/refs/macros/AD_TYPE_REGISTERED::doc}}\index{AD\_TYPE\_REGISTERED (built\sphinxhyphen{}in variable)@\spxentry{AD\_TYPE\_REGISTERED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AD_TYPE_REGISTERED:AD_TYPE_REGISTERED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AD\_TYPE\_REGISTERED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AD\_TYPE\_REGISTERED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x2000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AD\_TYPE\_RESERVED} -\label{\detokenize{appdev/refs/macros/AD_TYPE_RESERVED:ad-type-reserved}}\label{\detokenize{appdev/refs/macros/AD_TYPE_RESERVED:ad-type-reserved-data}}\label{\detokenize{appdev/refs/macros/AD_TYPE_RESERVED::doc}}\index{AD\_TYPE\_RESERVED (built\sphinxhyphen{}in variable)@\spxentry{AD\_TYPE\_RESERVED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AD_TYPE_RESERVED:AD_TYPE_RESERVED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AD\_TYPE\_RESERVED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AD\_TYPE\_RESERVED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x8000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AP\_OPTS\_ETYPE\_NEGOTIATION} -\label{\detokenize{appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION:ap-opts-etype-negotiation}}\label{\detokenize{appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION:ap-opts-etype-negotiation-data}}\label{\detokenize{appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION::doc}}\index{AP\_OPTS\_ETYPE\_NEGOTIATION (built\sphinxhyphen{}in variable)@\spxentry{AP\_OPTS\_ETYPE\_NEGOTIATION}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AP_OPTS_ETYPE_NEGOTIATION:AP_OPTS_ETYPE_NEGOTIATION}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AP\_OPTS\_ETYPE\_NEGOTIATION}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AP\_OPTS\_ETYPE\_NEGOTIATION}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AP\_OPTS\_CBT\_FLAG} -\label{\detokenize{appdev/refs/macros/AP_OPTS_CBT_FLAG:ap-opts-cbt-flag}}\label{\detokenize{appdev/refs/macros/AP_OPTS_CBT_FLAG:ap-opts-cbt-flag-data}}\label{\detokenize{appdev/refs/macros/AP_OPTS_CBT_FLAG::doc}}\index{AP\_OPTS\_CBT\_FLAG (built\sphinxhyphen{}in variable)@\spxentry{AP\_OPTS\_CBT\_FLAG}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AP_OPTS_CBT_FLAG:AP_OPTS_CBT_FLAG}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AP\_OPTS\_CBT\_FLAG}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AP\_OPTS\_CBT\_FLAG}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000004 /* include KERB\_AP\_OPTIONS\_CBT */}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AP\_OPTS\_MUTUAL\_REQUIRED} -\label{\detokenize{appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED:ap-opts-mutual-required}}\label{\detokenize{appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED:ap-opts-mutual-required-data}}\label{\detokenize{appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED::doc}}\index{AP\_OPTS\_MUTUAL\_REQUIRED (built\sphinxhyphen{}in variable)@\spxentry{AP\_OPTS\_MUTUAL\_REQUIRED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AP_OPTS_MUTUAL_REQUIRED:AP_OPTS_MUTUAL_REQUIRED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AP\_OPTS\_MUTUAL\_REQUIRED}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Perform a mutual authentication exchange. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AP\_OPTS\_MUTUAL\_REQUIRED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x20000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AP\_OPTS\_RESERVED} -\label{\detokenize{appdev/refs/macros/AP_OPTS_RESERVED:ap-opts-reserved}}\label{\detokenize{appdev/refs/macros/AP_OPTS_RESERVED:ap-opts-reserved-data}}\label{\detokenize{appdev/refs/macros/AP_OPTS_RESERVED::doc}}\index{AP\_OPTS\_RESERVED (built\sphinxhyphen{}in variable)@\spxentry{AP\_OPTS\_RESERVED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AP_OPTS_RESERVED:AP_OPTS_RESERVED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AP\_OPTS\_RESERVED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AP\_OPTS\_RESERVED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x80000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AP\_OPTS\_USE\_SESSION\_KEY} -\label{\detokenize{appdev/refs/macros/AP_OPTS_USE_SESSION_KEY:ap-opts-use-session-key}}\label{\detokenize{appdev/refs/macros/AP_OPTS_USE_SESSION_KEY:ap-opts-use-session-key-data}}\label{\detokenize{appdev/refs/macros/AP_OPTS_USE_SESSION_KEY::doc}}\index{AP\_OPTS\_USE\_SESSION\_KEY (built\sphinxhyphen{}in variable)@\spxentry{AP\_OPTS\_USE\_SESSION\_KEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AP_OPTS_USE_SESSION_KEY:AP_OPTS_USE_SESSION_KEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AP\_OPTS\_USE\_SESSION\_KEY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Use session key. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AP\_OPTS\_USE\_SESSION\_KEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x40000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AP\_OPTS\_USE\_SUBKEY} -\label{\detokenize{appdev/refs/macros/AP_OPTS_USE_SUBKEY:ap-opts-use-subkey}}\label{\detokenize{appdev/refs/macros/AP_OPTS_USE_SUBKEY:ap-opts-use-subkey-data}}\label{\detokenize{appdev/refs/macros/AP_OPTS_USE_SUBKEY::doc}}\index{AP\_OPTS\_USE\_SUBKEY (built\sphinxhyphen{}in variable)@\spxentry{AP\_OPTS\_USE\_SUBKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AP_OPTS_USE_SUBKEY:AP_OPTS_USE_SUBKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AP\_OPTS\_USE\_SUBKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Generate a subsession key from the current session key obtained from the credentials. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AP\_OPTS\_USE\_SUBKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{AP\_OPTS\_WIRE\_MASK} -\label{\detokenize{appdev/refs/macros/AP_OPTS_WIRE_MASK:ap-opts-wire-mask}}\label{\detokenize{appdev/refs/macros/AP_OPTS_WIRE_MASK:ap-opts-wire-mask-data}}\label{\detokenize{appdev/refs/macros/AP_OPTS_WIRE_MASK::doc}}\index{AP\_OPTS\_WIRE\_MASK (built\sphinxhyphen{}in variable)@\spxentry{AP\_OPTS\_WIRE\_MASK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/AP_OPTS_WIRE_MASK:AP_OPTS_WIRE_MASK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{AP\_OPTS\_WIRE\_MASK}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{AP\_OPTS\_WIRE\_MASK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0xfffffff0}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_CMAC\_CAMELLIA128} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128:cksumtype-cmac-camellia128}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128:cksumtype-cmac-camellia128-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128::doc}}\index{CKSUMTYPE\_CMAC\_CAMELLIA128 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_CMAC\_CAMELLIA128}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA128:CKSUMTYPE_CMAC_CAMELLIA128}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_CMAC\_CAMELLIA128}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6803. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_CMAC\_CAMELLIA128}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0011}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_CMAC\_CAMELLIA256} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256:cksumtype-cmac-camellia256}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256:cksumtype-cmac-camellia256-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256::doc}}\index{CKSUMTYPE\_CMAC\_CAMELLIA256 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_CMAC\_CAMELLIA256}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CMAC_CAMELLIA256:CKSUMTYPE_CMAC_CAMELLIA256}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_CMAC\_CAMELLIA256}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6803. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_CMAC\_CAMELLIA256}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0012}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_CRC32} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CRC32:cksumtype-crc32}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CRC32:cksumtype-crc32-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CRC32::doc}}\index{CKSUMTYPE\_CRC32 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_CRC32}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_CRC32:CKSUMTYPE_CRC32}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_CRC32}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_CRC32}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_DESCBC} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_DESCBC:cksumtype-descbc}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_DESCBC:cksumtype-descbc-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_DESCBC::doc}}\index{CKSUMTYPE\_DESCBC (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_DESCBC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_DESCBC:CKSUMTYPE_DESCBC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_DESCBC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_DESCBC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0004}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_HMAC\_MD5\_ARCFOUR} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR:cksumtype-hmac-md5-arcfour}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR:cksumtype-hmac-md5-arcfour-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR::doc}}\index{CKSUMTYPE\_HMAC\_MD5\_ARCFOUR (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_HMAC\_MD5\_ARCFOUR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_MD5_ARCFOUR:CKSUMTYPE_HMAC_MD5_ARCFOUR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_HMAC\_MD5\_ARCFOUR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 4757. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_HMAC\_MD5\_ARCFOUR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\sphinxhyphen{}138}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_HMAC\_SHA1\_96\_AES128} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128:cksumtype-hmac-sha1-96-aes128}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128:cksumtype-hmac-sha1-96-aes128-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128::doc}}\index{CKSUMTYPE\_HMAC\_SHA1\_96\_AES128 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_HMAC\_SHA1\_96\_AES128}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES128:CKSUMTYPE_HMAC_SHA1_96_AES128}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA1\_96\_AES128}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 3962. - -\sphinxAtStartPar -Used with ENCTYPE\_AES128\_CTS\_HMAC\_SHA1\_96 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA1\_96\_AES128}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000f}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_HMAC\_SHA1\_96\_AES256} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256:cksumtype-hmac-sha1-96-aes256}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256:cksumtype-hmac-sha1-96-aes256-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256::doc}}\index{CKSUMTYPE\_HMAC\_SHA1\_96\_AES256 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_HMAC\_SHA1\_96\_AES256}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_96_AES256:CKSUMTYPE_HMAC_SHA1_96_AES256}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA1\_96\_AES256}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 3962. - -\sphinxAtStartPar -Used with ENCTYPE\_AES256\_CTS\_HMAC\_SHA1\_96 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA1\_96\_AES256}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0010}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_HMAC\_SHA256\_128\_AES128} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128:cksumtype-hmac-sha256-128-aes128}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128:cksumtype-hmac-sha256-128-aes128-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128::doc}}\index{CKSUMTYPE\_HMAC\_SHA256\_128\_AES128 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_HMAC\_SHA256\_128\_AES128}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA256_128_AES128:CKSUMTYPE_HMAC_SHA256_128_AES128}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA256\_128\_AES128}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 8009. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA256\_128\_AES128}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0013}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_HMAC\_SHA384\_192\_AES256} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256:cksumtype-hmac-sha384-192-aes256}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256:cksumtype-hmac-sha384-192-aes256-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256::doc}}\index{CKSUMTYPE\_HMAC\_SHA384\_192\_AES256 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_HMAC\_SHA384\_192\_AES256}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA384_192_AES256:CKSUMTYPE_HMAC_SHA384_192_AES256}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA384\_192\_AES256}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 8009. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA384\_192\_AES256}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0014}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_HMAC\_SHA1\_DES3} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3:cksumtype-hmac-sha1-des3}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3:cksumtype-hmac-sha1-des3-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3::doc}}\index{CKSUMTYPE\_HMAC\_SHA1\_DES3 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_HMAC\_SHA1\_DES3}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_HMAC_SHA1_DES3:CKSUMTYPE_HMAC_SHA1_DES3}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA1\_DES3}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_HMAC\_SHA1\_DES3}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000c}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_MD5\_HMAC\_ARCFOUR} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR:cksumtype-md5-hmac-arcfour}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR:cksumtype-md5-hmac-arcfour-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR::doc}}\index{CKSUMTYPE\_MD5\_HMAC\_ARCFOUR (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_MD5\_HMAC\_ARCFOUR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_MD5_HMAC_ARCFOUR:CKSUMTYPE_MD5_HMAC_ARCFOUR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_MD5\_HMAC\_ARCFOUR}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_MD5\_HMAC\_ARCFOUR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\sphinxhyphen{}137 /* Microsoft netlogon */}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_NIST\_SHA} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_NIST_SHA:cksumtype-nist-sha}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_NIST_SHA:cksumtype-nist-sha-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_NIST_SHA::doc}}\index{CKSUMTYPE\_NIST\_SHA (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_NIST\_SHA}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_NIST_SHA:CKSUMTYPE_NIST_SHA}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_NIST\_SHA}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_NIST\_SHA}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0009}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_RSA\_MD4} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD4:cksumtype-rsa-md4}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD4:cksumtype-rsa-md4-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD4::doc}}\index{CKSUMTYPE\_RSA\_MD4 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_RSA\_MD4}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD4:CKSUMTYPE_RSA_MD4}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_RSA\_MD4}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_RSA\_MD4}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_RSA\_MD4\_DES} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES:cksumtype-rsa-md4-des}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES:cksumtype-rsa-md4-des-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES::doc}}\index{CKSUMTYPE\_RSA\_MD4\_DES (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_RSA\_MD4\_DES}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD4_DES:CKSUMTYPE_RSA_MD4_DES}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_RSA\_MD4\_DES}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_RSA\_MD4\_DES}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0003}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_RSA\_MD5} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD5:cksumtype-rsa-md5}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD5:cksumtype-rsa-md5-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD5::doc}}\index{CKSUMTYPE\_RSA\_MD5 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_RSA\_MD5}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD5:CKSUMTYPE_RSA_MD5}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_RSA\_MD5}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_RSA\_MD5}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0007}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_RSA\_MD5\_DES} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES:cksumtype-rsa-md5-des}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES:cksumtype-rsa-md5-des-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES::doc}}\index{CKSUMTYPE\_RSA\_MD5\_DES (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_RSA\_MD5\_DES}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_RSA_MD5_DES:CKSUMTYPE_RSA_MD5_DES}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_RSA\_MD5\_DES}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_RSA\_MD5\_DES}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0008}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{CKSUMTYPE\_SHA1} -\label{\detokenize{appdev/refs/macros/CKSUMTYPE_SHA1:cksumtype-sha1}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_SHA1:cksumtype-sha1-data}}\label{\detokenize{appdev/refs/macros/CKSUMTYPE_SHA1::doc}}\index{CKSUMTYPE\_SHA1 (built\sphinxhyphen{}in variable)@\spxentry{CKSUMTYPE\_SHA1}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/CKSUMTYPE_SHA1:CKSUMTYPE_SHA1}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{CKSUMTYPE\_SHA1}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 3961. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{CKSUMTYPE\_SHA1}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000e}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_AES128\_CTS\_HMAC\_SHA1\_96} -\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96:enctype-aes128-cts-hmac-sha1-96}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96:enctype-aes128-cts-hmac-sha1-96-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96::doc}}\index{ENCTYPE\_AES128\_CTS\_HMAC\_SHA1\_96 (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_AES128\_CTS\_HMAC\_SHA1\_96}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA1_96:ENCTYPE_AES128_CTS_HMAC_SHA1_96}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_AES128\_CTS\_HMAC\_SHA1\_96}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 3962. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_AES128\_CTS\_HMAC\_SHA1\_96}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0011}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_AES128\_CTS\_HMAC\_SHA256\_128} -\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128:enctype-aes128-cts-hmac-sha256-128}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128:enctype-aes128-cts-hmac-sha256-128-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128::doc}}\index{ENCTYPE\_AES128\_CTS\_HMAC\_SHA256\_128 (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_AES128\_CTS\_HMAC\_SHA256\_128}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_AES128_CTS_HMAC_SHA256_128:ENCTYPE_AES128_CTS_HMAC_SHA256_128}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_AES128\_CTS\_HMAC\_SHA256\_128}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 8009. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_AES128\_CTS\_HMAC\_SHA256\_128}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0013}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_AES256\_CTS\_HMAC\_SHA1\_96} -\label{\detokenize{appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96:enctype-aes256-cts-hmac-sha1-96}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96:enctype-aes256-cts-hmac-sha1-96-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96::doc}}\index{ENCTYPE\_AES256\_CTS\_HMAC\_SHA1\_96 (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_AES256\_CTS\_HMAC\_SHA1\_96}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA1_96:ENCTYPE_AES256_CTS_HMAC_SHA1_96}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_AES256\_CTS\_HMAC\_SHA1\_96}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 3962. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_AES256\_CTS\_HMAC\_SHA1\_96}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0012}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_AES256\_CTS\_HMAC\_SHA384\_192} -\label{\detokenize{appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192:enctype-aes256-cts-hmac-sha384-192}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192:enctype-aes256-cts-hmac-sha384-192-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192::doc}}\index{ENCTYPE\_AES256\_CTS\_HMAC\_SHA384\_192 (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_AES256\_CTS\_HMAC\_SHA384\_192}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_AES256_CTS_HMAC_SHA384_192:ENCTYPE_AES256_CTS_HMAC_SHA384_192}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_AES256\_CTS\_HMAC\_SHA384\_192}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 8009. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_AES256\_CTS\_HMAC\_SHA384\_192}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0014}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_ARCFOUR\_HMAC} -\label{\detokenize{appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC:enctype-arcfour-hmac}}\label{\detokenize{appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC:enctype-arcfour-hmac-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC::doc}}\index{ENCTYPE\_ARCFOUR\_HMAC (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_ARCFOUR\_HMAC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC:ENCTYPE_ARCFOUR_HMAC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_ARCFOUR\_HMAC}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 4757. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_ARCFOUR\_HMAC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0017}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_ARCFOUR\_HMAC\_EXP} -\label{\detokenize{appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP:enctype-arcfour-hmac-exp}}\label{\detokenize{appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP:enctype-arcfour-hmac-exp-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP::doc}}\index{ENCTYPE\_ARCFOUR\_HMAC\_EXP (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_ARCFOUR\_HMAC\_EXP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_ARCFOUR_HMAC_EXP:ENCTYPE_ARCFOUR_HMAC_EXP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_ARCFOUR\_HMAC\_EXP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 4757. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_ARCFOUR\_HMAC\_EXP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0018}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_CAMELLIA128\_CTS\_CMAC} -\label{\detokenize{appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC:enctype-camellia128-cts-cmac}}\label{\detokenize{appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC:enctype-camellia128-cts-cmac-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC::doc}}\index{ENCTYPE\_CAMELLIA128\_CTS\_CMAC (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_CAMELLIA128\_CTS\_CMAC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_CAMELLIA128_CTS_CMAC:ENCTYPE_CAMELLIA128_CTS_CMAC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_CAMELLIA128\_CTS\_CMAC}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6803. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_CAMELLIA128\_CTS\_CMAC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0019}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_CAMELLIA256\_CTS\_CMAC} -\label{\detokenize{appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC:enctype-camellia256-cts-cmac}}\label{\detokenize{appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC:enctype-camellia256-cts-cmac-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC::doc}}\index{ENCTYPE\_CAMELLIA256\_CTS\_CMAC (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_CAMELLIA256\_CTS\_CMAC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_CAMELLIA256_CTS_CMAC:ENCTYPE_CAMELLIA256_CTS_CMAC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_CAMELLIA256\_CTS\_CMAC}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6803. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_CAMELLIA256\_CTS\_CMAC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x001a}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES3\_CBC\_ENV} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_ENV:enctype-des3-cbc-env}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_ENV:enctype-des3-cbc-env-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_ENV::doc}}\index{ENCTYPE\_DES3\_CBC\_ENV (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES3\_CBC\_ENV}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_ENV:ENCTYPE_DES3_CBC_ENV}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES3\_CBC\_ENV}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -DES\sphinxhyphen{}3 cbc mode, CMS enveloped data. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES3\_CBC\_ENV}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000f}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES3\_CBC\_RAW} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_RAW:enctype-des3-cbc-raw}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_RAW:enctype-des3-cbc-raw-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_RAW::doc}}\index{ENCTYPE\_DES3\_CBC\_RAW (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES3\_CBC\_RAW}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_RAW:ENCTYPE_DES3_CBC_RAW}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES3\_CBC\_RAW}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES3\_CBC\_RAW}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0006}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES3\_CBC\_SHA} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_SHA:enctype-des3-cbc-sha}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_SHA:enctype-des3-cbc-sha-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_SHA::doc}}\index{ENCTYPE\_DES3\_CBC\_SHA (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES3\_CBC\_SHA}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_SHA:ENCTYPE_DES3_CBC_SHA}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES3\_CBC\_SHA}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES3\_CBC\_SHA}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0005}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES3\_CBC\_SHA1} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1:enctype-des3-cbc-sha1}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1:enctype-des3-cbc-sha1-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1::doc}}\index{ENCTYPE\_DES3\_CBC\_SHA1 (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES3\_CBC\_SHA1}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES3_CBC_SHA1:ENCTYPE_DES3_CBC_SHA1}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES3\_CBC\_SHA1}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES3\_CBC\_SHA1}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0010}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES\_CBC\_CRC} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_CRC:enctype-des-cbc-crc}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_CRC:enctype-des-cbc-crc-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_CRC::doc}}\index{ENCTYPE\_DES\_CBC\_CRC (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES\_CBC\_CRC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_CRC:ENCTYPE_DES_CBC_CRC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES\_CBC\_CRC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES\_CBC\_CRC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES\_CBC\_MD4} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_MD4:enctype-des-cbc-md4}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_MD4:enctype-des-cbc-md4-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_MD4::doc}}\index{ENCTYPE\_DES\_CBC\_MD4 (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES\_CBC\_MD4}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_MD4:ENCTYPE_DES_CBC_MD4}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES\_CBC\_MD4}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES\_CBC\_MD4}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES\_CBC\_MD5} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_MD5:enctype-des-cbc-md5}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_MD5:enctype-des-cbc-md5-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_MD5::doc}}\index{ENCTYPE\_DES\_CBC\_MD5 (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES\_CBC\_MD5}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_MD5:ENCTYPE_DES_CBC_MD5}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES\_CBC\_MD5}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES\_CBC\_MD5}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0003}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES\_CBC\_RAW} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_RAW:enctype-des-cbc-raw}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_RAW:enctype-des-cbc-raw-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_RAW::doc}}\index{ENCTYPE\_DES\_CBC\_RAW (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES\_CBC\_RAW}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_CBC_RAW:ENCTYPE_DES_CBC_RAW}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES\_CBC\_RAW}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES\_CBC\_RAW}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0004}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DES\_HMAC\_SHA1} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1:enctype-des-hmac-sha1}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1:enctype-des-hmac-sha1-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1::doc}}\index{ENCTYPE\_DES\_HMAC\_SHA1 (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DES\_HMAC\_SHA1}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DES_HMAC_SHA1:ENCTYPE_DES_HMAC_SHA1}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DES\_HMAC\_SHA1}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DES\_HMAC\_SHA1}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0008}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_DSA\_SHA1\_CMS} -\label{\detokenize{appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS:enctype-dsa-sha1-cms}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS:enctype-dsa-sha1-cms-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS::doc}}\index{ENCTYPE\_DSA\_SHA1\_CMS (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_DSA\_SHA1\_CMS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_DSA_SHA1_CMS:ENCTYPE_DSA_SHA1_CMS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_DSA\_SHA1\_CMS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -DSA with SHA1, CMS signature. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_DSA\_SHA1\_CMS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0009}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_MD5\_RSA\_CMS} -\label{\detokenize{appdev/refs/macros/ENCTYPE_MD5_RSA_CMS:enctype-md5-rsa-cms}}\label{\detokenize{appdev/refs/macros/ENCTYPE_MD5_RSA_CMS:enctype-md5-rsa-cms-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_MD5_RSA_CMS::doc}}\index{ENCTYPE\_MD5\_RSA\_CMS (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_MD5\_RSA\_CMS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_MD5_RSA_CMS:ENCTYPE_MD5_RSA_CMS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_MD5\_RSA\_CMS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -MD5 with RSA, CMS signature. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_MD5\_RSA\_CMS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000a}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_NULL} -\label{\detokenize{appdev/refs/macros/ENCTYPE_NULL:enctype-null}}\label{\detokenize{appdev/refs/macros/ENCTYPE_NULL:enctype-null-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_NULL::doc}}\index{ENCTYPE\_NULL (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_NULL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_NULL:ENCTYPE_NULL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_NULL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_NULL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_RC2\_CBC\_ENV} -\label{\detokenize{appdev/refs/macros/ENCTYPE_RC2_CBC_ENV:enctype-rc2-cbc-env}}\label{\detokenize{appdev/refs/macros/ENCTYPE_RC2_CBC_ENV:enctype-rc2-cbc-env-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_RC2_CBC_ENV::doc}}\index{ENCTYPE\_RC2\_CBC\_ENV (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_RC2\_CBC\_ENV}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_RC2_CBC_ENV:ENCTYPE_RC2_CBC_ENV}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_RC2\_CBC\_ENV}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RC2 cbc mode, CMS enveloped data. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_RC2\_CBC\_ENV}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000c}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_RSA\_ENV} -\label{\detokenize{appdev/refs/macros/ENCTYPE_RSA_ENV:enctype-rsa-env}}\label{\detokenize{appdev/refs/macros/ENCTYPE_RSA_ENV:enctype-rsa-env-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_RSA_ENV::doc}}\index{ENCTYPE\_RSA\_ENV (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_RSA\_ENV}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_RSA_ENV:ENCTYPE_RSA_ENV}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_RSA\_ENV}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RSA encryption, CMS enveloped data. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_RSA\_ENV}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000d}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_RSA\_ES\_OAEP\_ENV} -\label{\detokenize{appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV:enctype-rsa-es-oaep-env}}\label{\detokenize{appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV:enctype-rsa-es-oaep-env-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV::doc}}\index{ENCTYPE\_RSA\_ES\_OAEP\_ENV (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_RSA\_ES\_OAEP\_ENV}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_RSA_ES_OAEP_ENV:ENCTYPE_RSA_ES_OAEP_ENV}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_RSA\_ES\_OAEP\_ENV}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RSA w/OEAP encryption, CMS enveloped data. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_RSA\_ES\_OAEP\_ENV}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000e}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_SHA1\_RSA\_CMS} -\label{\detokenize{appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS:enctype-sha1-rsa-cms}}\label{\detokenize{appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS:enctype-sha1-rsa-cms-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS::doc}}\index{ENCTYPE\_SHA1\_RSA\_CMS (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_SHA1\_RSA\_CMS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_SHA1_RSA_CMS:ENCTYPE_SHA1_RSA_CMS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_SHA1\_RSA\_CMS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -SHA1 with RSA, CMS signature. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_SHA1\_RSA\_CMS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x000b}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{ENCTYPE\_UNKNOWN} -\label{\detokenize{appdev/refs/macros/ENCTYPE_UNKNOWN:enctype-unknown}}\label{\detokenize{appdev/refs/macros/ENCTYPE_UNKNOWN:enctype-unknown-data}}\label{\detokenize{appdev/refs/macros/ENCTYPE_UNKNOWN::doc}}\index{ENCTYPE\_UNKNOWN (built\sphinxhyphen{}in variable)@\spxentry{ENCTYPE\_UNKNOWN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/ENCTYPE_UNKNOWN:ENCTYPE_UNKNOWN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{ENCTYPE\_UNKNOWN}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{ENCTYPE\_UNKNOWN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x01ff}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_ALLOW\_POSTDATE} -\label{\detokenize{appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE:kdc-opt-allow-postdate}}\label{\detokenize{appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE:kdc-opt-allow-postdate-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE::doc}}\index{KDC\_OPT\_ALLOW\_POSTDATE (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_ALLOW\_POSTDATE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_ALLOW_POSTDATE:KDC_OPT_ALLOW_POSTDATE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_ALLOW\_POSTDATE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_ALLOW\_POSTDATE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x04000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_CANONICALIZE} -\label{\detokenize{appdev/refs/macros/KDC_OPT_CANONICALIZE:kdc-opt-canonicalize}}\label{\detokenize{appdev/refs/macros/KDC_OPT_CANONICALIZE:kdc-opt-canonicalize-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_CANONICALIZE::doc}}\index{KDC\_OPT\_CANONICALIZE (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_CANONICALIZE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_CANONICALIZE:KDC_OPT_CANONICALIZE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_CANONICALIZE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_CANONICALIZE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00010000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_CNAME\_IN\_ADDL\_TKT} -\label{\detokenize{appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT:kdc-opt-cname-in-addl-tkt}}\label{\detokenize{appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT:kdc-opt-cname-in-addl-tkt-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT::doc}}\index{KDC\_OPT\_CNAME\_IN\_ADDL\_TKT (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_CNAME\_IN\_ADDL\_TKT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_CNAME_IN_ADDL_TKT:KDC_OPT_CNAME_IN_ADDL_TKT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_CNAME\_IN\_ADDL\_TKT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_CNAME\_IN\_ADDL\_TKT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00020000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_DISABLE\_TRANSITED\_CHECK} -\label{\detokenize{appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK:kdc-opt-disable-transited-check}}\label{\detokenize{appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK:kdc-opt-disable-transited-check-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK::doc}}\index{KDC\_OPT\_DISABLE\_TRANSITED\_CHECK (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_DISABLE\_TRANSITED\_CHECK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_DISABLE_TRANSITED_CHECK:KDC_OPT_DISABLE_TRANSITED_CHECK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_DISABLE\_TRANSITED\_CHECK}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_DISABLE\_TRANSITED\_CHECK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000020}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_ENC\_TKT\_IN\_SKEY} -\label{\detokenize{appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY:kdc-opt-enc-tkt-in-skey}}\label{\detokenize{appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY:kdc-opt-enc-tkt-in-skey-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY::doc}}\index{KDC\_OPT\_ENC\_TKT\_IN\_SKEY (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_ENC\_TKT\_IN\_SKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_ENC_TKT_IN_SKEY:KDC_OPT_ENC_TKT_IN_SKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_ENC\_TKT\_IN\_SKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_ENC\_TKT\_IN\_SKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000008}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_FORWARDABLE} -\label{\detokenize{appdev/refs/macros/KDC_OPT_FORWARDABLE:kdc-opt-forwardable}}\label{\detokenize{appdev/refs/macros/KDC_OPT_FORWARDABLE:kdc-opt-forwardable-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_FORWARDABLE::doc}}\index{KDC\_OPT\_FORWARDABLE (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_FORWARDABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_FORWARDABLE:KDC_OPT_FORWARDABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_FORWARDABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_FORWARDABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x40000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_FORWARDED} -\label{\detokenize{appdev/refs/macros/KDC_OPT_FORWARDED:kdc-opt-forwarded}}\label{\detokenize{appdev/refs/macros/KDC_OPT_FORWARDED:kdc-opt-forwarded-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_FORWARDED::doc}}\index{KDC\_OPT\_FORWARDED (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_FORWARDED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_FORWARDED:KDC_OPT_FORWARDED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_FORWARDED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_FORWARDED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x20000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_POSTDATED} -\label{\detokenize{appdev/refs/macros/KDC_OPT_POSTDATED:kdc-opt-postdated}}\label{\detokenize{appdev/refs/macros/KDC_OPT_POSTDATED:kdc-opt-postdated-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_POSTDATED::doc}}\index{KDC\_OPT\_POSTDATED (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_POSTDATED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_POSTDATED:KDC_OPT_POSTDATED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_POSTDATED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_POSTDATED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x02000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_PROXIABLE} -\label{\detokenize{appdev/refs/macros/KDC_OPT_PROXIABLE:kdc-opt-proxiable}}\label{\detokenize{appdev/refs/macros/KDC_OPT_PROXIABLE:kdc-opt-proxiable-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_PROXIABLE::doc}}\index{KDC\_OPT\_PROXIABLE (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_PROXIABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_PROXIABLE:KDC_OPT_PROXIABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_PROXIABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_PROXIABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x10000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_PROXY} -\label{\detokenize{appdev/refs/macros/KDC_OPT_PROXY:kdc-opt-proxy}}\label{\detokenize{appdev/refs/macros/KDC_OPT_PROXY:kdc-opt-proxy-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_PROXY::doc}}\index{KDC\_OPT\_PROXY (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_PROXY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_PROXY:KDC_OPT_PROXY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_PROXY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_PROXY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x08000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_RENEW} -\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEW:kdc-opt-renew}}\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEW:kdc-opt-renew-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEW::doc}}\index{KDC\_OPT\_RENEW (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_RENEW}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEW:KDC_OPT_RENEW}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_RENEW}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_RENEW}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_RENEWABLE} -\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEWABLE:kdc-opt-renewable}}\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEWABLE:kdc-opt-renewable-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEWABLE::doc}}\index{KDC\_OPT\_RENEWABLE (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_RENEWABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEWABLE:KDC_OPT_RENEWABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_RENEWABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_RENEWABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00800000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_RENEWABLE\_OK} -\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEWABLE_OK:kdc-opt-renewable-ok}}\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEWABLE_OK:kdc-opt-renewable-ok-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEWABLE_OK::doc}}\index{KDC\_OPT\_RENEWABLE\_OK (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_RENEWABLE\_OK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_RENEWABLE_OK:KDC_OPT_RENEWABLE_OK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_RENEWABLE\_OK}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_RENEWABLE\_OK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000010}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_REQUEST\_ANONYMOUS} -\label{\detokenize{appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS:kdc-opt-request-anonymous}}\label{\detokenize{appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS:kdc-opt-request-anonymous-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS::doc}}\index{KDC\_OPT\_REQUEST\_ANONYMOUS (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_REQUEST\_ANONYMOUS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_REQUEST_ANONYMOUS:KDC_OPT_REQUEST_ANONYMOUS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_REQUEST\_ANONYMOUS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_REQUEST\_ANONYMOUS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00008000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_OPT\_VALIDATE} -\label{\detokenize{appdev/refs/macros/KDC_OPT_VALIDATE:kdc-opt-validate}}\label{\detokenize{appdev/refs/macros/KDC_OPT_VALIDATE:kdc-opt-validate-data}}\label{\detokenize{appdev/refs/macros/KDC_OPT_VALIDATE::doc}}\index{KDC\_OPT\_VALIDATE (built\sphinxhyphen{}in variable)@\spxentry{KDC\_OPT\_VALIDATE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_OPT_VALIDATE:KDC_OPT_VALIDATE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_OPT\_VALIDATE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_OPT\_VALIDATE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KDC\_TKT\_COMMON\_MASK} -\label{\detokenize{appdev/refs/macros/KDC_TKT_COMMON_MASK:kdc-tkt-common-mask}}\label{\detokenize{appdev/refs/macros/KDC_TKT_COMMON_MASK:kdc-tkt-common-mask-data}}\label{\detokenize{appdev/refs/macros/KDC_TKT_COMMON_MASK::doc}}\index{KDC\_TKT\_COMMON\_MASK (built\sphinxhyphen{}in variable)@\spxentry{KDC\_TKT\_COMMON\_MASK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KDC_TKT_COMMON_MASK:KDC_TKT_COMMON_MASK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KDC\_TKT\_COMMON\_MASK}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KDC\_TKT\_COMMON\_MASK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x54800000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_ALTAUTH\_ATT\_CHALLENGE\_RESPONSE} -\label{\detokenize{appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE:krb5-altauth-att-challenge-response}}\label{\detokenize{appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE:krb5-altauth-att-challenge-response-data}}\label{\detokenize{appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE::doc}}\index{KRB5\_ALTAUTH\_ATT\_CHALLENGE\_RESPONSE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_ALTAUTH\_ATT\_CHALLENGE\_RESPONSE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE:KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_ALTAUTH\_ATT\_CHALLENGE\_RESPONSE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -alternate authentication types - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_ALTAUTH\_ATT\_CHALLENGE\_RESPONSE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{64}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_ANONYMOUS\_PRINCSTR} -\label{\detokenize{appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR:krb5-anonymous-princstr}}\label{\detokenize{appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR:krb5-anonymous-princstr-data}}\label{\detokenize{appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR::doc}}\index{KRB5\_ANONYMOUS\_PRINCSTR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_ANONYMOUS\_PRINCSTR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_ANONYMOUS_PRINCSTR:KRB5_ANONYMOUS_PRINCSTR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_ANONYMOUS\_PRINCSTR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Anonymous principal name. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_ANONYMOUS\_PRINCSTR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{"ANONYMOUS"}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_ANONYMOUS\_REALMSTR} -\label{\detokenize{appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR:krb5-anonymous-realmstr}}\label{\detokenize{appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR:krb5-anonymous-realmstr-data}}\label{\detokenize{appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR::doc}}\index{KRB5\_ANONYMOUS\_REALMSTR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_ANONYMOUS\_REALMSTR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_ANONYMOUS_REALMSTR:KRB5_ANONYMOUS_REALMSTR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_ANONYMOUS\_REALMSTR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Anonymous realm. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_ANONYMOUS\_REALMSTR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{"WELLKNOWN:ANONYMOUS"}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AP\_REP} -\label{\detokenize{appdev/refs/macros/KRB5_AP_REP:krb5-ap-rep}}\label{\detokenize{appdev/refs/macros/KRB5_AP_REP:krb5-ap-rep-data}}\label{\detokenize{appdev/refs/macros/KRB5_AP_REP::doc}}\index{KRB5\_AP\_REP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AP\_REP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AP_REP:KRB5_AP_REP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AP\_REP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Response to mutual AP request. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AP\_REP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)15)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AP\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_AP_REQ:krb5-ap-req}}\label{\detokenize{appdev/refs/macros/KRB5_AP_REQ:krb5-ap-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_AP_REQ::doc}}\index{KRB5\_AP\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AP\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AP_REQ:KRB5_AP_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AP\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Auth req to application server. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AP\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)14)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AS\_REP} -\label{\detokenize{appdev/refs/macros/KRB5_AS_REP:krb5-as-rep}}\label{\detokenize{appdev/refs/macros/KRB5_AS_REP:krb5-as-rep-data}}\label{\detokenize{appdev/refs/macros/KRB5_AS_REP::doc}}\index{KRB5\_AS\_REP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AS\_REP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AS_REP:KRB5_AS_REP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AS\_REP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Response to AS request. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AS\_REP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)11)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AS\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_AS_REQ:krb5-as-req}}\label{\detokenize{appdev/refs/macros/KRB5_AS_REQ:krb5-as-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_AS_REQ::doc}}\index{KRB5\_AS\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AS\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AS_REQ:KRB5_AS_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AS\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Initial authentication request. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AS\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)10)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_AND\_OR} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AND_OR:krb5-authdata-and-or}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AND_OR:krb5-authdata-and-or-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AND_OR::doc}}\index{KRB5\_AUTHDATA\_AND\_OR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_AND\_OR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AND_OR:KRB5_AUTHDATA_AND_OR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_AND\_OR}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_AND\_OR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{5}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_AP\_OPTIONS} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS:krb5-authdata-ap-options}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS:krb5-authdata-ap-options-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS::doc}}\index{KRB5\_AUTHDATA\_AP\_OPTIONS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_AP\_OPTIONS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AP_OPTIONS:KRB5_AUTHDATA_AP_OPTIONS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_AP\_OPTIONS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_AP\_OPTIONS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{143}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_AUTH\_INDICATOR} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR:krb5-authdata-auth-indicator}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR:krb5-authdata-auth-indicator-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR::doc}}\index{KRB5\_AUTHDATA\_AUTH\_INDICATOR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_AUTH\_INDICATOR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_AUTH_INDICATOR:KRB5_AUTHDATA_AUTH_INDICATOR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_AUTH\_INDICATOR}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_AUTH\_INDICATOR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{97}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_CAMMAC} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_CAMMAC:krb5-authdata-cammac}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_CAMMAC:krb5-authdata-cammac-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_CAMMAC::doc}}\index{KRB5\_AUTHDATA\_CAMMAC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_CAMMAC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_CAMMAC:KRB5_AUTHDATA_CAMMAC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_CAMMAC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_CAMMAC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{96}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_ETYPE\_NEGOTIATION} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION:krb5-authdata-etype-negotiation}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION:krb5-authdata-etype-negotiation-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION::doc}}\index{KRB5\_AUTHDATA\_ETYPE\_NEGOTIATION (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_ETYPE\_NEGOTIATION}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_ETYPE_NEGOTIATION:KRB5_AUTHDATA_ETYPE_NEGOTIATION}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_ETYPE\_NEGOTIATION}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 4537. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_ETYPE\_NEGOTIATION}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{129}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_FX\_ARMOR} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR:krb5-authdata-fx-armor}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR:krb5-authdata-fx-armor-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR::doc}}\index{KRB5\_AUTHDATA\_FX\_ARMOR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_FX\_ARMOR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_FX_ARMOR:KRB5_AUTHDATA_FX_ARMOR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_FX\_ARMOR}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_FX\_ARMOR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{71}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_IF\_RELEVANT} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT:krb5-authdata-if-relevant}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT:krb5-authdata-if-relevant-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT::doc}}\index{KRB5\_AUTHDATA\_IF\_RELEVANT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_IF\_RELEVANT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_IF_RELEVANT:KRB5_AUTHDATA_IF_RELEVANT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_IF\_RELEVANT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_IF\_RELEVANT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_INITIAL\_VERIFIED\_CAS} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS:krb5-authdata-initial-verified-cas}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS:krb5-authdata-initial-verified-cas-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS::doc}}\index{KRB5\_AUTHDATA\_INITIAL\_VERIFIED\_CAS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_INITIAL\_VERIFIED\_CAS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_INITIAL_VERIFIED_CAS:KRB5_AUTHDATA_INITIAL_VERIFIED_CAS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_INITIAL\_VERIFIED\_CAS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_INITIAL\_VERIFIED\_CAS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{9}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_KDC\_ISSUED} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED:krb5-authdata-kdc-issued}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED:krb5-authdata-kdc-issued-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED::doc}}\index{KRB5\_AUTHDATA\_KDC\_ISSUED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_KDC\_ISSUED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_KDC_ISSUED:KRB5_AUTHDATA_KDC_ISSUED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_KDC\_ISSUED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_KDC\_ISSUED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_MANDATORY\_FOR\_KDC} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC:krb5-authdata-mandatory-for-kdc}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC:krb5-authdata-mandatory-for-kdc-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC::doc}}\index{KRB5\_AUTHDATA\_MANDATORY\_FOR\_KDC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_MANDATORY\_FOR\_KDC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_MANDATORY_FOR_KDC:KRB5_AUTHDATA_MANDATORY_FOR_KDC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_MANDATORY\_FOR\_KDC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_MANDATORY\_FOR\_KDC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{8}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_OSF\_DCE} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE:krb5-authdata-osf-dce}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE:krb5-authdata-osf-dce-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE::doc}}\index{KRB5\_AUTHDATA\_OSF\_DCE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_OSF\_DCE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_OSF_DCE:KRB5_AUTHDATA_OSF_DCE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_OSF\_DCE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_OSF\_DCE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{64}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_SESAME} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_SESAME:krb5-authdata-sesame}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_SESAME:krb5-authdata-sesame-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_SESAME::doc}}\index{KRB5\_AUTHDATA\_SESAME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_SESAME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_SESAME:KRB5_AUTHDATA_SESAME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_SESAME}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_SESAME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{65}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_SIGNTICKET} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET:krb5-authdata-signticket}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET:krb5-authdata-signticket-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET::doc}}\index{KRB5\_AUTHDATA\_SIGNTICKET (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_SIGNTICKET}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_SIGNTICKET:KRB5_AUTHDATA_SIGNTICKET}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_SIGNTICKET}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_SIGNTICKET}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{512}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTHDATA\_WIN2K\_PAC} -\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC:krb5-authdata-win2k-pac}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC:krb5-authdata-win2k-pac-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC::doc}}\index{KRB5\_AUTHDATA\_WIN2K\_PAC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTHDATA\_WIN2K\_PAC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTHDATA_WIN2K_PAC:KRB5_AUTHDATA_WIN2K_PAC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTHDATA\_WIN2K\_PAC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTHDATA\_WIN2K\_PAC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{128}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE:krb5-auth-context-do-sequence}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE:krb5-auth-context-do-sequence-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE::doc}}\index{KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_SEQUENCE:KRB5_AUTH_CONTEXT_DO_SEQUENCE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Prevent replays with sequence numbers. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000004}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_DO\_TIME} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME:krb5-auth-context-do-time}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME:krb5-auth-context-do-time-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME::doc}}\index{KRB5\_AUTH\_CONTEXT\_DO\_TIME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_DO\_TIME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_DO_TIME:KRB5_AUTH_CONTEXT_DO_TIME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_DO\_TIME}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Prevent replays with timestamps and replay cache. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_DO\_TIME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_ADDR} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR:krb5-auth-context-generate-local-addr}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR:krb5-auth-context-generate-local-addr-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR::doc}}\index{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_ADDR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_ADDR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR:KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_ADDR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Generate the local network address. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_ADDR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_FULL\_ADDR} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR:krb5-auth-context-generate-local-full-addr}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR:krb5-auth-context-generate-local-full-addr-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR::doc}}\index{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_FULL\_ADDR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_FULL\_ADDR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR:KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_FULL\_ADDR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Generate the local network address and the local port. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_FULL\_ADDR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000004}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_ADDR} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR:krb5-auth-context-generate-remote-addr}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR:krb5-auth-context-generate-remote-addr-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR::doc}}\index{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_ADDR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_ADDR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR:KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_ADDR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Generate the remote network address. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_ADDR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_FULL\_ADDR} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR:krb5-auth-context-generate-remote-full-addr}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR:krb5-auth-context-generate-remote-full-addr-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR::doc}}\index{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_FULL\_ADDR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_FULL\_ADDR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR:KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_FULL\_ADDR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Generate the remote network address and the remote port. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_FULL\_ADDR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000008}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_PERMIT\_ALL} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL:krb5-auth-context-permit-all}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL:krb5-auth-context-permit-all-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL::doc}}\index{KRB5\_AUTH\_CONTEXT\_PERMIT\_ALL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_PERMIT\_ALL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_PERMIT_ALL:KRB5_AUTH_CONTEXT_PERMIT_ALL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_PERMIT\_ALL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_PERMIT\_ALL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000010}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE:krb5-auth-context-ret-sequence}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE:krb5-auth-context-ret-sequence-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE::doc}}\index{KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_SEQUENCE:KRB5_AUTH_CONTEXT_RET_SEQUENCE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Save sequence numbers for application. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000008}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_RET\_TIME} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME:krb5-auth-context-ret-time}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME:krb5-auth-context-ret-time-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME::doc}}\index{KRB5\_AUTH\_CONTEXT\_RET\_TIME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_RET\_TIME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_RET_TIME:KRB5_AUTH_CONTEXT_RET_TIME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_RET\_TIME}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Save timestamps for application. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_RET\_TIME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_AUTH\_CONTEXT\_USE\_SUBKEY} -\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY:krb5-auth-context-use-subkey}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY:krb5-auth-context-use-subkey-data}}\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY::doc}}\index{KRB5\_AUTH\_CONTEXT\_USE\_SUBKEY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_AUTH\_CONTEXT\_USE\_SUBKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_AUTH_CONTEXT_USE_SUBKEY:KRB5_AUTH_CONTEXT_USE_SUBKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_USE\_SUBKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_AUTH\_CONTEXT\_USE\_SUBKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000020}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRED} -\label{\detokenize{appdev/refs/macros/KRB5_CRED:krb5-cred}}\label{\detokenize{appdev/refs/macros/KRB5_CRED:krb5-cred-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRED::doc}}\index{KRB5\_CRED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRED:KRB5_CRED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRED}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Cred forwarding message. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)22)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRYPTO\_TYPE\_CHECKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM:krb5-crypto-type-checksum}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM:krb5-crypto-type-checksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM::doc}}\index{KRB5\_CRYPTO\_TYPE\_CHECKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRYPTO\_TYPE\_CHECKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_CHECKSUM:KRB5_CRYPTO_TYPE_CHECKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_CHECKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -{[}out{]} checksum for MIC - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_CHECKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{6}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRYPTO\_TYPE\_DATA} -\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA:krb5-crypto-type-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA:krb5-crypto-type-data-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA::doc}}\index{KRB5\_CRYPTO\_TYPE\_DATA (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRYPTO\_TYPE\_DATA}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_DATA:KRB5_CRYPTO_TYPE_DATA}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_DATA}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -{[}in, out{]} plaintext - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_DATA}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRYPTO\_TYPE\_EMPTY} -\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY:krb5-crypto-type-empty}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY:krb5-crypto-type-empty-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY::doc}}\index{KRB5\_CRYPTO\_TYPE\_EMPTY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRYPTO\_TYPE\_EMPTY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_EMPTY:KRB5_CRYPTO_TYPE_EMPTY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_EMPTY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -{[}in{]} ignored - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_EMPTY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRYPTO\_TYPE\_HEADER} -\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER:krb5-crypto-type-header}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER:krb5-crypto-type-header-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER::doc}}\index{KRB5\_CRYPTO\_TYPE\_HEADER (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRYPTO\_TYPE\_HEADER}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_HEADER:KRB5_CRYPTO_TYPE_HEADER}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_HEADER}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -{[}out{]} header - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_HEADER}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRYPTO\_TYPE\_PADDING} -\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING:krb5-crypto-type-padding}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING:krb5-crypto-type-padding-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING::doc}}\index{KRB5\_CRYPTO\_TYPE\_PADDING (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRYPTO\_TYPE\_PADDING}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_PADDING:KRB5_CRYPTO_TYPE_PADDING}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_PADDING}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -{[}out{]} padding - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_PADDING}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY} -\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY:krb5-crypto-type-sign-only}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY:krb5-crypto-type-sign-only-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY::doc}}\index{KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_SIGN_ONLY:KRB5_CRYPTO_TYPE_SIGN_ONLY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -{[}in{]} associated data - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_SIGN\_ONLY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{3}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRYPTO\_TYPE\_STREAM} -\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM:krb5-crypto-type-stream}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM:krb5-crypto-type-stream-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM::doc}}\index{KRB5\_CRYPTO\_TYPE\_STREAM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRYPTO\_TYPE\_STREAM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_STREAM:KRB5_CRYPTO_TYPE_STREAM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_STREAM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -{[}in{]} entire message without decomposing the structure into header, data and trailer buffers - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_STREAM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{7}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CRYPTO\_TYPE\_TRAILER} -\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER:krb5-crypto-type-trailer}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER:krb5-crypto-type-trailer-data}}\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER::doc}}\index{KRB5\_CRYPTO\_TYPE\_TRAILER (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CRYPTO\_TYPE\_TRAILER}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CRYPTO_TYPE_TRAILER:KRB5_CRYPTO_TYPE_TRAILER}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_TRAILER}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -{[}out{]} checksum for encrypt - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CRYPTO\_TYPE\_TRAILER}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{5}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_CYBERSAFE\_SECUREID} -\label{\detokenize{appdev/refs/macros/KRB5_CYBERSAFE_SECUREID:krb5-cybersafe-secureid}}\label{\detokenize{appdev/refs/macros/KRB5_CYBERSAFE_SECUREID:krb5-cybersafe-secureid-data}}\label{\detokenize{appdev/refs/macros/KRB5_CYBERSAFE_SECUREID::doc}}\index{KRB5\_CYBERSAFE\_SECUREID (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_CYBERSAFE\_SECUREID}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_CYBERSAFE_SECUREID:KRB5_CYBERSAFE_SECUREID}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_CYBERSAFE\_SECUREID}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Cybersafe. - -\sphinxAtStartPar -RFC 4120 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_CYBERSAFE\_SECUREID}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{9}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_DOMAIN\_X500\_COMPRESS} -\label{\detokenize{appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS:krb5-domain-x500-compress}}\label{\detokenize{appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS:krb5-domain-x500-compress-data}}\label{\detokenize{appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS::doc}}\index{KRB5\_DOMAIN\_X500\_COMPRESS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_DOMAIN\_X500\_COMPRESS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_DOMAIN_X500_COMPRESS:KRB5_DOMAIN_X500_COMPRESS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_DOMAIN\_X500\_COMPRESS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Transited encoding types. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_DOMAIN\_X500\_COMPRESS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_ENCPADATA\_REQ\_ENC\_PA\_REP} -\label{\detokenize{appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP:krb5-encpadata-req-enc-pa-rep}}\label{\detokenize{appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP:krb5-encpadata-req-enc-pa-rep-data}}\label{\detokenize{appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP::doc}}\index{KRB5\_ENCPADATA\_REQ\_ENC\_PA\_REP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_ENCPADATA\_REQ\_ENC\_PA\_REP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_ENCPADATA_REQ_ENC_PA_REP:KRB5_ENCPADATA_REQ_ENC_PA_REP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_ENCPADATA\_REQ\_ENC\_PA\_REP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6806. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_ENCPADATA\_REQ\_ENC\_PA\_REP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{149}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_ERROR} -\label{\detokenize{appdev/refs/macros/KRB5_ERROR:krb5-error}}\label{\detokenize{appdev/refs/macros/KRB5_ERROR:krb5-error-data}}\label{\detokenize{appdev/refs/macros/KRB5_ERROR::doc}}\index{KRB5\_ERROR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_ERROR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_ERROR:KRB5_ERROR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_ERROR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Error response. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_ERROR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)30)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_FAST\_REQUIRED} -\label{\detokenize{appdev/refs/macros/KRB5_FAST_REQUIRED:krb5-fast-required}}\label{\detokenize{appdev/refs/macros/KRB5_FAST_REQUIRED:krb5-fast-required-data}}\label{\detokenize{appdev/refs/macros/KRB5_FAST_REQUIRED::doc}}\index{KRB5\_FAST\_REQUIRED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_FAST\_REQUIRED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_FAST_REQUIRED:KRB5_FAST_REQUIRED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_FAST\_REQUIRED}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Require KDC to support FAST. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_FAST\_REQUIRED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GC\_CACHED} -\label{\detokenize{appdev/refs/macros/KRB5_GC_CACHED:krb5-gc-cached}}\label{\detokenize{appdev/refs/macros/KRB5_GC_CACHED:krb5-gc-cached-data}}\label{\detokenize{appdev/refs/macros/KRB5_GC_CACHED::doc}}\index{KRB5\_GC\_CACHED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GC\_CACHED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GC_CACHED:KRB5_GC_CACHED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GC\_CACHED}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Want cached ticket only. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GC\_CACHED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GC\_CANONICALIZE} -\label{\detokenize{appdev/refs/macros/KRB5_GC_CANONICALIZE:krb5-gc-canonicalize}}\label{\detokenize{appdev/refs/macros/KRB5_GC_CANONICALIZE:krb5-gc-canonicalize-data}}\label{\detokenize{appdev/refs/macros/KRB5_GC_CANONICALIZE::doc}}\index{KRB5\_GC\_CANONICALIZE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GC\_CANONICALIZE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GC_CANONICALIZE:KRB5_GC_CANONICALIZE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GC\_CANONICALIZE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Set canonicalize KDC option. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GC\_CANONICALIZE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GC\_CONSTRAINED\_DELEGATION} -\label{\detokenize{appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION:krb5-gc-constrained-delegation}}\label{\detokenize{appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION:krb5-gc-constrained-delegation-data}}\label{\detokenize{appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION::doc}}\index{KRB5\_GC\_CONSTRAINED\_DELEGATION (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GC\_CONSTRAINED\_DELEGATION}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GC_CONSTRAINED_DELEGATION:KRB5_GC_CONSTRAINED_DELEGATION}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GC\_CONSTRAINED\_DELEGATION}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Constrained delegation. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GC\_CONSTRAINED\_DELEGATION}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{64}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GC\_FORWARDABLE} -\label{\detokenize{appdev/refs/macros/KRB5_GC_FORWARDABLE:krb5-gc-forwardable}}\label{\detokenize{appdev/refs/macros/KRB5_GC_FORWARDABLE:krb5-gc-forwardable-data}}\label{\detokenize{appdev/refs/macros/KRB5_GC_FORWARDABLE::doc}}\index{KRB5\_GC\_FORWARDABLE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GC\_FORWARDABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GC_FORWARDABLE:KRB5_GC_FORWARDABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GC\_FORWARDABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Acquire forwardable tickets. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GC\_FORWARDABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{16}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GC\_NO\_STORE} -\label{\detokenize{appdev/refs/macros/KRB5_GC_NO_STORE:krb5-gc-no-store}}\label{\detokenize{appdev/refs/macros/KRB5_GC_NO_STORE:krb5-gc-no-store-data}}\label{\detokenize{appdev/refs/macros/KRB5_GC_NO_STORE::doc}}\index{KRB5\_GC\_NO\_STORE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GC\_NO\_STORE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GC_NO_STORE:KRB5_GC_NO_STORE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GC\_NO\_STORE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Do not store in credential cache. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GC\_NO\_STORE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{8}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GC\_NO\_TRANSIT\_CHECK} -\label{\detokenize{appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK:krb5-gc-no-transit-check}}\label{\detokenize{appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK:krb5-gc-no-transit-check-data}}\label{\detokenize{appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK::doc}}\index{KRB5\_GC\_NO\_TRANSIT\_CHECK (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GC\_NO\_TRANSIT\_CHECK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GC_NO_TRANSIT_CHECK:KRB5_GC_NO_TRANSIT_CHECK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GC\_NO\_TRANSIT\_CHECK}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Disable transited check. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GC\_NO\_TRANSIT\_CHECK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{32}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GC\_USER\_USER} -\label{\detokenize{appdev/refs/macros/KRB5_GC_USER_USER:krb5-gc-user-user}}\label{\detokenize{appdev/refs/macros/KRB5_GC_USER_USER:krb5-gc-user-user-data}}\label{\detokenize{appdev/refs/macros/KRB5_GC_USER_USER::doc}}\index{KRB5\_GC\_USER\_USER (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GC\_USER\_USER}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GC_USER_USER:KRB5_GC_USER_USER}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GC\_USER\_USER}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Want user\sphinxhyphen{}user ticket. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GC\_USER\_USER}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_ADDRESS\_LIST} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST:krb5-get-init-creds-opt-address-list}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST:krb5-get-init-creds-opt-address-list-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_ADDRESS\_LIST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_ADDRESS\_LIST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST:KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_ADDRESS\_LIST}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_ADDRESS\_LIST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0020}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_ANONYMOUS} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS:krb5-get-init-creds-opt-anonymous}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS:krb5-get-init-creds-opt-anonymous-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_ANONYMOUS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_ANONYMOUS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ANONYMOUS:KRB5_GET_INIT_CREDS_OPT_ANONYMOUS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_ANONYMOUS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_ANONYMOUS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0400}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_CANONICALIZE} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE:krb5-get-init-creds-opt-canonicalize}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE:krb5-get-init-creds-opt-canonicalize-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_CANONICALIZE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_CANONICALIZE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CANONICALIZE:KRB5_GET_INIT_CREDS_OPT_CANONICALIZE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_CANONICALIZE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_CANONICALIZE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0200}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_CHG\_PWD\_PRMPT} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT:krb5-get-init-creds-opt-chg-pwd-prmpt}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT:krb5-get-init-creds-opt-chg-pwd-prmpt-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_CHG\_PWD\_PRMPT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_CHG\_PWD\_PRMPT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT:KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_CHG\_PWD\_PRMPT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_CHG\_PWD\_PRMPT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0100}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_ETYPE\_LIST} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST:krb5-get-init-creds-opt-etype-list}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST:krb5-get-init-creds-opt-etype-list-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_ETYPE\_LIST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_ETYPE\_LIST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST:KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_ETYPE\_LIST}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_ETYPE\_LIST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0010}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_FORWARDABLE} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE:krb5-get-init-creds-opt-forwardable}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE:krb5-get-init-creds-opt-forwardable-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_FORWARDABLE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_FORWARDABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_FORWARDABLE:KRB5_GET_INIT_CREDS_OPT_FORWARDABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_FORWARDABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_FORWARDABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0004}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_PREAUTH\_LIST} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST:krb5-get-init-creds-opt-preauth-list}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST:krb5-get-init-creds-opt-preauth-list-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_PREAUTH\_LIST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_PREAUTH\_LIST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST:KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_PREAUTH\_LIST}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_PREAUTH\_LIST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0040}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_PROXIABLE} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE:krb5-get-init-creds-opt-proxiable}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE:krb5-get-init-creds-opt-proxiable-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_PROXIABLE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_PROXIABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_PROXIABLE:KRB5_GET_INIT_CREDS_OPT_PROXIABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_PROXIABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_PROXIABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0008}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_RENEW\_LIFE} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE:krb5-get-init-creds-opt-renew-life}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE:krb5-get-init-creds-opt-renew-life-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_RENEW\_LIFE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_RENEW\_LIFE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE:KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_RENEW\_LIFE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_RENEW\_LIFE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_SALT} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT:krb5-get-init-creds-opt-salt}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT:krb5-get-init-creds-opt-salt-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_SALT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_SALT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_SALT:KRB5_GET_INIT_CREDS_OPT_SALT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_SALT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_SALT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0080}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_GET\_INIT\_CREDS\_OPT\_TKT\_LIFE} -\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE:krb5-get-init-creds-opt-tkt-life}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE:krb5-get-init-creds-opt-tkt-life-data}}\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE::doc}}\index{KRB5\_GET\_INIT\_CREDS\_OPT\_TKT\_LIFE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_GET\_INIT\_CREDS\_OPT\_TKT\_LIFE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_GET_INIT_CREDS_OPT_TKT_LIFE:KRB5_GET_INIT_CREDS_OPT_TKT_LIFE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_TKT\_LIFE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_GET\_INIT\_CREDS\_OPT\_TKT\_LIFE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_INIT\_CONTEXT\_SECURE} -\label{\detokenize{appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE:krb5-init-context-secure}}\label{\detokenize{appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE:krb5-init-context-secure-data}}\label{\detokenize{appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE::doc}}\index{KRB5\_INIT\_CONTEXT\_SECURE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_INIT\_CONTEXT\_SECURE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_INIT_CONTEXT_SECURE:KRB5_INIT_CONTEXT_SECURE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_INIT\_CONTEXT\_SECURE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Use secure context configuration. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_INIT\_CONTEXT\_SECURE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_INIT\_CONTEXT\_KDC} -\label{\detokenize{appdev/refs/macros/KRB5_INIT_CONTEXT_KDC:krb5-init-context-kdc}}\label{\detokenize{appdev/refs/macros/KRB5_INIT_CONTEXT_KDC:krb5-init-context-kdc-data}}\label{\detokenize{appdev/refs/macros/KRB5_INIT_CONTEXT_KDC::doc}}\index{KRB5\_INIT\_CONTEXT\_KDC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_INIT\_CONTEXT\_KDC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_INIT_CONTEXT_KDC:KRB5_INIT_CONTEXT_KDC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_INIT\_CONTEXT\_KDC}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Use KDC configuration if available. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_INIT\_CONTEXT\_KDC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_INIT\_CREDS\_STEP\_FLAG\_CONTINUE} -\label{\detokenize{appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE:krb5-init-creds-step-flag-continue}}\label{\detokenize{appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE:krb5-init-creds-step-flag-continue-data}}\label{\detokenize{appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE::doc}}\index{KRB5\_INIT\_CREDS\_STEP\_FLAG\_CONTINUE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_INIT\_CREDS\_STEP\_FLAG\_CONTINUE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_INIT_CREDS_STEP_FLAG_CONTINUE:KRB5_INIT_CREDS_STEP_FLAG_CONTINUE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_INIT\_CREDS\_STEP\_FLAG\_CONTINUE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -More responses needed. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_INIT\_CREDS\_STEP\_FLAG\_CONTINUE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_INT16\_MAX} -\label{\detokenize{appdev/refs/macros/KRB5_INT16_MAX:krb5-int16-max}}\label{\detokenize{appdev/refs/macros/KRB5_INT16_MAX:krb5-int16-max-data}}\label{\detokenize{appdev/refs/macros/KRB5_INT16_MAX::doc}}\index{KRB5\_INT16\_MAX (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_INT16\_MAX}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_INT16_MAX:KRB5_INT16_MAX}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_INT16\_MAX}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_INT16\_MAX}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{65535}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_INT16\_MIN} -\label{\detokenize{appdev/refs/macros/KRB5_INT16_MIN:krb5-int16-min}}\label{\detokenize{appdev/refs/macros/KRB5_INT16_MIN:krb5-int16-min-data}}\label{\detokenize{appdev/refs/macros/KRB5_INT16_MIN::doc}}\index{KRB5\_INT16\_MIN (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_INT16\_MIN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_INT16_MIN:KRB5_INT16_MIN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_INT16\_MIN}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_INT16\_MIN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}KRB5\_INT16\_MAX\sphinxhyphen{}1)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_INT32\_MAX} -\label{\detokenize{appdev/refs/macros/KRB5_INT32_MAX:krb5-int32-max}}\label{\detokenize{appdev/refs/macros/KRB5_INT32_MAX:krb5-int32-max-data}}\label{\detokenize{appdev/refs/macros/KRB5_INT32_MAX::doc}}\index{KRB5\_INT32\_MAX (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_INT32\_MAX}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_INT32_MAX:KRB5_INT32_MAX}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_INT32\_MAX}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_INT32\_MAX}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2147483647}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_INT32\_MIN} -\label{\detokenize{appdev/refs/macros/KRB5_INT32_MIN:krb5-int32-min}}\label{\detokenize{appdev/refs/macros/KRB5_INT32_MIN:krb5-int32-min-data}}\label{\detokenize{appdev/refs/macros/KRB5_INT32_MIN::doc}}\index{KRB5\_INT32\_MIN (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_INT32\_MIN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_INT32_MIN:KRB5_INT32_MIN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_INT32\_MIN}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_INT32\_MIN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}KRB5\_INT32\_MAX\sphinxhyphen{}1)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AD\_ITE} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE:krb5-keyusage-ad-ite}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE:krb5-keyusage-ad-ite-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE::doc}}\index{KRB5\_KEYUSAGE\_AD\_ITE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AD\_ITE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_ITE:KRB5_KEYUSAGE_AD_ITE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AD\_ITE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AD\_ITE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{21}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AD\_KDCISSUED\_CKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM:krb5-keyusage-ad-kdcissued-cksum}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM:krb5-keyusage-ad-kdcissued-cksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM::doc}}\index{KRB5\_KEYUSAGE\_AD\_KDCISSUED\_CKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AD\_KDCISSUED\_CKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM:KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AD\_KDCISSUED\_CKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AD\_KDCISSUED\_CKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{19}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AD\_MTE} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE:krb5-keyusage-ad-mte}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE:krb5-keyusage-ad-mte-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE::doc}}\index{KRB5\_KEYUSAGE\_AD\_MTE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AD\_MTE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_MTE:KRB5_KEYUSAGE_AD_MTE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AD\_MTE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AD\_MTE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{20}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AD\_SIGNEDPATH} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH:krb5-keyusage-ad-signedpath}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH:krb5-keyusage-ad-signedpath-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH::doc}}\index{KRB5\_KEYUSAGE\_AD\_SIGNEDPATH (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AD\_SIGNEDPATH}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AD_SIGNEDPATH:KRB5_KEYUSAGE_AD_SIGNEDPATH}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AD\_SIGNEDPATH}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AD\_SIGNEDPATH}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\sphinxhyphen{}21}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_APP\_DATA\_CKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM:krb5-keyusage-app-data-cksum}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM:krb5-keyusage-app-data-cksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM::doc}}\index{KRB5\_KEYUSAGE\_APP\_DATA\_CKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_APP\_DATA\_CKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_CKSUM:KRB5_KEYUSAGE_APP_DATA_CKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_APP\_DATA\_CKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_APP\_DATA\_CKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{17}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_APP\_DATA\_ENCRYPT} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT:krb5-keyusage-app-data-encrypt}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT:krb5-keyusage-app-data-encrypt-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT::doc}}\index{KRB5\_KEYUSAGE\_APP\_DATA\_ENCRYPT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_APP\_DATA\_ENCRYPT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_APP_DATA_ENCRYPT:KRB5_KEYUSAGE_APP_DATA_ENCRYPT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_APP\_DATA\_ENCRYPT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_APP\_DATA\_ENCRYPT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{16}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AP\_REP\_ENCPART} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART:krb5-keyusage-ap-rep-encpart}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART:krb5-keyusage-ap-rep-encpart-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART::doc}}\index{KRB5\_KEYUSAGE\_AP\_REP\_ENCPART (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AP\_REP\_ENCPART}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REP_ENCPART:KRB5_KEYUSAGE_AP_REP_ENCPART}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AP\_REP\_ENCPART}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AP\_REP\_ENCPART}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{12}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH:krb5-keyusage-ap-req-auth}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH:krb5-keyusage-ap-req-auth-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH::doc}}\index{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH:KRB5_KEYUSAGE_AP_REQ_AUTH}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{11}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH\_CKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM:krb5-keyusage-ap-req-auth-cksum}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM:krb5-keyusage-ap-req-auth-cksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM::doc}}\index{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH\_CKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH\_CKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM:KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH\_CKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AP\_REQ\_AUTH\_CKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{10}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AS\_REP\_ENCPART} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART:krb5-keyusage-as-rep-encpart}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART:krb5-keyusage-as-rep-encpart-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART::doc}}\index{KRB5\_KEYUSAGE\_AS\_REP\_ENCPART (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AS\_REP\_ENCPART}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REP_ENCPART:KRB5_KEYUSAGE_AS_REP_ENCPART}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AS\_REP\_ENCPART}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AS\_REP\_ENCPART}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{3}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AS\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ:krb5-keyusage-as-req}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ:krb5-keyusage-as-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ::doc}}\index{KRB5\_KEYUSAGE\_AS\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AS\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ:KRB5_KEYUSAGE_AS_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AS\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AS\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{56}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_AS\_REQ\_PA\_ENC\_TS} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS:krb5-keyusage-as-req-pa-enc-ts}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS:krb5-keyusage-as-req-pa-enc-ts-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS::doc}}\index{KRB5\_KEYUSAGE\_AS\_REQ\_PA\_ENC\_TS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_AS\_REQ\_PA\_ENC\_TS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS:KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_AS\_REQ\_PA\_ENC\_TS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_AS\_REQ\_PA\_ENC\_TS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_CAMMAC} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC:krb5-keyusage-cammac}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC:krb5-keyusage-cammac-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC::doc}}\index{KRB5\_KEYUSAGE\_CAMMAC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_CAMMAC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_CAMMAC:KRB5_KEYUSAGE_CAMMAC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_CAMMAC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_CAMMAC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{64}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_CLIENT} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT:krb5-keyusage-enc-challenge-client}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT:krb5-keyusage-enc-challenge-client-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT::doc}}\index{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_CLIENT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_CLIENT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT:KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_CLIENT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_CLIENT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{54}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_KDC} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC:krb5-keyusage-enc-challenge-kdc}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC:krb5-keyusage-enc-challenge-kdc-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC::doc}}\index{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_KDC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_KDC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_ENC_CHALLENGE_KDC:KRB5_KEYUSAGE_ENC_CHALLENGE_KDC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_KDC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_ENC\_CHALLENGE\_KDC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{55}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_FAST\_ENC} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC:krb5-keyusage-fast-enc}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC:krb5-keyusage-fast-enc-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC::doc}}\index{KRB5\_KEYUSAGE\_FAST\_ENC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_FAST\_ENC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_ENC:KRB5_KEYUSAGE_FAST_ENC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_FAST\_ENC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_FAST\_ENC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{51}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_FAST\_FINISHED} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED:krb5-keyusage-fast-finished}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED:krb5-keyusage-fast-finished-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED::doc}}\index{KRB5\_KEYUSAGE\_FAST\_FINISHED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_FAST\_FINISHED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_FINISHED:KRB5_KEYUSAGE_FAST_FINISHED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_FAST\_FINISHED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_FAST\_FINISHED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{53}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_FAST\_REP} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP:krb5-keyusage-fast-rep}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP:krb5-keyusage-fast-rep-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP::doc}}\index{KRB5\_KEYUSAGE\_FAST\_REP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_FAST\_REP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_REP:KRB5_KEYUSAGE_FAST_REP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_FAST\_REP}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_FAST\_REP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{52}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_FAST\_REQ\_CHKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM:krb5-keyusage-fast-req-chksum}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM:krb5-keyusage-fast-req-chksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM::doc}}\index{KRB5\_KEYUSAGE\_FAST\_REQ\_CHKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_FAST\_REQ\_CHKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FAST_REQ_CHKSUM:KRB5_KEYUSAGE_FAST_REQ_CHKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_FAST\_REQ\_CHKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_FAST\_REQ\_CHKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{50}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_GSS\_TOK\_MIC} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC:krb5-keyusage-gss-tok-mic}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC:krb5-keyusage-gss-tok-mic-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC::doc}}\index{KRB5\_KEYUSAGE\_GSS\_TOK\_MIC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_GSS\_TOK\_MIC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_MIC:KRB5_KEYUSAGE_GSS_TOK_MIC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_GSS\_TOK\_MIC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_GSS\_TOK\_MIC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{22}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_INTEG} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG:krb5-keyusage-gss-tok-wrap-integ}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG:krb5-keyusage-gss-tok-wrap-integ-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG::doc}}\index{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_INTEG (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_INTEG}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG:KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_INTEG}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_INTEG}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{23}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_PRIV} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV:krb5-keyusage-gss-tok-wrap-priv}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV:krb5-keyusage-gss-tok-wrap-priv-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV::doc}}\index{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_PRIV (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_PRIV}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV:KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_PRIV}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_GSS\_TOK\_WRAP\_PRIV}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{24}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_FINISHED} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FINISHED:krb5-keyusage-finished}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FINISHED:krb5-keyusage-finished-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FINISHED::doc}}\index{KRB5\_KEYUSAGE\_FINISHED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_FINISHED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_FINISHED:KRB5_KEYUSAGE_FINISHED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_FINISHED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_FINISHED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{41}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_IAKERB\_FINISHED} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED:krb5-keyusage-iakerb-finished}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED:krb5-keyusage-iakerb-finished-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED::doc}}\index{KRB5\_KEYUSAGE\_IAKERB\_FINISHED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_IAKERB\_FINISHED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_IAKERB_FINISHED:KRB5_KEYUSAGE_IAKERB_FINISHED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_IAKERB\_FINISHED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_IAKERB\_FINISHED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{42}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_KDC\_REP\_TICKET} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET:krb5-keyusage-kdc-rep-ticket}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET:krb5-keyusage-kdc-rep-ticket-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET::doc}}\index{KRB5\_KEYUSAGE\_KDC\_REP\_TICKET (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_KDC\_REP\_TICKET}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KDC_REP_TICKET:KRB5_KEYUSAGE_KDC_REP_TICKET}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_KDC\_REP\_TICKET}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_KDC\_REP\_TICKET}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_KRB\_CRED\_ENCPART} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART:krb5-keyusage-krb-cred-encpart}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART:krb5-keyusage-krb-cred-encpart-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART::doc}}\index{KRB5\_KEYUSAGE\_KRB\_CRED\_ENCPART (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_KRB\_CRED\_ENCPART}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_CRED_ENCPART:KRB5_KEYUSAGE_KRB_CRED_ENCPART}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_KRB\_CRED\_ENCPART}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_KRB\_CRED\_ENCPART}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{14}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_KRB\_ERROR\_CKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM:krb5-keyusage-krb-error-cksum}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM:krb5-keyusage-krb-error-cksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM::doc}}\index{KRB5\_KEYUSAGE\_KRB\_ERROR\_CKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_KRB\_ERROR\_CKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_ERROR_CKSUM:KRB5_KEYUSAGE_KRB_ERROR_CKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_KRB\_ERROR\_CKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_KRB\_ERROR\_CKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{18}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_KRB\_PRIV\_ENCPART} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART:krb5-keyusage-krb-priv-encpart}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART:krb5-keyusage-krb-priv-encpart-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART::doc}}\index{KRB5\_KEYUSAGE\_KRB\_PRIV\_ENCPART (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_KRB\_PRIV\_ENCPART}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_PRIV_ENCPART:KRB5_KEYUSAGE_KRB_PRIV_ENCPART}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_KRB\_PRIV\_ENCPART}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_KRB\_PRIV\_ENCPART}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{13}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_KRB\_SAFE\_CKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM:krb5-keyusage-krb-safe-cksum}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM:krb5-keyusage-krb-safe-cksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM::doc}}\index{KRB5\_KEYUSAGE\_KRB\_SAFE\_CKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_KRB\_SAFE\_CKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_KRB_SAFE_CKSUM:KRB5_KEYUSAGE_KRB_SAFE_CKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_KRB\_SAFE\_CKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_KRB\_SAFE\_CKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{15}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_AS\_FRESHNESS} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS:krb5-keyusage-pa-as-freshness}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS:krb5-keyusage-pa-as-freshness-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS::doc}}\index{KRB5\_KEYUSAGE\_PA\_AS\_FRESHNESS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_AS\_FRESHNESS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_AS_FRESHNESS:KRB5_KEYUSAGE_PA_AS_FRESHNESS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_AS\_FRESHNESS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Used for freshness tokens. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_AS\_FRESHNESS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{514}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_FX\_COOKIE} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE:krb5-keyusage-pa-fx-cookie}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE:krb5-keyusage-pa-fx-cookie-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE::doc}}\index{KRB5\_KEYUSAGE\_PA\_FX\_COOKIE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_FX\_COOKIE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_FX_COOKIE:KRB5_KEYUSAGE_PA_FX_COOKIE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_FX\_COOKIE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Used for encrypted FAST cookies. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_FX\_COOKIE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{513}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_OTP\_REQUEST} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST:krb5-keyusage-pa-otp-request}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST:krb5-keyusage-pa-otp-request-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST::doc}}\index{KRB5\_KEYUSAGE\_PA\_OTP\_REQUEST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_OTP\_REQUEST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_OTP_REQUEST:KRB5_KEYUSAGE_PA_OTP_REQUEST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_OTP\_REQUEST}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -See RFC 6560 section 4.2. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_OTP\_REQUEST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{45}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_PKINIT\_KX} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX:krb5-keyusage-pa-pkinit-kx}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX:krb5-keyusage-pa-pkinit-kx-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX::doc}}\index{KRB5\_KEYUSAGE\_PA\_PKINIT\_KX (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_PKINIT\_KX}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_PKINIT_KX:KRB5_KEYUSAGE_PA_PKINIT_KX}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_PKINIT\_KX}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_PKINIT\_KX}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{44}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REPLY} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY:krb5-keyusage-pa-s4u-x509-user-reply}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY:krb5-keyusage-pa-s4u-x509-user-reply-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY::doc}}\index{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REPLY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REPLY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY:KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REPLY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REPLY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{27}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REQUEST} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST:krb5-keyusage-pa-s4u-x509-user-request}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST:krb5-keyusage-pa-s4u-x509-user-request-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST::doc}}\index{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REQUEST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REQUEST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST:KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REQUEST}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_S4U\_X509\_USER\_REQUEST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{26}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_CKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM:krb5-keyusage-pa-sam-challenge-cksum}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM:krb5-keyusage-pa-sam-challenge-cksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM::doc}}\index{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_CKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_CKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM:KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_CKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_CKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{25}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_TRACKID} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID:krb5-keyusage-pa-sam-challenge-trackid}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID:krb5-keyusage-pa-sam-challenge-trackid-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID::doc}}\index{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_TRACKID (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_TRACKID}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID:KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_TRACKID}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_SAM\_CHALLENGE\_TRACKID}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{26}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_PA\_SAM\_RESPONSE} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE:krb5-keyusage-pa-sam-response}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE:krb5-keyusage-pa-sam-response-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE::doc}}\index{KRB5\_KEYUSAGE\_PA\_SAM\_RESPONSE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_PA\_SAM\_RESPONSE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_PA_SAM_RESPONSE:KRB5_KEYUSAGE_PA_SAM_RESPONSE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_SAM\_RESPONSE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_PA\_SAM\_RESPONSE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{27}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_SPAKE} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_SPAKE:krb5-keyusage-spake}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_SPAKE:krb5-keyusage-spake-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_SPAKE::doc}}\index{KRB5\_KEYUSAGE\_SPAKE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_SPAKE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_SPAKE:KRB5_KEYUSAGE_SPAKE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_SPAKE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_SPAKE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{65}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SESSKEY} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY:krb5-keyusage-tgs-rep-encpart-sesskey}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY:krb5-keyusage-tgs-rep-encpart-sesskey-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY::doc}}\index{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SESSKEY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SESSKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY:KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SESSKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SESSKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{8}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SUBKEY} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY:krb5-keyusage-tgs-rep-encpart-subkey}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY:krb5-keyusage-tgs-rep-encpart-subkey-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY::doc}}\index{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SUBKEY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SUBKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY:KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SUBKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REP\_ENCPART\_SUBKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{9}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SESSKEY} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY:krb5-keyusage-tgs-req-ad-sesskey}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY:krb5-keyusage-tgs-req-ad-sesskey-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY::doc}}\index{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SESSKEY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SESSKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY:KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SESSKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SESSKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SUBKEY} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY:krb5-keyusage-tgs-req-ad-subkey}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY:krb5-keyusage-tgs-req-ad-subkey-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY::doc}}\index{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SUBKEY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SUBKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY:KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SUBKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REQ\_AD\_SUBKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{5}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH:krb5-keyusage-tgs-req-auth}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH:krb5-keyusage-tgs-req-auth-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH::doc}}\index{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH:KRB5_KEYUSAGE_TGS_REQ_AUTH}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{7}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH\_CKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM:krb5-keyusage-tgs-req-auth-cksum}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM:krb5-keyusage-tgs-req-auth-cksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM::doc}}\index{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH\_CKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH\_CKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM:KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH\_CKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KEYUSAGE\_TGS\_REQ\_AUTH\_CKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{6}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KPASSWD\_ACCESSDENIED} -\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED:krb5-kpasswd-accessdenied}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED:krb5-kpasswd-accessdenied-data}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED::doc}}\index{KRB5\_KPASSWD\_ACCESSDENIED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KPASSWD\_ACCESSDENIED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_ACCESSDENIED:KRB5_KPASSWD_ACCESSDENIED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KPASSWD\_ACCESSDENIED}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Not authorized. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KPASSWD\_ACCESSDENIED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{5}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KPASSWD\_AUTHERROR} -\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_AUTHERROR:krb5-kpasswd-autherror}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_AUTHERROR:krb5-kpasswd-autherror-data}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_AUTHERROR::doc}}\index{KRB5\_KPASSWD\_AUTHERROR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KPASSWD\_AUTHERROR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_AUTHERROR:KRB5_KPASSWD_AUTHERROR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KPASSWD\_AUTHERROR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Authentication error. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KPASSWD\_AUTHERROR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{3}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KPASSWD\_BAD\_VERSION} -\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION:krb5-kpasswd-bad-version}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION:krb5-kpasswd-bad-version-data}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION::doc}}\index{KRB5\_KPASSWD\_BAD\_VERSION (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KPASSWD\_BAD\_VERSION}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_BAD_VERSION:KRB5_KPASSWD_BAD_VERSION}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KPASSWD\_BAD\_VERSION}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Unknown RPC version. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KPASSWD\_BAD\_VERSION}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{6}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KPASSWD\_HARDERROR} -\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_HARDERROR:krb5-kpasswd-harderror}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_HARDERROR:krb5-kpasswd-harderror-data}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_HARDERROR::doc}}\index{KRB5\_KPASSWD\_HARDERROR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KPASSWD\_HARDERROR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_HARDERROR:KRB5_KPASSWD_HARDERROR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KPASSWD\_HARDERROR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Server error. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KPASSWD\_HARDERROR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KPASSWD\_INITIAL\_FLAG\_NEEDED} -\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED:krb5-kpasswd-initial-flag-needed}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED:krb5-kpasswd-initial-flag-needed-data}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED::doc}}\index{KRB5\_KPASSWD\_INITIAL\_FLAG\_NEEDED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KPASSWD\_INITIAL\_FLAG\_NEEDED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_INITIAL_FLAG_NEEDED:KRB5_KPASSWD_INITIAL_FLAG_NEEDED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KPASSWD\_INITIAL\_FLAG\_NEEDED}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -The presented credentials were not obtained using a password directly. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KPASSWD\_INITIAL\_FLAG\_NEEDED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{7}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KPASSWD\_MALFORMED} -\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_MALFORMED:krb5-kpasswd-malformed}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_MALFORMED:krb5-kpasswd-malformed-data}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_MALFORMED::doc}}\index{KRB5\_KPASSWD\_MALFORMED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KPASSWD\_MALFORMED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_MALFORMED:KRB5_KPASSWD_MALFORMED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KPASSWD\_MALFORMED}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Malformed request. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KPASSWD\_MALFORMED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KPASSWD\_SOFTERROR} -\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_SOFTERROR:krb5-kpasswd-softerror}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_SOFTERROR:krb5-kpasswd-softerror-data}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_SOFTERROR::doc}}\index{KRB5\_KPASSWD\_SOFTERROR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KPASSWD\_SOFTERROR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_SOFTERROR:KRB5_KPASSWD_SOFTERROR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KPASSWD\_SOFTERROR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Password change rejected. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KPASSWD\_SOFTERROR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_KPASSWD\_SUCCESS} -\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_SUCCESS:krb5-kpasswd-success}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_SUCCESS:krb5-kpasswd-success-data}}\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_SUCCESS::doc}}\index{KRB5\_KPASSWD\_SUCCESS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_KPASSWD\_SUCCESS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_KPASSWD_SUCCESS:KRB5_KPASSWD_SUCCESS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_KPASSWD\_SUCCESS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Success. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_KPASSWD\_SUCCESS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ALL\_ACCT\_EXPTIME} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME:krb5-lrq-all-acct-exptime}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME:krb5-lrq-all-acct-exptime-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME::doc}}\index{KRB5\_LRQ\_ALL\_ACCT\_EXPTIME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ALL\_ACCT\_EXPTIME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_ACCT_EXPTIME:KRB5_LRQ_ALL_ACCT_EXPTIME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ALL\_ACCT\_EXPTIME}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ALL\_ACCT\_EXPTIME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{7}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ALL\_LAST\_INITIAL} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL:krb5-lrq-all-last-initial}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL:krb5-lrq-all-last-initial-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL::doc}}\index{KRB5\_LRQ\_ALL\_LAST\_INITIAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ALL\_LAST\_INITIAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_INITIAL:KRB5_LRQ_ALL_LAST_INITIAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_INITIAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_INITIAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ALL\_LAST\_RENEWAL} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL:krb5-lrq-all-last-renewal}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL:krb5-lrq-all-last-renewal-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL::doc}}\index{KRB5\_LRQ\_ALL\_LAST\_RENEWAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ALL\_LAST\_RENEWAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_RENEWAL:KRB5_LRQ_ALL_LAST_RENEWAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_RENEWAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_RENEWAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ALL\_LAST\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ:krb5-lrq-all-last-req}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ:krb5-lrq-all-last-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ::doc}}\index{KRB5\_LRQ\_ALL\_LAST\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ALL\_LAST\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_REQ:KRB5_LRQ_ALL_LAST_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{5}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ALL\_LAST\_TGT} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT:krb5-lrq-all-last-tgt}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT:krb5-lrq-all-last-tgt-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT::doc}}\index{KRB5\_LRQ\_ALL\_LAST\_TGT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ALL\_LAST\_TGT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT:KRB5_LRQ_ALL_LAST_TGT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_TGT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_TGT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ALL\_LAST\_TGT\_ISSUED} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED:krb5-lrq-all-last-tgt-issued}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED:krb5-lrq-all-last-tgt-issued-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED::doc}}\index{KRB5\_LRQ\_ALL\_LAST\_TGT\_ISSUED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ALL\_LAST\_TGT\_ISSUED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_LAST_TGT_ISSUED:KRB5_LRQ_ALL_LAST_TGT_ISSUED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_TGT\_ISSUED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ALL\_LAST\_TGT\_ISSUED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{3}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ALL\_PW\_EXPTIME} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME:krb5-lrq-all-pw-exptime}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME:krb5-lrq-all-pw-exptime-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME::doc}}\index{KRB5\_LRQ\_ALL\_PW\_EXPTIME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ALL\_PW\_EXPTIME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ALL_PW_EXPTIME:KRB5_LRQ_ALL_PW_EXPTIME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ALL\_PW\_EXPTIME}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ALL\_PW\_EXPTIME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{6}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_NONE} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_NONE:krb5-lrq-none}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_NONE:krb5-lrq-none-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_NONE::doc}}\index{KRB5\_LRQ\_NONE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_NONE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_NONE:KRB5_LRQ_NONE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_NONE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_NONE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ONE\_ACCT\_EXPTIME} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME:krb5-lrq-one-acct-exptime}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME:krb5-lrq-one-acct-exptime-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME::doc}}\index{KRB5\_LRQ\_ONE\_ACCT\_EXPTIME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ONE\_ACCT\_EXPTIME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_ACCT_EXPTIME:KRB5_LRQ_ONE_ACCT_EXPTIME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ONE\_ACCT\_EXPTIME}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ONE\_ACCT\_EXPTIME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}7)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ONE\_LAST\_INITIAL} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL:krb5-lrq-one-last-initial}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL:krb5-lrq-one-last-initial-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL::doc}}\index{KRB5\_LRQ\_ONE\_LAST\_INITIAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ONE\_LAST\_INITIAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_INITIAL:KRB5_LRQ_ONE_LAST_INITIAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_INITIAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_INITIAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}2)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ONE\_LAST\_RENEWAL} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL:krb5-lrq-one-last-renewal}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL:krb5-lrq-one-last-renewal-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL::doc}}\index{KRB5\_LRQ\_ONE\_LAST\_RENEWAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ONE\_LAST\_RENEWAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_RENEWAL:KRB5_LRQ_ONE_LAST_RENEWAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_RENEWAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_RENEWAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}4)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ONE\_LAST\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ:krb5-lrq-one-last-req}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ:krb5-lrq-one-last-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ::doc}}\index{KRB5\_LRQ\_ONE\_LAST\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ONE\_LAST\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_REQ:KRB5_LRQ_ONE_LAST_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}5)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ONE\_LAST\_TGT} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT:krb5-lrq-one-last-tgt}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT:krb5-lrq-one-last-tgt-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT::doc}}\index{KRB5\_LRQ\_ONE\_LAST\_TGT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ONE\_LAST\_TGT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT:KRB5_LRQ_ONE_LAST_TGT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_TGT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_TGT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}1)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ONE\_LAST\_TGT\_ISSUED} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED:krb5-lrq-one-last-tgt-issued}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED:krb5-lrq-one-last-tgt-issued-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED::doc}}\index{KRB5\_LRQ\_ONE\_LAST\_TGT\_ISSUED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ONE\_LAST\_TGT\_ISSUED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_LAST_TGT_ISSUED:KRB5_LRQ_ONE_LAST_TGT_ISSUED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_TGT\_ISSUED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ONE\_LAST\_TGT\_ISSUED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}3)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_LRQ\_ONE\_PW\_EXPTIME} -\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME:krb5-lrq-one-pw-exptime}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME:krb5-lrq-one-pw-exptime-data}}\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME::doc}}\index{KRB5\_LRQ\_ONE\_PW\_EXPTIME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_LRQ\_ONE\_PW\_EXPTIME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_LRQ_ONE_PW_EXPTIME:KRB5_LRQ_ONE_PW_EXPTIME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_LRQ\_ONE\_PW\_EXPTIME}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_LRQ\_ONE\_PW\_EXPTIME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\sphinxhyphen{}6)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_ENTERPRISE\_PRINCIPAL} -\label{\detokenize{appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL:krb5-nt-enterprise-principal}}\label{\detokenize{appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL:krb5-nt-enterprise-principal-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL::doc}}\index{KRB5\_NT\_ENTERPRISE\_PRINCIPAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_ENTERPRISE\_PRINCIPAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_ENTERPRISE_PRINCIPAL:KRB5_NT_ENTERPRISE_PRINCIPAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_ENTERPRISE\_PRINCIPAL}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Windows 2000 UPN. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_ENTERPRISE\_PRINCIPAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{10}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_ENT\_PRINCIPAL\_AND\_ID} -\label{\detokenize{appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID:krb5-nt-ent-principal-and-id}}\label{\detokenize{appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID:krb5-nt-ent-principal-and-id-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID::doc}}\index{KRB5\_NT\_ENT\_PRINCIPAL\_AND\_ID (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_ENT\_PRINCIPAL\_AND\_ID}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_ENT_PRINCIPAL_AND_ID:KRB5_NT_ENT_PRINCIPAL_AND_ID}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_ENT\_PRINCIPAL\_AND\_ID}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -NT 4 style name and SID. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_ENT\_PRINCIPAL\_AND\_ID}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\sphinxhyphen{}130}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_MS\_PRINCIPAL} -\label{\detokenize{appdev/refs/macros/KRB5_NT_MS_PRINCIPAL:krb5-nt-ms-principal}}\label{\detokenize{appdev/refs/macros/KRB5_NT_MS_PRINCIPAL:krb5-nt-ms-principal-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_MS_PRINCIPAL::doc}}\index{KRB5\_NT\_MS\_PRINCIPAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_MS\_PRINCIPAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_MS_PRINCIPAL:KRB5_NT_MS_PRINCIPAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_MS\_PRINCIPAL}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Windows 2000 UPN and SID. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_MS\_PRINCIPAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\sphinxhyphen{}128}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_MS\_PRINCIPAL\_AND\_ID} -\label{\detokenize{appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID:krb5-nt-ms-principal-and-id}}\label{\detokenize{appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID:krb5-nt-ms-principal-and-id-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID::doc}}\index{KRB5\_NT\_MS\_PRINCIPAL\_AND\_ID (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_MS\_PRINCIPAL\_AND\_ID}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_MS_PRINCIPAL_AND_ID:KRB5_NT_MS_PRINCIPAL_AND_ID}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_MS\_PRINCIPAL\_AND\_ID}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -NT 4 style name. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_MS\_PRINCIPAL\_AND\_ID}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\sphinxhyphen{}129}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_PRINCIPAL} -\label{\detokenize{appdev/refs/macros/KRB5_NT_PRINCIPAL:krb5-nt-principal}}\label{\detokenize{appdev/refs/macros/KRB5_NT_PRINCIPAL:krb5-nt-principal-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_PRINCIPAL::doc}}\index{KRB5\_NT\_PRINCIPAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_PRINCIPAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_PRINCIPAL:KRB5_NT_PRINCIPAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_PRINCIPAL}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Just the name of the principal as in DCE, or for users. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_PRINCIPAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_SMTP\_NAME} -\label{\detokenize{appdev/refs/macros/KRB5_NT_SMTP_NAME:krb5-nt-smtp-name}}\label{\detokenize{appdev/refs/macros/KRB5_NT_SMTP_NAME:krb5-nt-smtp-name-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_SMTP_NAME::doc}}\index{KRB5\_NT\_SMTP\_NAME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_SMTP\_NAME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_SMTP_NAME:KRB5_NT_SMTP_NAME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_SMTP\_NAME}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Name in form of SMTP email name. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_SMTP\_NAME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{7}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_SRV\_HST} -\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_HST:krb5-nt-srv-hst}}\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_HST:krb5-nt-srv-hst-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_HST::doc}}\index{KRB5\_NT\_SRV\_HST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_SRV\_HST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_HST:KRB5_NT_SRV_HST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_SRV\_HST}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Service with host name as instance (telnet, rcommands) - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_SRV\_HST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{3}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_SRV\_INST} -\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_INST:krb5-nt-srv-inst}}\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_INST:krb5-nt-srv-inst-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_INST::doc}}\index{KRB5\_NT\_SRV\_INST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_SRV\_INST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_INST:KRB5_NT_SRV_INST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_SRV\_INST}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Service and other unique instance (krbtgt) - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_SRV\_INST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_SRV\_XHST} -\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_XHST:krb5-nt-srv-xhst}}\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_XHST:krb5-nt-srv-xhst-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_XHST::doc}}\index{KRB5\_NT\_SRV\_XHST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_SRV\_XHST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_SRV_XHST:KRB5_NT_SRV_XHST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_SRV\_XHST}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Service with host as remaining components. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_SRV\_XHST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_UID} -\label{\detokenize{appdev/refs/macros/KRB5_NT_UID:krb5-nt-uid}}\label{\detokenize{appdev/refs/macros/KRB5_NT_UID:krb5-nt-uid-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_UID::doc}}\index{KRB5\_NT\_UID (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_UID}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_UID:KRB5_NT_UID}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_UID}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Unique ID. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_UID}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{5}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_UNKNOWN} -\label{\detokenize{appdev/refs/macros/KRB5_NT_UNKNOWN:krb5-nt-unknown}}\label{\detokenize{appdev/refs/macros/KRB5_NT_UNKNOWN:krb5-nt-unknown-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_UNKNOWN::doc}}\index{KRB5\_NT\_UNKNOWN (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_UNKNOWN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_UNKNOWN:KRB5_NT_UNKNOWN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_UNKNOWN}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Name type not known. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_UNKNOWN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_WELLKNOWN} -\label{\detokenize{appdev/refs/macros/KRB5_NT_WELLKNOWN:krb5-nt-wellknown}}\label{\detokenize{appdev/refs/macros/KRB5_NT_WELLKNOWN:krb5-nt-wellknown-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_WELLKNOWN::doc}}\index{KRB5\_NT\_WELLKNOWN (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_WELLKNOWN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_WELLKNOWN:KRB5_NT_WELLKNOWN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_WELLKNOWN}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Well\sphinxhyphen{}known (special) principal. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_WELLKNOWN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{11}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_NT\_X500\_PRINCIPAL} -\label{\detokenize{appdev/refs/macros/KRB5_NT_X500_PRINCIPAL:krb5-nt-x500-principal}}\label{\detokenize{appdev/refs/macros/KRB5_NT_X500_PRINCIPAL:krb5-nt-x500-principal-data}}\label{\detokenize{appdev/refs/macros/KRB5_NT_X500_PRINCIPAL::doc}}\index{KRB5\_NT\_X500\_PRINCIPAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_NT\_X500\_PRINCIPAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_NT_X500_PRINCIPAL:KRB5_NT_X500_PRINCIPAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_NT\_X500\_PRINCIPAL}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PKINIT. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_NT\_X500\_PRINCIPAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{6}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_ATTRIBUTES\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO:krb5-pac-attributes-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO:krb5-pac-attributes-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO::doc}}\index{KRB5\_PAC\_ATTRIBUTES\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_ATTRIBUTES\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_ATTRIBUTES_INFO:KRB5_PAC_ATTRIBUTES_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_ATTRIBUTES\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PAC attributes. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_ATTRIBUTES\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{17}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_CLIENT\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_INFO:krb5-pac-client-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_INFO:krb5-pac-client-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_INFO::doc}}\index{KRB5\_PAC\_CLIENT\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_CLIENT\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_INFO:KRB5_PAC_CLIENT_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_CLIENT\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Client name and ticket info. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_CLIENT\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{10}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_CLIENT\_CLAIMS} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS:krb5-pac-client-claims}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS:krb5-pac-client-claims-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS::doc}}\index{KRB5\_PAC\_CLIENT\_CLAIMS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_CLIENT\_CLAIMS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_CLIENT_CLAIMS:KRB5_PAC_CLIENT_CLAIMS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_CLIENT\_CLAIMS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Client claims information. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_CLIENT\_CLAIMS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{13}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_CREDENTIALS\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO:krb5-pac-credentials-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO:krb5-pac-credentials-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO::doc}}\index{KRB5\_PAC\_CREDENTIALS\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_CREDENTIALS\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_CREDENTIALS_INFO:KRB5_PAC_CREDENTIALS_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_CREDENTIALS\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Credentials information. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_CREDENTIALS\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_DELEGATION\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_DELEGATION_INFO:krb5-pac-delegation-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DELEGATION_INFO:krb5-pac-delegation-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DELEGATION_INFO::doc}}\index{KRB5\_PAC\_DELEGATION\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_DELEGATION\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_DELEGATION_INFO:KRB5_PAC_DELEGATION_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_DELEGATION\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Constrained delegation info. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_DELEGATION\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{11}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_DEVICE\_CLAIMS} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS:krb5-pac-device-claims}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS:krb5-pac-device-claims-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS::doc}}\index{KRB5\_PAC\_DEVICE\_CLAIMS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_DEVICE\_CLAIMS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_CLAIMS:KRB5_PAC_DEVICE_CLAIMS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_DEVICE\_CLAIMS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Device claims information. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_DEVICE\_CLAIMS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{15}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_DEVICE\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_INFO:krb5-pac-device-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_INFO:krb5-pac-device-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_INFO::doc}}\index{KRB5\_PAC\_DEVICE\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_DEVICE\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_DEVICE_INFO:KRB5_PAC_DEVICE_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_DEVICE\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Device information. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_DEVICE\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{14}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_LOGON\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_LOGON_INFO:krb5-pac-logon-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_LOGON_INFO:krb5-pac-logon-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_LOGON_INFO::doc}}\index{KRB5\_PAC\_LOGON\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_LOGON\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_LOGON_INFO:KRB5_PAC_LOGON_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_LOGON\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Logon information. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_LOGON\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_PRIVSVR\_CHECKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM:krb5-pac-privsvr-checksum}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM:krb5-pac-privsvr-checksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM::doc}}\index{KRB5\_PAC\_PRIVSVR\_CHECKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_PRIVSVR\_CHECKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_PRIVSVR_CHECKSUM:KRB5_PAC_PRIVSVR_CHECKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_PRIVSVR\_CHECKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -KDC checksum. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_PRIVSVR\_CHECKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{7}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_REQUESTOR} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_REQUESTOR:krb5-pac-requestor}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_REQUESTOR:krb5-pac-requestor-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_REQUESTOR::doc}}\index{KRB5\_PAC\_REQUESTOR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_REQUESTOR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_REQUESTOR:KRB5_PAC_REQUESTOR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_REQUESTOR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PAC requestor SID. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_REQUESTOR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{18}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_SERVER\_CHECKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM:krb5-pac-server-checksum}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM:krb5-pac-server-checksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM::doc}}\index{KRB5\_PAC\_SERVER\_CHECKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_SERVER\_CHECKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_SERVER_CHECKSUM:KRB5_PAC_SERVER_CHECKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_SERVER\_CHECKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Server checksum. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_SERVER\_CHECKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{6}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_TICKET\_CHECKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM:krb5-pac-ticket-checksum}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM:krb5-pac-ticket-checksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM::doc}}\index{KRB5\_PAC\_TICKET\_CHECKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_TICKET\_CHECKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_TICKET_CHECKSUM:KRB5_PAC_TICKET_CHECKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_TICKET\_CHECKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Ticket checksum. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_TICKET\_CHECKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{16}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_UPN\_DNS\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO:krb5-pac-upn-dns-info}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO:krb5-pac-upn-dns-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO::doc}}\index{KRB5\_PAC\_UPN\_DNS\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_UPN\_DNS\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_UPN_DNS_INFO:KRB5_PAC_UPN_DNS_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_UPN\_DNS\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -User principal name and DNS info. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_UPN\_DNS\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{12}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PAC\_FULL\_CHECKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_PAC_FULL_CHECKSUM:krb5-pac-full-checksum}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_FULL_CHECKSUM:krb5-pac-full-checksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_PAC_FULL_CHECKSUM::doc}}\index{KRB5\_PAC\_FULL\_CHECKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PAC\_FULL\_CHECKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PAC_FULL_CHECKSUM:KRB5_PAC_FULL_CHECKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PAC\_FULL\_CHECKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -KDC full checksum. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PAC\_FULL\_CHECKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{19}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_AFS3\_SALT} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AFS3_SALT:krb5-padata-afs3-salt}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AFS3_SALT:krb5-padata-afs3-salt-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AFS3_SALT::doc}}\index{KRB5\_PADATA\_AFS3\_SALT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_AFS3\_SALT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AFS3_SALT:KRB5_PADATA_AFS3_SALT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_AFS3\_SALT}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Cygnus. - -\sphinxAtStartPar -RFC 4120, 3961 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_AFS3\_SALT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{10}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_AP\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AP_REQ:krb5-padata-ap-req}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AP_REQ:krb5-padata-ap-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AP_REQ::doc}}\index{KRB5\_PADATA\_AP\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_AP\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AP_REQ:KRB5_PADATA_AP_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_AP\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_AP\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_AS\_CHECKSUM} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM:krb5-padata-as-checksum}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM:krb5-padata-as-checksum-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM::doc}}\index{KRB5\_PADATA\_AS\_CHECKSUM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_AS\_CHECKSUM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AS_CHECKSUM:KRB5_PADATA_AS_CHECKSUM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_AS\_CHECKSUM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -AS checksum. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_AS\_CHECKSUM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{132}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_AS\_FRESHNESS} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS:krb5-padata-as-freshness}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS:krb5-padata-as-freshness-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS::doc}}\index{KRB5\_PADATA\_AS\_FRESHNESS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_AS\_FRESHNESS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_AS_FRESHNESS:KRB5_PADATA_AS_FRESHNESS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_AS\_FRESHNESS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 8070. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_AS\_FRESHNESS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{150}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_ENCRYPTED\_CHALLENGE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE:krb5-padata-encrypted-challenge}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE:krb5-padata-encrypted-challenge-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE::doc}}\index{KRB5\_PADATA\_ENCRYPTED\_CHALLENGE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_ENCRYPTED\_CHALLENGE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENCRYPTED_CHALLENGE:KRB5_PADATA_ENCRYPTED_CHALLENGE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_ENCRYPTED\_CHALLENGE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6113. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_ENCRYPTED\_CHALLENGE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{138}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_ENC\_SANDIA\_SECURID} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID:krb5-padata-enc-sandia-securid}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID:krb5-padata-enc-sandia-securid-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID::doc}}\index{KRB5\_PADATA\_ENC\_SANDIA\_SECURID (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_ENC\_SANDIA\_SECURID}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_SANDIA_SECURID:KRB5_PADATA_ENC_SANDIA_SECURID}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_ENC\_SANDIA\_SECURID}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -SecurId passcode. - -\sphinxAtStartPar -RFC 4120 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_ENC\_SANDIA\_SECURID}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{6}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_ENC\_TIMESTAMP} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP:krb5-padata-enc-timestamp}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP:krb5-padata-enc-timestamp-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP::doc}}\index{KRB5\_PADATA\_ENC\_TIMESTAMP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_ENC\_TIMESTAMP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_TIMESTAMP:KRB5_PADATA_ENC_TIMESTAMP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_ENC\_TIMESTAMP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 4120. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_ENC\_TIMESTAMP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_ENC\_UNIX\_TIME} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME:krb5-padata-enc-unix-time}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME:krb5-padata-enc-unix-time-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME::doc}}\index{KRB5\_PADATA\_ENC\_UNIX\_TIME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_ENC\_UNIX\_TIME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ENC_UNIX_TIME:KRB5_PADATA_ENC_UNIX_TIME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_ENC\_UNIX\_TIME}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -timestamp encrypted in key. - -\sphinxAtStartPar -RFC 4120 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_ENC\_UNIX\_TIME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{5}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_ETYPE\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ETYPE_INFO:krb5-padata-etype-info}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ETYPE_INFO:krb5-padata-etype-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ETYPE_INFO::doc}}\index{KRB5\_PADATA\_ETYPE\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_ETYPE\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ETYPE_INFO:KRB5_PADATA_ETYPE_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_ETYPE\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Etype info for preauth. - -\sphinxAtStartPar -RFC 4120 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_ETYPE\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{11}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_ETYPE\_INFO2} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2:krb5-padata-etype-info2}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2:krb5-padata-etype-info2-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2::doc}}\index{KRB5\_PADATA\_ETYPE\_INFO2 (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_ETYPE\_INFO2}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_ETYPE_INFO2:KRB5_PADATA_ETYPE_INFO2}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_ETYPE\_INFO2}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 4120. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_ETYPE\_INFO2}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{19}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_FOR\_USER} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FOR_USER:krb5-padata-for-user}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FOR_USER:krb5-padata-for-user-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FOR_USER::doc}}\index{KRB5\_PADATA\_FOR\_USER (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_FOR\_USER}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FOR_USER:KRB5_PADATA_FOR_USER}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_FOR\_USER}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -username protocol transition request - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_FOR\_USER}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{129}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_FX\_COOKIE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_COOKIE:krb5-padata-fx-cookie}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_COOKIE:krb5-padata-fx-cookie-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_COOKIE::doc}}\index{KRB5\_PADATA\_FX\_COOKIE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_FX\_COOKIE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_COOKIE:KRB5_PADATA_FX_COOKIE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_FX\_COOKIE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6113. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_FX\_COOKIE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{133}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_FX\_ERROR} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_ERROR:krb5-padata-fx-error}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_ERROR:krb5-padata-fx-error-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_ERROR::doc}}\index{KRB5\_PADATA\_FX\_ERROR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_FX\_ERROR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_ERROR:KRB5_PADATA_FX_ERROR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_FX\_ERROR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6113. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_FX\_ERROR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{137}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_FX\_FAST} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_FAST:krb5-padata-fx-fast}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_FAST:krb5-padata-fx-fast-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_FAST::doc}}\index{KRB5\_PADATA\_FX\_FAST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_FX\_FAST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_FX_FAST:KRB5_PADATA_FX_FAST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_FX\_FAST}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6113. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_FX\_FAST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{136}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_GET\_FROM\_TYPED\_DATA} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA:krb5-padata-get-from-typed-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA:krb5-padata-get-from-typed-data-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA::doc}}\index{KRB5\_PADATA\_GET\_FROM\_TYPED\_DATA (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_GET\_FROM\_TYPED\_DATA}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_GET_FROM_TYPED_DATA:KRB5_PADATA_GET_FROM_TYPED_DATA}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_GET\_FROM\_TYPED\_DATA}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Embedded in typed data. - -\sphinxAtStartPar -RFC 4120 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_GET\_FROM\_TYPED\_DATA}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{22}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_NONE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_NONE:krb5-padata-none}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_NONE:krb5-padata-none-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_NONE::doc}}\index{KRB5\_PADATA\_NONE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_NONE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_NONE:KRB5_PADATA_NONE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_NONE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_NONE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_OSF\_DCE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OSF_DCE:krb5-padata-osf-dce}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OSF_DCE:krb5-padata-osf-dce-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OSF_DCE::doc}}\index{KRB5\_PADATA\_OSF\_DCE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_OSF\_DCE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OSF_DCE:KRB5_PADATA_OSF_DCE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_OSF\_DCE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -OSF DCE. - -\sphinxAtStartPar -RFC 4120 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_OSF\_DCE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{8}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_OTP\_CHALLENGE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE:krb5-padata-otp-challenge}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE:krb5-padata-otp-challenge-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE::doc}}\index{KRB5\_PADATA\_OTP\_CHALLENGE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_OTP\_CHALLENGE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_CHALLENGE:KRB5_PADATA_OTP_CHALLENGE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_OTP\_CHALLENGE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6560 section 4.1. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_OTP\_CHALLENGE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{141}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_OTP\_PIN\_CHANGE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE:krb5-padata-otp-pin-change}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE:krb5-padata-otp-pin-change-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE::doc}}\index{KRB5\_PADATA\_OTP\_PIN\_CHANGE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_OTP\_PIN\_CHANGE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_PIN_CHANGE:KRB5_PADATA_OTP_PIN_CHANGE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_OTP\_PIN\_CHANGE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6560 section 4.3. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_OTP\_PIN\_CHANGE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{144}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_OTP\_REQUEST} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_REQUEST:krb5-padata-otp-request}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_REQUEST:krb5-padata-otp-request-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_REQUEST::doc}}\index{KRB5\_PADATA\_OTP\_REQUEST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_OTP\_REQUEST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_OTP_REQUEST:KRB5_PADATA_OTP_REQUEST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_OTP\_REQUEST}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6560 section 4.2. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_OTP\_REQUEST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{142}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_PAC\_OPTIONS} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS:krb5-padata-pac-options}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS:krb5-padata-pac-options-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS::doc}}\index{KRB5\_PADATA\_PAC\_OPTIONS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_PAC\_OPTIONS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PAC_OPTIONS:KRB5_PADATA_PAC_OPTIONS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_PAC\_OPTIONS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -MS\sphinxhyphen{}KILE and MS\sphinxhyphen{}SFU. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_PAC\_OPTIONS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{167}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_PAC\_REQUEST} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PAC_REQUEST:krb5-padata-pac-request}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PAC_REQUEST:krb5-padata-pac-request-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PAC_REQUEST::doc}}\index{KRB5\_PADATA\_PAC\_REQUEST (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_PAC\_REQUEST}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PAC_REQUEST:KRB5_PADATA_PAC_REQUEST}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_PAC\_REQUEST}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -include Windows PAC - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_PAC\_REQUEST}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{128}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_PKINIT\_KX} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PKINIT_KX:krb5-padata-pkinit-kx}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PKINIT_KX:krb5-padata-pkinit-kx-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PKINIT_KX::doc}}\index{KRB5\_PADATA\_PKINIT\_KX (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_PKINIT\_KX}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PKINIT_KX:KRB5_PADATA_PKINIT_KX}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_PKINIT\_KX}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 6112. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_PKINIT\_KX}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{147}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_PK\_AS\_REP} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REP:krb5-padata-pk-as-rep}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REP:krb5-padata-pk-as-rep-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REP::doc}}\index{KRB5\_PADATA\_PK\_AS\_REP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_PK\_AS\_REP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REP:KRB5_PADATA_PK_AS_REP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_PK\_AS\_REP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PKINIT. - -\sphinxAtStartPar -RFC 4556 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_PK\_AS\_REP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{17}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_PK\_AS\_REP\_OLD} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD:krb5-padata-pk-as-rep-old}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD:krb5-padata-pk-as-rep-old-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD::doc}}\index{KRB5\_PADATA\_PK\_AS\_REP\_OLD (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_PK\_AS\_REP\_OLD}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REP_OLD:KRB5_PADATA_PK_AS_REP_OLD}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_PK\_AS\_REP\_OLD}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PKINIT. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_PK\_AS\_REP\_OLD}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{15}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_PK\_AS\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REQ:krb5-padata-pk-as-req}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REQ:krb5-padata-pk-as-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REQ::doc}}\index{KRB5\_PADATA\_PK\_AS\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_PK\_AS\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REQ:KRB5_PADATA_PK_AS_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_PK\_AS\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PKINIT. - -\sphinxAtStartPar -RFC 4556 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_PK\_AS\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{16}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_PK\_AS\_REQ\_OLD} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD:krb5-padata-pk-as-req-old}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD:krb5-padata-pk-as-req-old-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD::doc}}\index{KRB5\_PADATA\_PK\_AS\_REQ\_OLD (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_PK\_AS\_REQ\_OLD}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PK_AS_REQ_OLD:KRB5_PADATA_PK_AS_REQ_OLD}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_PK\_AS\_REQ\_OLD}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PKINIT. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_PK\_AS\_REQ\_OLD}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{14}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_PW\_SALT} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PW_SALT:krb5-padata-pw-salt}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PW_SALT:krb5-padata-pw-salt-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PW_SALT::doc}}\index{KRB5\_PADATA\_PW\_SALT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_PW\_SALT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_PW_SALT:KRB5_PADATA_PW_SALT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_PW\_SALT}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 4120. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_PW\_SALT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{3}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_REFERRAL} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REFERRAL:krb5-padata-referral}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REFERRAL:krb5-padata-referral-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REFERRAL::doc}}\index{KRB5\_PADATA\_REFERRAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_REFERRAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REFERRAL:KRB5_PADATA_REFERRAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_REFERRAL}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -draft referral system - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_REFERRAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{25}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_S4U\_X509\_USER} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_S4U_X509_USER:krb5-padata-s4u-x509-user}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_S4U_X509_USER:krb5-padata-s4u-x509-user-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_S4U_X509_USER::doc}}\index{KRB5\_PADATA\_S4U\_X509\_USER (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_S4U\_X509\_USER}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_S4U_X509_USER:KRB5_PADATA_S4U_X509_USER}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_S4U\_X509\_USER}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -certificate protocol transition request - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_S4U\_X509\_USER}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{130}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_SAM\_CHALLENGE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE:krb5-padata-sam-challenge}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE:krb5-padata-sam-challenge-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE::doc}}\index{KRB5\_PADATA\_SAM\_CHALLENGE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_SAM\_CHALLENGE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE:KRB5_PADATA_SAM_CHALLENGE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_SAM\_CHALLENGE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -SAM/OTP. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_SAM\_CHALLENGE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{12}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_SAM\_CHALLENGE\_2} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2:krb5-padata-sam-challenge-2}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2:krb5-padata-sam-challenge-2-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2::doc}}\index{KRB5\_PADATA\_SAM\_CHALLENGE\_2 (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_SAM\_CHALLENGE\_2}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_CHALLENGE_2:KRB5_PADATA_SAM_CHALLENGE_2}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_SAM\_CHALLENGE\_2}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -draft challenge system, updated - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_SAM\_CHALLENGE\_2}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{30}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_SAM\_REDIRECT} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT:krb5-padata-sam-redirect}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT:krb5-padata-sam-redirect-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT::doc}}\index{KRB5\_PADATA\_SAM\_REDIRECT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_SAM\_REDIRECT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_REDIRECT:KRB5_PADATA_SAM_REDIRECT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_SAM\_REDIRECT}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -SAM/OTP. - -\sphinxAtStartPar -RFC 4120 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_SAM\_REDIRECT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{21}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_SAM\_RESPONSE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE:krb5-padata-sam-response}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE:krb5-padata-sam-response-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE::doc}}\index{KRB5\_PADATA\_SAM\_RESPONSE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_SAM\_RESPONSE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE:KRB5_PADATA_SAM_RESPONSE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_SAM\_RESPONSE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -SAM/OTP. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_SAM\_RESPONSE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{13}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_SAM\_RESPONSE\_2} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2:krb5-padata-sam-response-2}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2:krb5-padata-sam-response-2-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2::doc}}\index{KRB5\_PADATA\_SAM\_RESPONSE\_2 (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_SAM\_RESPONSE\_2}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SAM_RESPONSE_2:KRB5_PADATA_SAM_RESPONSE_2}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_SAM\_RESPONSE\_2}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -draft challenge system, updated - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_SAM\_RESPONSE\_2}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{31}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_SESAME} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SESAME:krb5-padata-sesame}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SESAME:krb5-padata-sesame-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SESAME::doc}}\index{KRB5\_PADATA\_SESAME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_SESAME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SESAME:KRB5_PADATA_SESAME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_SESAME}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Sesame project. - -\sphinxAtStartPar -RFC 4120 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_SESAME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{7}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_SPAKE} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SPAKE:krb5-padata-spake}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SPAKE:krb5-padata-spake-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SPAKE::doc}}\index{KRB5\_PADATA\_SPAKE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_SPAKE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SPAKE:KRB5_PADATA_SPAKE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_SPAKE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_SPAKE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{151}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2:krb5-padata-redhat-idp-oauth2}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2:krb5-padata-redhat-idp-oauth2-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2::doc}}\index{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2 (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_IDP_OAUTH2:KRB5_PADATA_REDHAT_IDP_OAUTH2}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Red Hat IdP mechanism. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_REDHAT\_IDP\_OAUTH2}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{152}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_REDHAT\_PASSKEY} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_PASSKEY:krb5-padata-redhat-passkey}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_PASSKEY:krb5-padata-redhat-passkey-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_PASSKEY::doc}}\index{KRB5\_PADATA\_REDHAT\_PASSKEY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_REDHAT\_PASSKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_REDHAT_PASSKEY:KRB5_PADATA_REDHAT_PASSKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_REDHAT\_PASSKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Red Hat Passkey mechanism. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_REDHAT\_PASSKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{153}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_SVR\_REFERRAL\_INFO} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO:krb5-padata-svr-referral-info}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO:krb5-padata-svr-referral-info-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO::doc}}\index{KRB5\_PADATA\_SVR\_REFERRAL\_INFO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_SVR\_REFERRAL\_INFO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_SVR_REFERRAL_INFO:KRB5_PADATA_SVR_REFERRAL_INFO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_SVR\_REFERRAL\_INFO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Windows 2000 referrals. - -\sphinxAtStartPar -RFC 6820 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_SVR\_REFERRAL\_INFO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{20}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_TGS\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_TGS_REQ:krb5-padata-tgs-req}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_TGS_REQ:krb5-padata-tgs-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_TGS_REQ::doc}}\index{KRB5\_PADATA\_TGS\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_TGS\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_TGS_REQ:KRB5_PADATA_TGS_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_TGS\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_TGS\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_AP\_REQ}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PADATA\_USE\_SPECIFIED\_KVNO} -\label{\detokenize{appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO:krb5-padata-use-specified-kvno}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO:krb5-padata-use-specified-kvno-data}}\label{\detokenize{appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO::doc}}\index{KRB5\_PADATA\_USE\_SPECIFIED\_KVNO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PADATA\_USE\_SPECIFIED\_KVNO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PADATA_USE_SPECIFIED_KVNO:KRB5_PADATA_USE_SPECIFIED_KVNO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PADATA\_USE\_SPECIFIED\_KVNO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -RFC 4120. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PADATA\_USE\_SPECIFIED\_KVNO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{20}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_COMPARE\_CASEFOLD} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD:krb5-principal-compare-casefold}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD:krb5-principal-compare-casefold-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD::doc}}\index{KRB5\_PRINCIPAL\_COMPARE\_CASEFOLD (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_COMPARE\_CASEFOLD}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_CASEFOLD:KRB5_PRINCIPAL_COMPARE_CASEFOLD}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_COMPARE\_CASEFOLD}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -case\sphinxhyphen{}insensitive - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_COMPARE\_CASEFOLD}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_COMPARE\_ENTERPRISE} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE:krb5-principal-compare-enterprise}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE:krb5-principal-compare-enterprise-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE::doc}}\index{KRB5\_PRINCIPAL\_COMPARE\_ENTERPRISE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_COMPARE\_ENTERPRISE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_ENTERPRISE:KRB5_PRINCIPAL_COMPARE_ENTERPRISE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_COMPARE\_ENTERPRISE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -UPNs as real principals. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_COMPARE\_ENTERPRISE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_COMPARE\_IGNORE\_REALM} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM:krb5-principal-compare-ignore-realm}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM:krb5-principal-compare-ignore-realm-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM::doc}}\index{KRB5\_PRINCIPAL\_COMPARE\_IGNORE\_REALM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_COMPARE\_IGNORE\_REALM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_IGNORE_REALM:KRB5_PRINCIPAL_COMPARE_IGNORE_REALM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_COMPARE\_IGNORE\_REALM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -ignore realm component - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_COMPARE\_IGNORE\_REALM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_COMPARE\_UTF8} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8:krb5-principal-compare-utf8}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8:krb5-principal-compare-utf8-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8::doc}}\index{KRB5\_PRINCIPAL\_COMPARE\_UTF8 (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_COMPARE\_UTF8}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_COMPARE_UTF8:KRB5_PRINCIPAL_COMPARE_UTF8}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_COMPARE\_UTF8}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -treat principals as UTF\sphinxhyphen{}8 - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_COMPARE\_UTF8}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{8}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_PARSE\_ENTERPRISE} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE:krb5-principal-parse-enterprise}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE:krb5-principal-parse-enterprise-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE::doc}}\index{KRB5\_PRINCIPAL\_PARSE\_ENTERPRISE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_PARSE\_ENTERPRISE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_ENTERPRISE:KRB5_PRINCIPAL_PARSE_ENTERPRISE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_ENTERPRISE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Create single\sphinxhyphen{}component enterprise principle. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_ENTERPRISE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_PARSE\_IGNORE\_REALM} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM:krb5-principal-parse-ignore-realm}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM:krb5-principal-parse-ignore-realm-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM::doc}}\index{KRB5\_PRINCIPAL\_PARSE\_IGNORE\_REALM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_PARSE\_IGNORE\_REALM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_IGNORE_REALM:KRB5_PRINCIPAL_PARSE_IGNORE_REALM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_IGNORE\_REALM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Ignore realm if present. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_IGNORE\_REALM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x8}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_PARSE\_NO\_DEF\_REALM} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM:krb5-principal-parse-no-def-realm}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM:krb5-principal-parse-no-def-realm-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM::doc}}\index{KRB5\_PRINCIPAL\_PARSE\_NO\_DEF\_REALM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_PARSE\_NO\_DEF\_REALM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_DEF_REALM:KRB5_PRINCIPAL_PARSE_NO_DEF_REALM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_NO\_DEF\_REALM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Don’t add default realm. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_NO\_DEF\_REALM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x10}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_PARSE\_NO\_REALM} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM:krb5-principal-parse-no-realm}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM:krb5-principal-parse-no-realm-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM::doc}}\index{KRB5\_PRINCIPAL\_PARSE\_NO\_REALM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_PARSE\_NO\_REALM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_NO_REALM:KRB5_PRINCIPAL_PARSE_NO_REALM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_NO\_REALM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Error if realm is present. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_NO\_REALM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_PARSE\_REQUIRE\_REALM} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM:krb5-principal-parse-require-realm}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM:krb5-principal-parse-require-realm-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM::doc}}\index{KRB5\_PRINCIPAL\_PARSE\_REQUIRE\_REALM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_PARSE\_REQUIRE\_REALM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_PARSE_REQUIRE_REALM:KRB5_PRINCIPAL_PARSE_REQUIRE_REALM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_REQUIRE\_REALM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Error if realm is not present. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_PARSE\_REQUIRE\_REALM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_UNPARSE\_DISPLAY} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY:krb5-principal-unparse-display}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY:krb5-principal-unparse-display-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY::doc}}\index{KRB5\_PRINCIPAL\_UNPARSE\_DISPLAY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_UNPARSE\_DISPLAY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_DISPLAY:KRB5_PRINCIPAL_UNPARSE_DISPLAY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_UNPARSE\_DISPLAY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Don’t escape special characters. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_UNPARSE\_DISPLAY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_UNPARSE\_NO\_REALM} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM:krb5-principal-unparse-no-realm}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM:krb5-principal-unparse-no-realm-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM::doc}}\index{KRB5\_PRINCIPAL\_UNPARSE\_NO\_REALM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_UNPARSE\_NO\_REALM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_NO_REALM:KRB5_PRINCIPAL_UNPARSE_NO_REALM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_UNPARSE\_NO\_REALM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Omit realm always. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_UNPARSE\_NO\_REALM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRINCIPAL\_UNPARSE\_SHORT} -\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT:krb5-principal-unparse-short}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT:krb5-principal-unparse-short-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT::doc}}\index{KRB5\_PRINCIPAL\_UNPARSE\_SHORT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRINCIPAL\_UNPARSE\_SHORT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRINCIPAL_UNPARSE_SHORT:KRB5_PRINCIPAL_UNPARSE_SHORT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRINCIPAL\_UNPARSE\_SHORT}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Omit realm if it is the local realm. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRINCIPAL\_UNPARSE\_SHORT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PRIV} -\label{\detokenize{appdev/refs/macros/KRB5_PRIV:krb5-priv}}\label{\detokenize{appdev/refs/macros/KRB5_PRIV:krb5-priv-data}}\label{\detokenize{appdev/refs/macros/KRB5_PRIV::doc}}\index{KRB5\_PRIV (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PRIV}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PRIV:KRB5_PRIV}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PRIV}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Private application message. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PRIV}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)21)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD} -\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD:krb5-prompt-type-new-password}}\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD:krb5-prompt-type-new-password-data}}\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD::doc}}\index{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD:KRB5_PROMPT_TYPE_NEW_PASSWORD}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Prompt for new password (during password change) - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD\_AGAIN} -\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN:krb5-prompt-type-new-password-again}}\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN:krb5-prompt-type-new-password-again-data}}\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN::doc}}\index{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD\_AGAIN (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD\_AGAIN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN:KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD\_AGAIN}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Prompt for new password again. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PROMPT\_TYPE\_NEW\_PASSWORD\_AGAIN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x3}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PROMPT\_TYPE\_PASSWORD} -\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD:krb5-prompt-type-password}}\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD:krb5-prompt-type-password-data}}\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD::doc}}\index{KRB5\_PROMPT\_TYPE\_PASSWORD (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PROMPT\_TYPE\_PASSWORD}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_PASSWORD:KRB5_PROMPT_TYPE_PASSWORD}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PROMPT\_TYPE\_PASSWORD}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Prompt for password. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PROMPT\_TYPE\_PASSWORD}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PROMPT\_TYPE\_PREAUTH} -\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH:krb5-prompt-type-preauth}}\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH:krb5-prompt-type-preauth-data}}\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH::doc}}\index{KRB5\_PROMPT\_TYPE\_PREAUTH (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PROMPT\_TYPE\_PREAUTH}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PROMPT_TYPE_PREAUTH:KRB5_PROMPT_TYPE_PREAUTH}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PROMPT\_TYPE\_PREAUTH}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Prompt for preauthentication data (such as an OTP value) - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PROMPT\_TYPE\_PREAUTH}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x4}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_PVNO} -\label{\detokenize{appdev/refs/macros/KRB5_PVNO:krb5-pvno}}\label{\detokenize{appdev/refs/macros/KRB5_PVNO:krb5-pvno-data}}\label{\detokenize{appdev/refs/macros/KRB5_PVNO::doc}}\index{KRB5\_PVNO (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_PVNO}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_PVNO:KRB5_PVNO}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_PVNO}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Protocol version number. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_PVNO}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{5}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_REALM\_BRANCH\_CHAR} -\label{\detokenize{appdev/refs/macros/KRB5_REALM_BRANCH_CHAR:krb5-realm-branch-char}}\label{\detokenize{appdev/refs/macros/KRB5_REALM_BRANCH_CHAR:krb5-realm-branch-char-data}}\label{\detokenize{appdev/refs/macros/KRB5_REALM_BRANCH_CHAR::doc}}\index{KRB5\_REALM\_BRANCH\_CHAR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_REALM\_BRANCH\_CHAR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_REALM_BRANCH_CHAR:KRB5_REALM_BRANCH_CHAR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_REALM\_BRANCH\_CHAR}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_REALM\_BRANCH\_CHAR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{\textquotesingle{}.\textquotesingle{}}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RECVAUTH\_BADAUTHVERS} -\label{\detokenize{appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS:krb5-recvauth-badauthvers}}\label{\detokenize{appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS:krb5-recvauth-badauthvers-data}}\label{\detokenize{appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS::doc}}\index{KRB5\_RECVAUTH\_BADAUTHVERS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RECVAUTH\_BADAUTHVERS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RECVAUTH_BADAUTHVERS:KRB5_RECVAUTH_BADAUTHVERS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RECVAUTH\_BADAUTHVERS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RECVAUTH\_BADAUTHVERS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RECVAUTH\_SKIP\_VERSION} -\label{\detokenize{appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION:krb5-recvauth-skip-version}}\label{\detokenize{appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION:krb5-recvauth-skip-version-data}}\label{\detokenize{appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION::doc}}\index{KRB5\_RECVAUTH\_SKIP\_VERSION (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RECVAUTH\_SKIP\_VERSION}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RECVAUTH_SKIP_VERSION:KRB5_RECVAUTH_SKIP_VERSION}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RECVAUTH\_SKIP\_VERSION}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RECVAUTH\_SKIP\_VERSION}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_REFERRAL\_REALM} -\label{\detokenize{appdev/refs/macros/KRB5_REFERRAL_REALM:krb5-referral-realm}}\label{\detokenize{appdev/refs/macros/KRB5_REFERRAL_REALM:krb5-referral-realm-data}}\label{\detokenize{appdev/refs/macros/KRB5_REFERRAL_REALM::doc}}\index{KRB5\_REFERRAL\_REALM (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_REFERRAL\_REALM}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_REFERRAL_REALM:KRB5_REFERRAL_REALM}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_REFERRAL\_REALM}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Constant for realm referrals. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_REFERRAL\_REALM}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{""}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_COUNT\_LOW} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW:krb5-responder-pkinit-flags-token-user-pin-count-low}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW:krb5-responder-pkinit-flags-token-user-pin-count-low-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW::doc}}\index{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_COUNT\_LOW (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_COUNT\_LOW}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW:KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_COUNT_LOW}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_COUNT\_LOW}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -This flag indicates that an incorrect PIN was supplied at least once since the last time the correct PIN was supplied. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_COUNT\_LOW}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(1 \textless{}\textless{} 0)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_FINAL\_TRY} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY:krb5-responder-pkinit-flags-token-user-pin-final-try}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY:krb5-responder-pkinit-flags-token-user-pin-final-try-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY::doc}}\index{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_FINAL\_TRY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_FINAL\_TRY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY:KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_FINAL_TRY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_FINAL\_TRY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -This flag indicates that supplying an incorrect PIN will cause the token to lock itself. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_FINAL\_TRY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(1 \textless{}\textless{} 1)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_LOCKED} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED:krb5-responder-pkinit-flags-token-user-pin-locked}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED:krb5-responder-pkinit-flags-token-user-pin-locked-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED::doc}}\index{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_LOCKED (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_LOCKED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED:KRB5_RESPONDER_PKINIT_FLAGS_TOKEN_USER_PIN_LOCKED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_LOCKED}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -This flag indicates that the user PIN is locked, and you can’t log in to the token with it. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_USER\_PIN\_LOCKED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(1 \textless{}\textless{} 2)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_QUESTION\_PKINIT} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT:krb5-responder-question-pkinit}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT:krb5-responder-question-pkinit-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT::doc}}\index{KRB5\_RESPONDER\_QUESTION\_PKINIT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_QUESTION\_PKINIT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_PKINIT:KRB5_RESPONDER_QUESTION_PKINIT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_PKINIT}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -PKINIT responder question. - -\sphinxAtStartPar -The PKINIT responder question is asked when the client needs a password that’s being used to protect key information, and is formatted as a JSON object. A specific identity’s flags value, if not zero, is the bitwise\sphinxhyphen{}OR of one or more of the KRB5\_RESPONDER\_PKINIT\_FLAGS\_TOKEN\_* flags defined below, and possibly other flags to be added later. Any resemblance to similarly\sphinxhyphen{}named CKF\_* values in the PKCS\#11 API should not be depended on. - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{\PYGZob{}} -\PYG{+w}{ }\PYG{n}{identity}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{o}{\PYGZgt{}}\PYG{+w}{ }\PYG{o}{:}\PYG{+w}{ }\PYG{n}{flags}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{number}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{p}{.}\PYG{p}{.}\PYG{p}{.} -\PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The answer to the question MUST be JSON formatted: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{\PYGZob{}} -\PYG{+w}{ }\PYG{n}{identity}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{o}{\PYGZgt{}}\PYG{+w}{ }\PYG{o}{:}\PYG{+w}{ }\PYG{n}{password}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{p}{.}\PYG{p}{.}\PYG{p}{.} -\PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_PKINIT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{"pkinit"}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_PIN} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN:krb5-responder-otp-flags-collect-pin}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN:krb5-responder-otp-flags-collect-pin-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN::doc}}\index{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_PIN (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_PIN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN:KRB5_RESPONDER_OTP_FLAGS_COLLECT_PIN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_PIN}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -This flag indicates that the PIN value MUST be collected. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_PIN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_TOKEN} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN:krb5-responder-otp-flags-collect-token}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN:krb5-responder-otp-flags-collect-token-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN::doc}}\index{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_TOKEN (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_TOKEN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN:KRB5_RESPONDER_OTP_FLAGS_COLLECT_TOKEN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_TOKEN}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -This flag indicates that the token value MUST be collected. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_TOKEN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_OTP\_FLAGS\_NEXTOTP} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP:krb5-responder-otp-flags-nextotp}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP:krb5-responder-otp-flags-nextotp-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP::doc}}\index{KRB5\_RESPONDER\_OTP\_FLAGS\_NEXTOTP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_OTP\_FLAGS\_NEXTOTP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_NEXTOTP:KRB5_RESPONDER_OTP_FLAGS_NEXTOTP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FLAGS\_NEXTOTP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -This flag indicates that the token is now in re\sphinxhyphen{}synchronization mode with the server. - -\sphinxAtStartPar -The user is expected to reply with the next code displayed on the token. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FLAGS\_NEXTOTP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0004}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_OTP\_FLAGS\_SEPARATE\_PIN} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN:krb5-responder-otp-flags-separate-pin}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN:krb5-responder-otp-flags-separate-pin-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN::doc}}\index{KRB5\_RESPONDER\_OTP\_FLAGS\_SEPARATE\_PIN (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_OTP\_FLAGS\_SEPARATE\_PIN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN:KRB5_RESPONDER_OTP_FLAGS_SEPARATE_PIN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FLAGS\_SEPARATE\_PIN}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -This flag indicates that the PIN MUST be returned as a separate item. - -\sphinxAtStartPar -This flag only takes effect if KRB5\_RESPONDER\_OTP\_FLAGS\_COLLECT\_PIN is set. If this flag is not set, the responder may either concatenate PIN + token value and store it as “value” in the answer or it may return them separately. If they are returned separately, they will be concatenated internally. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FLAGS\_SEPARATE\_PIN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0008}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_OTP\_FORMAT\_ALPHANUMERIC} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC:krb5-responder-otp-format-alphanumeric}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC:krb5-responder-otp-format-alphanumeric-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC::doc}}\index{KRB5\_RESPONDER\_OTP\_FORMAT\_ALPHANUMERIC (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_OTP\_FORMAT\_ALPHANUMERIC}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC:KRB5_RESPONDER_OTP_FORMAT_ALPHANUMERIC}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FORMAT\_ALPHANUMERIC}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FORMAT\_ALPHANUMERIC}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{2}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_OTP\_FORMAT\_DECIMAL} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL:krb5-responder-otp-format-decimal}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL:krb5-responder-otp-format-decimal-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL::doc}}\index{KRB5\_RESPONDER\_OTP\_FORMAT\_DECIMAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_OTP\_FORMAT\_DECIMAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_DECIMAL:KRB5_RESPONDER_OTP_FORMAT_DECIMAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FORMAT\_DECIMAL}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -These format constants identify the format of the token value. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FORMAT\_DECIMAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_OTP\_FORMAT\_HEXADECIMAL} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL:krb5-responder-otp-format-hexadecimal}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL:krb5-responder-otp-format-hexadecimal-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL::doc}}\index{KRB5\_RESPONDER\_OTP\_FORMAT\_HEXADECIMAL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_OTP\_FORMAT\_HEXADECIMAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL:KRB5_RESPONDER_OTP_FORMAT_HEXADECIMAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FORMAT\_HEXADECIMAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_OTP\_FORMAT\_HEXADECIMAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_QUESTION\_OTP} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP:krb5-responder-question-otp}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP:krb5-responder-question-otp-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP::doc}}\index{KRB5\_RESPONDER\_QUESTION\_OTP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_QUESTION\_OTP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_OTP:KRB5_RESPONDER_QUESTION_OTP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_OTP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -OTP responder question. - -\sphinxAtStartPar -The OTP responder question is asked when the KDC indicates that an OTP value is required in order to complete the authentication. The JSON format of the challenge is: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{\PYGZob{}} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{service}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{tokenInfo}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{p}{[} -\PYG{+w}{ }\PYG{p}{\PYGZob{}} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{flags}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{number}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{vendor}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{challenge}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{length}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{number}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{format}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{number}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{tokenID}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{algID}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{p}{\PYGZcb{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{p}{.}\PYG{p}{.}\PYG{p}{.} -\PYG{+w}{ }\PYG{p}{]} -\PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The answer to the question MUST be JSON formatted: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{p}{\PYGZob{}} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{tokeninfo}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{number}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{value}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{+w}{ }\PYG{l+s}{\PYGZdq{}}\PYG{l+s}{pin}\PYG{l+s}{\PYGZdq{}}\PYG{o}{:}\PYG{+w}{ }\PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{+w}{ }\PYG{p}{(}\PYG{n}{optional}\PYG{p}{)}\PYG{o}{\PYGZgt{}}\PYG{p}{,} -\PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -For more detail, please see RFC 6560. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_OTP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{"otp"}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_RESPONDER\_QUESTION\_PASSWORD} -\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD:krb5-responder-question-password}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD:krb5-responder-question-password-data}}\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD::doc}}\index{KRB5\_RESPONDER\_QUESTION\_PASSWORD (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_RESPONDER\_QUESTION\_PASSWORD}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_RESPONDER_QUESTION_PASSWORD:KRB5_RESPONDER_QUESTION_PASSWORD}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_PASSWORD}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Long\sphinxhyphen{}term password responder question. - -\sphinxAtStartPar -This question is asked when the long\sphinxhyphen{}term password is needed. It has no challenge and the response is simply the password string. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_RESPONDER\_QUESTION\_PASSWORD}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{"password"}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_SAFE} -\label{\detokenize{appdev/refs/macros/KRB5_SAFE:krb5-safe}}\label{\detokenize{appdev/refs/macros/KRB5_SAFE:krb5-safe-data}}\label{\detokenize{appdev/refs/macros/KRB5_SAFE::doc}}\index{KRB5\_SAFE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_SAFE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_SAFE:KRB5_SAFE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_SAFE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Safe application message. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_SAFE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)20)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_SAM\_MUST\_PK\_ENCRYPT\_SAD} -\label{\detokenize{appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD:krb5-sam-must-pk-encrypt-sad}}\label{\detokenize{appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD:krb5-sam-must-pk-encrypt-sad-data}}\label{\detokenize{appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD::doc}}\index{KRB5\_SAM\_MUST\_PK\_ENCRYPT\_SAD (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_SAM\_MUST\_PK\_ENCRYPT\_SAD}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_SAM_MUST_PK_ENCRYPT_SAD:KRB5_SAM_MUST_PK_ENCRYPT_SAD}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_SAM\_MUST\_PK\_ENCRYPT\_SAD}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -currently must be zero - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_SAM\_MUST\_PK\_ENCRYPT\_SAD}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x20000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_SAM\_SEND\_ENCRYPTED\_SAD} -\label{\detokenize{appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD:krb5-sam-send-encrypted-sad}}\label{\detokenize{appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD:krb5-sam-send-encrypted-sad-data}}\label{\detokenize{appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD::doc}}\index{KRB5\_SAM\_SEND\_ENCRYPTED\_SAD (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_SAM\_SEND\_ENCRYPTED\_SAD}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_SAM_SEND_ENCRYPTED_SAD:KRB5_SAM_SEND_ENCRYPTED_SAD}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_SAM\_SEND\_ENCRYPTED\_SAD}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_SAM\_SEND\_ENCRYPTED\_SAD}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x40000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_SAM\_USE\_SAD\_AS\_KEY} -\label{\detokenize{appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY:krb5-sam-use-sad-as-key}}\label{\detokenize{appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY:krb5-sam-use-sad-as-key-data}}\label{\detokenize{appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY::doc}}\index{KRB5\_SAM\_USE\_SAD\_AS\_KEY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_SAM\_USE\_SAD\_AS\_KEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_SAM_USE_SAD_AS_KEY:KRB5_SAM_USE_SAD_AS_KEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_SAM\_USE\_SAD\_AS\_KEY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_SAM\_USE\_SAD\_AS\_KEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x80000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_2ND\_TKT} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT:krb5-tc-match-2nd-tkt}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT:krb5-tc-match-2nd-tkt-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT::doc}}\index{KRB5\_TC\_MATCH\_2ND\_TKT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_2ND\_TKT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_2ND_TKT:KRB5_TC_MATCH_2ND_TKT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_2ND\_TKT}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -The second ticket must match. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_2ND\_TKT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000080}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_AUTHDATA} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA:krb5-tc-match-authdata}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA:krb5-tc-match-authdata-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA::doc}}\index{KRB5\_TC\_MATCH\_AUTHDATA (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_AUTHDATA}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_AUTHDATA:KRB5_TC_MATCH_AUTHDATA}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_AUTHDATA}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -The authorization data must match. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_AUTHDATA}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000020}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_FLAGS} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_FLAGS:krb5-tc-match-flags}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_FLAGS:krb5-tc-match-flags-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_FLAGS::doc}}\index{KRB5\_TC\_MATCH\_FLAGS (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_FLAGS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_FLAGS:KRB5_TC_MATCH_FLAGS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_FLAGS}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -All the flags set in the match credentials must be set. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_FLAGS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000004}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_FLAGS\_EXACT} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT:krb5-tc-match-flags-exact}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT:krb5-tc-match-flags-exact-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT::doc}}\index{KRB5\_TC\_MATCH\_FLAGS\_EXACT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_FLAGS\_EXACT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_FLAGS_EXACT:KRB5_TC_MATCH_FLAGS_EXACT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_FLAGS\_EXACT}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -All the flags must match exactly. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_FLAGS\_EXACT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000010}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_IS\_SKEY} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY:krb5-tc-match-is-skey}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY:krb5-tc-match-is-skey-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY::doc}}\index{KRB5\_TC\_MATCH\_IS\_SKEY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_IS\_SKEY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_IS_SKEY:KRB5_TC_MATCH_IS_SKEY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_IS\_SKEY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -The is\_skey field must match exactly. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_IS\_SKEY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_KTYPE} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_KTYPE:krb5-tc-match-ktype}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_KTYPE:krb5-tc-match-ktype-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_KTYPE::doc}}\index{KRB5\_TC\_MATCH\_KTYPE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_KTYPE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_KTYPE:KRB5_TC_MATCH_KTYPE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_KTYPE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -The encryption key type must match. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_KTYPE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000100}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_SRV\_NAMEONLY} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY:krb5-tc-match-srv-nameonly}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY:krb5-tc-match-srv-nameonly-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY::doc}}\index{KRB5\_TC\_MATCH\_SRV\_NAMEONLY (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_SRV\_NAMEONLY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_SRV_NAMEONLY:KRB5_TC_MATCH_SRV_NAMEONLY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_SRV\_NAMEONLY}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Only the name portion of the principal name must match. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_SRV\_NAMEONLY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000040}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_TIMES} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_TIMES:krb5-tc-match-times}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_TIMES:krb5-tc-match-times-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_TIMES::doc}}\index{KRB5\_TC\_MATCH\_TIMES (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_TIMES}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_TIMES:KRB5_TC_MATCH_TIMES}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_TIMES}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -The requested lifetime must be at least as great as the time specified. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_TIMES}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_MATCH\_TIMES\_EXACT} -\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT:krb5-tc-match-times-exact}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT:krb5-tc-match-times-exact-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT::doc}}\index{KRB5\_TC\_MATCH\_TIMES\_EXACT (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_MATCH\_TIMES\_EXACT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_MATCH_TIMES_EXACT:KRB5_TC_MATCH_TIMES_EXACT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_MATCH\_TIMES\_EXACT}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -All the time fields must match exactly. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_MATCH\_TIMES\_EXACT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000008}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_NOTICKET} -\label{\detokenize{appdev/refs/macros/KRB5_TC_NOTICKET:krb5-tc-noticket}}\label{\detokenize{appdev/refs/macros/KRB5_TC_NOTICKET:krb5-tc-noticket-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_NOTICKET::doc}}\index{KRB5\_TC\_NOTICKET (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_NOTICKET}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_NOTICKET:KRB5_TC_NOTICKET}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_NOTICKET}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_NOTICKET}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000002}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_OPENCLOSE} -\label{\detokenize{appdev/refs/macros/KRB5_TC_OPENCLOSE:krb5-tc-openclose}}\label{\detokenize{appdev/refs/macros/KRB5_TC_OPENCLOSE:krb5-tc-openclose-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_OPENCLOSE::doc}}\index{KRB5\_TC\_OPENCLOSE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_OPENCLOSE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_OPENCLOSE:KRB5_TC_OPENCLOSE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_OPENCLOSE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Open and close the file for each cache operation. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_OPENCLOSE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TC\_SUPPORTED\_KTYPES} -\label{\detokenize{appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES:krb5-tc-supported-ktypes}}\label{\detokenize{appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES:krb5-tc-supported-ktypes-data}}\label{\detokenize{appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES::doc}}\index{KRB5\_TC\_SUPPORTED\_KTYPES (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TC\_SUPPORTED\_KTYPES}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TC_SUPPORTED_KTYPES:KRB5_TC_SUPPORTED_KTYPES}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TC\_SUPPORTED\_KTYPES}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -The supported key types must match. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TC\_SUPPORTED\_KTYPES}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00000200}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TGS\_NAME} -\label{\detokenize{appdev/refs/macros/KRB5_TGS_NAME:krb5-tgs-name}}\label{\detokenize{appdev/refs/macros/KRB5_TGS_NAME:krb5-tgs-name-data}}\label{\detokenize{appdev/refs/macros/KRB5_TGS_NAME::doc}}\index{KRB5\_TGS\_NAME (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TGS\_NAME}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TGS_NAME:KRB5_TGS_NAME}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TGS\_NAME}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TGS\_NAME}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{"krbtgt"}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TGS\_NAME\_SIZE} -\label{\detokenize{appdev/refs/macros/KRB5_TGS_NAME_SIZE:krb5-tgs-name-size}}\label{\detokenize{appdev/refs/macros/KRB5_TGS_NAME_SIZE:krb5-tgs-name-size-data}}\label{\detokenize{appdev/refs/macros/KRB5_TGS_NAME_SIZE::doc}}\index{KRB5\_TGS\_NAME\_SIZE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TGS\_NAME\_SIZE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TGS_NAME_SIZE:KRB5_TGS_NAME_SIZE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TGS\_NAME\_SIZE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TGS\_NAME\_SIZE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{6}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TGS\_REP} -\label{\detokenize{appdev/refs/macros/KRB5_TGS_REP:krb5-tgs-rep}}\label{\detokenize{appdev/refs/macros/KRB5_TGS_REP:krb5-tgs-rep-data}}\label{\detokenize{appdev/refs/macros/KRB5_TGS_REP::doc}}\index{KRB5\_TGS\_REP (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TGS\_REP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TGS_REP:KRB5_TGS_REP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TGS\_REP}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Response to TGS request. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TGS\_REP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)13)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TGS\_REQ} -\label{\detokenize{appdev/refs/macros/KRB5_TGS_REQ:krb5-tgs-req}}\label{\detokenize{appdev/refs/macros/KRB5_TGS_REQ:krb5-tgs-req-data}}\label{\detokenize{appdev/refs/macros/KRB5_TGS_REQ::doc}}\index{KRB5\_TGS\_REQ (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TGS\_REQ}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TGS_REQ:KRB5_TGS_REQ}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TGS\_REQ}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Ticket granting server request. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TGS\_REQ}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((krb5\_msgtype)12)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_TKT\_CREDS\_STEP\_FLAG\_CONTINUE} -\label{\detokenize{appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE:krb5-tkt-creds-step-flag-continue}}\label{\detokenize{appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE:krb5-tkt-creds-step-flag-continue-data}}\label{\detokenize{appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE::doc}}\index{KRB5\_TKT\_CREDS\_STEP\_FLAG\_CONTINUE (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_TKT\_CREDS\_STEP\_FLAG\_CONTINUE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_TKT_CREDS_STEP_FLAG_CONTINUE:KRB5_TKT_CREDS_STEP_FLAG_CONTINUE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_TKT\_CREDS\_STEP\_FLAG\_CONTINUE}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -More responses needed. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_TKT\_CREDS\_STEP\_FLAG\_CONTINUE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x1}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_VERIFY\_INIT\_CREDS\_OPT\_AP\_REQ\_NOFAIL} -\label{\detokenize{appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL:krb5-verify-init-creds-opt-ap-req-nofail}}\label{\detokenize{appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL:krb5-verify-init-creds-opt-ap-req-nofail-data}}\label{\detokenize{appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL::doc}}\index{KRB5\_VERIFY\_INIT\_CREDS\_OPT\_AP\_REQ\_NOFAIL (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_VERIFY\_INIT\_CREDS\_OPT\_AP\_REQ\_NOFAIL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL:KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_VERIFY\_INIT\_CREDS\_OPT\_AP\_REQ\_NOFAIL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_VERIFY\_INIT\_CREDS\_OPT\_AP\_REQ\_NOFAIL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x0001}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{KRB5\_WELLKNOWN\_NAMESTR} -\label{\detokenize{appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR:krb5-wellknown-namestr}}\label{\detokenize{appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR:krb5-wellknown-namestr-data}}\label{\detokenize{appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR::doc}}\index{KRB5\_WELLKNOWN\_NAMESTR (built\sphinxhyphen{}in variable)@\spxentry{KRB5\_WELLKNOWN\_NAMESTR}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/KRB5_WELLKNOWN_NAMESTR:KRB5_WELLKNOWN_NAMESTR}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{KRB5\_WELLKNOWN\_NAMESTR}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -First component of NT\_WELLKNOWN principals. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{KRB5\_WELLKNOWN\_NAMESTR}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{"WELLKNOWN"}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{LR\_TYPE\_INTERPRETATION\_MASK} -\label{\detokenize{appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK:lr-type-interpretation-mask}}\label{\detokenize{appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK:lr-type-interpretation-mask-data}}\label{\detokenize{appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK::doc}}\index{LR\_TYPE\_INTERPRETATION\_MASK (built\sphinxhyphen{}in variable)@\spxentry{LR\_TYPE\_INTERPRETATION\_MASK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/LR_TYPE_INTERPRETATION_MASK:LR_TYPE_INTERPRETATION_MASK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{LR\_TYPE\_INTERPRETATION\_MASK}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{LR\_TYPE\_INTERPRETATION\_MASK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x7fff}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{LR\_TYPE\_THIS\_SERVER\_ONLY} -\label{\detokenize{appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY:lr-type-this-server-only}}\label{\detokenize{appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY:lr-type-this-server-only-data}}\label{\detokenize{appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY::doc}}\index{LR\_TYPE\_THIS\_SERVER\_ONLY (built\sphinxhyphen{}in variable)@\spxentry{LR\_TYPE\_THIS\_SERVER\_ONLY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/LR_TYPE_THIS_SERVER_ONLY:LR_TYPE_THIS_SERVER_ONLY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{LR\_TYPE\_THIS\_SERVER\_ONLY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{LR\_TYPE\_THIS\_SERVER\_ONLY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x8000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{MAX\_KEYTAB\_NAME\_LEN} -\label{\detokenize{appdev/refs/macros/MAX_KEYTAB_NAME_LEN:max-keytab-name-len}}\label{\detokenize{appdev/refs/macros/MAX_KEYTAB_NAME_LEN:max-keytab-name-len-data}}\label{\detokenize{appdev/refs/macros/MAX_KEYTAB_NAME_LEN::doc}}\index{MAX\_KEYTAB\_NAME\_LEN (built\sphinxhyphen{}in variable)@\spxentry{MAX\_KEYTAB\_NAME\_LEN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/MAX_KEYTAB_NAME_LEN:MAX_KEYTAB_NAME_LEN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{MAX\_KEYTAB\_NAME\_LEN}}} -\pysigstopsignatures -\end{fulllineitems} - - -\sphinxAtStartPar -Long enough for MAXPATHLEN + some extra. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{MAX\_KEYTAB\_NAME\_LEN}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{1100}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{MSEC\_DIRBIT} -\label{\detokenize{appdev/refs/macros/MSEC_DIRBIT:msec-dirbit}}\label{\detokenize{appdev/refs/macros/MSEC_DIRBIT:msec-dirbit-data}}\label{\detokenize{appdev/refs/macros/MSEC_DIRBIT::doc}}\index{MSEC\_DIRBIT (built\sphinxhyphen{}in variable)@\spxentry{MSEC\_DIRBIT}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/MSEC_DIRBIT:MSEC_DIRBIT}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{MSEC\_DIRBIT}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{MSEC\_DIRBIT}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x8000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{MSEC\_VAL\_MASK} -\label{\detokenize{appdev/refs/macros/MSEC_VAL_MASK:msec-val-mask}}\label{\detokenize{appdev/refs/macros/MSEC_VAL_MASK:msec-val-mask-data}}\label{\detokenize{appdev/refs/macros/MSEC_VAL_MASK::doc}}\index{MSEC\_VAL\_MASK (built\sphinxhyphen{}in variable)@\spxentry{MSEC\_VAL\_MASK}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/MSEC_VAL_MASK:MSEC_VAL_MASK}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{MSEC\_VAL\_MASK}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{MSEC\_VAL\_MASK}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x7fff}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{SALT\_TYPE\_AFS\_LENGTH} -\label{\detokenize{appdev/refs/macros/SALT_TYPE_AFS_LENGTH:salt-type-afs-length}}\label{\detokenize{appdev/refs/macros/SALT_TYPE_AFS_LENGTH:salt-type-afs-length-data}}\label{\detokenize{appdev/refs/macros/SALT_TYPE_AFS_LENGTH::doc}}\index{SALT\_TYPE\_AFS\_LENGTH (built\sphinxhyphen{}in variable)@\spxentry{SALT\_TYPE\_AFS\_LENGTH}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/SALT_TYPE_AFS_LENGTH:SALT_TYPE_AFS_LENGTH}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{SALT\_TYPE\_AFS\_LENGTH}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{SALT\_TYPE\_AFS\_LENGTH}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{UINT\_MAX}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{SALT\_TYPE\_NO\_LENGTH} -\label{\detokenize{appdev/refs/macros/SALT_TYPE_NO_LENGTH:salt-type-no-length}}\label{\detokenize{appdev/refs/macros/SALT_TYPE_NO_LENGTH:salt-type-no-length-data}}\label{\detokenize{appdev/refs/macros/SALT_TYPE_NO_LENGTH::doc}}\index{SALT\_TYPE\_NO\_LENGTH (built\sphinxhyphen{}in variable)@\spxentry{SALT\_TYPE\_NO\_LENGTH}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/SALT_TYPE_NO_LENGTH:SALT_TYPE_NO_LENGTH}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{SALT\_TYPE\_NO\_LENGTH}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{SALT\_TYPE\_NO\_LENGTH}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{UINT\_MAX}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{THREEPARAMOPEN} -\label{\detokenize{appdev/refs/macros/THREEPARAMOPEN:threeparamopen}}\label{\detokenize{appdev/refs/macros/THREEPARAMOPEN:threeparamopen-data}}\label{\detokenize{appdev/refs/macros/THREEPARAMOPEN::doc}}\index{THREEPARAMOPEN (built\sphinxhyphen{}in variable)@\spxentry{THREEPARAMOPEN}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/THREEPARAMOPEN:THREEPARAMOPEN}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{THREEPARAMOPEN}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{THREEPARAMOPEN (x, y, z)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{open(x,y,z)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_ANONYMOUS} -\label{\detokenize{appdev/refs/macros/TKT_FLG_ANONYMOUS:tkt-flg-anonymous}}\label{\detokenize{appdev/refs/macros/TKT_FLG_ANONYMOUS:tkt-flg-anonymous-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_ANONYMOUS::doc}}\index{TKT\_FLG\_ANONYMOUS (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_ANONYMOUS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_ANONYMOUS:TKT_FLG_ANONYMOUS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_ANONYMOUS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_ANONYMOUS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00008000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_ENC\_PA\_REP} -\label{\detokenize{appdev/refs/macros/TKT_FLG_ENC_PA_REP:tkt-flg-enc-pa-rep}}\label{\detokenize{appdev/refs/macros/TKT_FLG_ENC_PA_REP:tkt-flg-enc-pa-rep-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_ENC_PA_REP::doc}}\index{TKT\_FLG\_ENC\_PA\_REP (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_ENC\_PA\_REP}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_ENC_PA_REP:TKT_FLG_ENC_PA_REP}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_ENC\_PA\_REP}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_ENC\_PA\_REP}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00010000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_FORWARDABLE} -\label{\detokenize{appdev/refs/macros/TKT_FLG_FORWARDABLE:tkt-flg-forwardable}}\label{\detokenize{appdev/refs/macros/TKT_FLG_FORWARDABLE:tkt-flg-forwardable-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_FORWARDABLE::doc}}\index{TKT\_FLG\_FORWARDABLE (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_FORWARDABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_FORWARDABLE:TKT_FLG_FORWARDABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_FORWARDABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_FORWARDABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x40000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_FORWARDED} -\label{\detokenize{appdev/refs/macros/TKT_FLG_FORWARDED:tkt-flg-forwarded}}\label{\detokenize{appdev/refs/macros/TKT_FLG_FORWARDED:tkt-flg-forwarded-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_FORWARDED::doc}}\index{TKT\_FLG\_FORWARDED (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_FORWARDED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_FORWARDED:TKT_FLG_FORWARDED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_FORWARDED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_FORWARDED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x20000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_HW\_AUTH} -\label{\detokenize{appdev/refs/macros/TKT_FLG_HW_AUTH:tkt-flg-hw-auth}}\label{\detokenize{appdev/refs/macros/TKT_FLG_HW_AUTH:tkt-flg-hw-auth-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_HW_AUTH::doc}}\index{TKT\_FLG\_HW\_AUTH (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_HW\_AUTH}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_HW_AUTH:TKT_FLG_HW_AUTH}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_HW\_AUTH}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_HW\_AUTH}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00100000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_INITIAL} -\label{\detokenize{appdev/refs/macros/TKT_FLG_INITIAL:tkt-flg-initial}}\label{\detokenize{appdev/refs/macros/TKT_FLG_INITIAL:tkt-flg-initial-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_INITIAL::doc}}\index{TKT\_FLG\_INITIAL (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_INITIAL}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_INITIAL:TKT_FLG_INITIAL}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_INITIAL}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_INITIAL}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00400000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_INVALID} -\label{\detokenize{appdev/refs/macros/TKT_FLG_INVALID:tkt-flg-invalid}}\label{\detokenize{appdev/refs/macros/TKT_FLG_INVALID:tkt-flg-invalid-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_INVALID::doc}}\index{TKT\_FLG\_INVALID (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_INVALID}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_INVALID:TKT_FLG_INVALID}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_INVALID}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_INVALID}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x01000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_MAY\_POSTDATE} -\label{\detokenize{appdev/refs/macros/TKT_FLG_MAY_POSTDATE:tkt-flg-may-postdate}}\label{\detokenize{appdev/refs/macros/TKT_FLG_MAY_POSTDATE:tkt-flg-may-postdate-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_MAY_POSTDATE::doc}}\index{TKT\_FLG\_MAY\_POSTDATE (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_MAY\_POSTDATE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_MAY_POSTDATE:TKT_FLG_MAY_POSTDATE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_MAY\_POSTDATE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_MAY\_POSTDATE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x04000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_OK\_AS\_DELEGATE} -\label{\detokenize{appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE:tkt-flg-ok-as-delegate}}\label{\detokenize{appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE:tkt-flg-ok-as-delegate-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE::doc}}\index{TKT\_FLG\_OK\_AS\_DELEGATE (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_OK\_AS\_DELEGATE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_OK_AS_DELEGATE:TKT_FLG_OK_AS_DELEGATE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_OK\_AS\_DELEGATE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_OK\_AS\_DELEGATE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00040000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_POSTDATED} -\label{\detokenize{appdev/refs/macros/TKT_FLG_POSTDATED:tkt-flg-postdated}}\label{\detokenize{appdev/refs/macros/TKT_FLG_POSTDATED:tkt-flg-postdated-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_POSTDATED::doc}}\index{TKT\_FLG\_POSTDATED (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_POSTDATED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_POSTDATED:TKT_FLG_POSTDATED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_POSTDATED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_POSTDATED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x02000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_PRE\_AUTH} -\label{\detokenize{appdev/refs/macros/TKT_FLG_PRE_AUTH:tkt-flg-pre-auth}}\label{\detokenize{appdev/refs/macros/TKT_FLG_PRE_AUTH:tkt-flg-pre-auth-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_PRE_AUTH::doc}}\index{TKT\_FLG\_PRE\_AUTH (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_PRE\_AUTH}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_PRE_AUTH:TKT_FLG_PRE_AUTH}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_PRE\_AUTH}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_PRE\_AUTH}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00200000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_PROXIABLE} -\label{\detokenize{appdev/refs/macros/TKT_FLG_PROXIABLE:tkt-flg-proxiable}}\label{\detokenize{appdev/refs/macros/TKT_FLG_PROXIABLE:tkt-flg-proxiable-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_PROXIABLE::doc}}\index{TKT\_FLG\_PROXIABLE (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_PROXIABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_PROXIABLE:TKT_FLG_PROXIABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_PROXIABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_PROXIABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x10000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_PROXY} -\label{\detokenize{appdev/refs/macros/TKT_FLG_PROXY:tkt-flg-proxy}}\label{\detokenize{appdev/refs/macros/TKT_FLG_PROXY:tkt-flg-proxy-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_PROXY::doc}}\index{TKT\_FLG\_PROXY (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_PROXY}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_PROXY:TKT_FLG_PROXY}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_PROXY}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_PROXY}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x08000000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_RENEWABLE} -\label{\detokenize{appdev/refs/macros/TKT_FLG_RENEWABLE:tkt-flg-renewable}}\label{\detokenize{appdev/refs/macros/TKT_FLG_RENEWABLE:tkt-flg-renewable-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_RENEWABLE::doc}}\index{TKT\_FLG\_RENEWABLE (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_RENEWABLE}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_RENEWABLE:TKT_FLG_RENEWABLE}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_RENEWABLE}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_RENEWABLE}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00800000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{TKT\_FLG\_TRANSIT\_POLICY\_CHECKED} -\label{\detokenize{appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED:tkt-flg-transit-policy-checked}}\label{\detokenize{appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED:tkt-flg-transit-policy-checked-data}}\label{\detokenize{appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED::doc}}\index{TKT\_FLG\_TRANSIT\_POLICY\_CHECKED (built\sphinxhyphen{}in variable)@\spxentry{TKT\_FLG\_TRANSIT\_POLICY\_CHECKED}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/TKT_FLG_TRANSIT_POLICY_CHECKED:TKT_FLG_TRANSIT_POLICY_CHECKED}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{TKT\_FLG\_TRANSIT\_POLICY\_CHECKED}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{TKT\_FLG\_TRANSIT\_POLICY\_CHECKED}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{0x00080000}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{VALID\_INT\_BITS} -\label{\detokenize{appdev/refs/macros/VALID_INT_BITS:valid-int-bits}}\label{\detokenize{appdev/refs/macros/VALID_INT_BITS:valid-int-bits-data}}\label{\detokenize{appdev/refs/macros/VALID_INT_BITS::doc}}\index{VALID\_INT\_BITS (built\sphinxhyphen{}in variable)@\spxentry{VALID\_INT\_BITS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/VALID_INT_BITS:VALID_INT_BITS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{VALID\_INT\_BITS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{VALID\_INT\_BITS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{INT\_MAX}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{VALID\_UINT\_BITS} -\label{\detokenize{appdev/refs/macros/VALID_UINT_BITS:valid-uint-bits}}\label{\detokenize{appdev/refs/macros/VALID_UINT_BITS:valid-uint-bits-data}}\label{\detokenize{appdev/refs/macros/VALID_UINT_BITS::doc}}\index{VALID\_UINT\_BITS (built\sphinxhyphen{}in variable)@\spxentry{VALID\_UINT\_BITS}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/VALID_UINT_BITS:VALID_UINT_BITS}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{VALID\_UINT\_BITS}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{VALID\_UINT\_BITS}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{UINT\_MAX}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_const} -\label{\detokenize{appdev/refs/macros/krb5_const:krb5-const}}\label{\detokenize{appdev/refs/macros/krb5_const:krb5-const-data}}\label{\detokenize{appdev/refs/macros/krb5_const::doc}}\index{krb5\_const (built\sphinxhyphen{}in variable)@\spxentry{krb5\_const}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_const:krb5_const}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_const}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_const}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{const}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_princ\_component} -\label{\detokenize{appdev/refs/macros/krb5_princ_component:krb5-princ-component}}\label{\detokenize{appdev/refs/macros/krb5_princ_component:krb5-princ-component-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_component::doc}}\index{krb5\_princ\_component (built\sphinxhyphen{}in variable)@\spxentry{krb5\_princ\_component}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_princ_component:krb5_princ_component}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_princ\_component}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_princ\_component (context, princ, i)}} -& -\sphinxAtStartPar -\textasciigrave{}\textasciigrave{} (((i) \textless{} krb5\_princ\_size(context, princ)) ? (princ)\sphinxhyphen{}\textgreater{}data + (i) : NULL)\textasciigrave{}\textasciigrave{} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_princ\_name} -\label{\detokenize{appdev/refs/macros/krb5_princ_name:krb5-princ-name}}\label{\detokenize{appdev/refs/macros/krb5_princ_name:krb5-princ-name-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_name::doc}}\index{krb5\_princ\_name (built\sphinxhyphen{}in variable)@\spxentry{krb5\_princ\_name}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_princ_name:krb5_princ_name}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_princ\_name}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_princ\_name (context, princ)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(princ)\sphinxhyphen{}\textgreater{}data}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_princ\_realm} -\label{\detokenize{appdev/refs/macros/krb5_princ_realm:krb5-princ-realm}}\label{\detokenize{appdev/refs/macros/krb5_princ_realm:krb5-princ-realm-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_realm::doc}}\index{krb5\_princ\_realm (built\sphinxhyphen{}in variable)@\spxentry{krb5\_princ\_realm}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_princ_realm:krb5_princ_realm}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_princ\_realm}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_princ\_realm (context, princ)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(\&(princ)\sphinxhyphen{}\textgreater{}realm)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_princ\_set\_realm} -\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm:krb5-princ-set-realm}}\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm:krb5-princ-set-realm-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm::doc}}\index{krb5\_princ\_set\_realm (built\sphinxhyphen{}in variable)@\spxentry{krb5\_princ\_set\_realm}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm:krb5_princ_set_realm}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_princ\_set\_realm}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_princ\_set\_realm (context, princ, value)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((princ)\sphinxhyphen{}\textgreater{}realm = *(value))}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_princ\_set\_realm\_data} -\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm_data:krb5-princ-set-realm-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm_data:krb5-princ-set-realm-data-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm_data::doc}}\index{krb5\_princ\_set\_realm\_data (built\sphinxhyphen{}in variable)@\spxentry{krb5\_princ\_set\_realm\_data}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm_data:krb5_princ_set_realm_data}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_princ\_set\_realm\_data}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_princ\_set\_realm\_data (context, princ, value)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(princ)\sphinxhyphen{}\textgreater{}realm.data = (value)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_princ\_set\_realm\_length} -\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm_length:krb5-princ-set-realm-length}}\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm_length:krb5-princ-set-realm-length-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm_length::doc}}\index{krb5\_princ\_set\_realm\_length (built\sphinxhyphen{}in variable)@\spxentry{krb5\_princ\_set\_realm\_length}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_princ_set_realm_length:krb5_princ_set_realm_length}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_princ\_set\_realm\_length}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_princ\_set\_realm\_length (context, princ, value)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(princ)\sphinxhyphen{}\textgreater{}realm.length = (value)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_princ\_size} -\label{\detokenize{appdev/refs/macros/krb5_princ_size:krb5-princ-size}}\label{\detokenize{appdev/refs/macros/krb5_princ_size:krb5-princ-size-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_size::doc}}\index{krb5\_princ\_size (built\sphinxhyphen{}in variable)@\spxentry{krb5\_princ\_size}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_princ_size:krb5_princ_size}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_princ\_size}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_princ\_size (context, princ)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(princ)\sphinxhyphen{}\textgreater{}length}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_princ\_type} -\label{\detokenize{appdev/refs/macros/krb5_princ_type:krb5-princ-type}}\label{\detokenize{appdev/refs/macros/krb5_princ_type:krb5-princ-type-data}}\label{\detokenize{appdev/refs/macros/krb5_princ_type::doc}}\index{krb5\_princ\_type (built\sphinxhyphen{}in variable)@\spxentry{krb5\_princ\_type}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_princ_type:krb5_princ_type}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_princ\_type}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_princ\_type (context, princ)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(princ)\sphinxhyphen{}\textgreater{}type}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_roundup} -\label{\detokenize{appdev/refs/macros/krb5_roundup:krb5-roundup}}\label{\detokenize{appdev/refs/macros/krb5_roundup:krb5-roundup-data}}\label{\detokenize{appdev/refs/macros/krb5_roundup::doc}}\index{krb5\_roundup (built\sphinxhyphen{}in variable)@\spxentry{krb5\_roundup}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_roundup:krb5_roundup}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_roundup}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_roundup (x, y)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((((x) + (y) \sphinxhyphen{} 1)/(y))*(y))}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_x} -\label{\detokenize{appdev/refs/macros/krb5_x:krb5-x}}\label{\detokenize{appdev/refs/macros/krb5_x:krb5-x-data}}\label{\detokenize{appdev/refs/macros/krb5_x::doc}}\index{krb5\_x (built\sphinxhyphen{}in variable)@\spxentry{krb5\_x}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_x:krb5_x}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_x}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_x (ptr, args)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((ptr)?((*(ptr)) args):(abort(),1))}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb5\_xc} -\label{\detokenize{appdev/refs/macros/krb5_xc:krb5-xc}}\label{\detokenize{appdev/refs/macros/krb5_xc:krb5-xc-data}}\label{\detokenize{appdev/refs/macros/krb5_xc::doc}}\index{krb5\_xc (built\sphinxhyphen{}in variable)@\spxentry{krb5\_xc}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb5_xc:krb5_xc}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb5\_xc}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_xc (ptr, args)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{((ptr)?((*(ptr)) args):(abort(),(char*)0))}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - - -\subsection{Deprecated macros} -\label{\detokenize{appdev/refs/macros/index:deprecated-macros}} -\sphinxstepscope - - -\subsubsection{krb524\_convert\_creds\_kdc} -\label{\detokenize{appdev/refs/macros/krb524_convert_creds_kdc:krb524-convert-creds-kdc}}\label{\detokenize{appdev/refs/macros/krb524_convert_creds_kdc:krb524-convert-creds-kdc-data}}\label{\detokenize{appdev/refs/macros/krb524_convert_creds_kdc::doc}}\index{krb524\_convert\_creds\_kdc (built\sphinxhyphen{}in variable)@\spxentry{krb524\_convert\_creds\_kdc}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb524_convert_creds_kdc:krb524_convert_creds_kdc}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb524\_convert\_creds\_kdc}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb524\_convert\_creds\_kdc}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb5\_524\_convert\_creds}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxstepscope - - -\subsubsection{krb524\_init\_ets} -\label{\detokenize{appdev/refs/macros/krb524_init_ets:krb524-init-ets}}\label{\detokenize{appdev/refs/macros/krb524_init_ets:krb524-init-ets-data}}\label{\detokenize{appdev/refs/macros/krb524_init_ets::doc}}\index{krb524\_init\_ets (built\sphinxhyphen{}in variable)@\spxentry{krb524\_init\_ets}\spxextra{built\sphinxhyphen{}in variable}} - -\begin{fulllineitems} -\phantomsection\label{\detokenize{appdev/refs/macros/krb524_init_ets:krb524_init_ets}} -\pysigstartsignatures -\pysigline{\sphinxbfcode{\sphinxupquote{krb524\_init\_ets}}} -\pysigstopsignatures -\end{fulllineitems} - - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{krb524\_init\_ets (x)}} -& -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{(0)}} -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - - - -\renewcommand{\indexname}{Index} -\printindex -\end{document}
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/basic.pdf b/crypto/krb5/doc/pdf/basic.pdf Binary files differdeleted file mode 100644 index 586078310217..000000000000 --- a/crypto/krb5/doc/pdf/basic.pdf +++ /dev/null diff --git a/crypto/krb5/doc/pdf/basic.tex b/crypto/krb5/doc/pdf/basic.tex deleted file mode 100644 index a8a8c3dfa877..000000000000 --- a/crypto/krb5/doc/pdf/basic.tex +++ /dev/null @@ -1,941 +0,0 @@ -%% Generated by Sphinx. -\def\sphinxdocclass{report} -\documentclass[letterpaper,10pt,english]{sphinxmanual} -\ifdefined\pdfpxdimen - \let\sphinxpxdimen\pdfpxdimen\else\newdimen\sphinxpxdimen -\fi \sphinxpxdimen=.75bp\relax -\ifdefined\pdfimageresolution - \pdfimageresolution= \numexpr \dimexpr1in\relax/\sphinxpxdimen\relax -\fi -%% let collapsible pdf bookmarks panel have high depth per default -\PassOptionsToPackage{bookmarksdepth=5}{hyperref} - -\PassOptionsToPackage{booktabs}{sphinx} -\PassOptionsToPackage{colorrows}{sphinx} - -\PassOptionsToPackage{warn}{textcomp} -\usepackage[utf8]{inputenc} -\ifdefined\DeclareUnicodeCharacter -% support both utf8 and utf8x syntaxes - \ifdefined\DeclareUnicodeCharacterAsOptional - \def\sphinxDUC#1{\DeclareUnicodeCharacter{"#1}} - \else - \let\sphinxDUC\DeclareUnicodeCharacter - \fi - \sphinxDUC{00A0}{\nobreakspace} - \sphinxDUC{2500}{\sphinxunichar{2500}} - \sphinxDUC{2502}{\sphinxunichar{2502}} - \sphinxDUC{2514}{\sphinxunichar{2514}} - \sphinxDUC{251C}{\sphinxunichar{251C}} - \sphinxDUC{2572}{\textbackslash} -\fi -\usepackage{cmap} -\usepackage[T1]{fontenc} -\usepackage{amsmath,amssymb,amstext} -\usepackage{babel} - - - -\usepackage{tgtermes} -\usepackage{tgheros} -\renewcommand{\ttdefault}{txtt} - - - -\usepackage[Bjarne]{fncychap} -\usepackage{sphinx} - -\fvset{fontsize=auto} -\usepackage{geometry} - - -% Include hyperref last. -\usepackage{hyperref} -% Fix anchor placement for figures with captions. -\usepackage{hypcap}% it must be loaded after hyperref. -% Set up styles of URL: it should be placed after hyperref. -\urlstyle{same} - - -\usepackage{sphinxmessages} -\setcounter{tocdepth}{0} - - - -\title{Kerberos Concepts} -\date{ } -\release{1.22\sphinxhyphen{}final} -\author{MIT} -\newcommand{\sphinxlogo}{\vbox{}} -\renewcommand{\releasename}{Release} -\makeindex -\begin{document} - -\ifdefined\shorthandoff - \ifnum\catcode`\=\string=\active\shorthandoff{=}\fi - \ifnum\catcode`\"=\active\shorthandoff{"}\fi -\fi - -\pagestyle{empty} -\sphinxmaketitle -\pagestyle{plain} -\sphinxtableofcontents -\pagestyle{normal} -\phantomsection\label{\detokenize{basic/index::doc}} - - -\sphinxstepscope - - -\chapter{Credential cache} -\label{\detokenize{basic/ccache_def:credential-cache}}\label{\detokenize{basic/ccache_def:ccache-definition}}\label{\detokenize{basic/ccache_def::doc}} -\sphinxAtStartPar -A credential cache (or “ccache”) holds Kerberos credentials while they -remain valid and, generally, while the user’s session lasts, so that -authenticating to a service multiple times (e.g., connecting to a web -or mail server more than once) doesn’t require contacting the KDC -every time. - -\sphinxAtStartPar -A credential cache usually contains one initial ticket which is -obtained using a password or another form of identity verification. -If this ticket is a ticket\sphinxhyphen{}granting ticket, it can be used to obtain -additional credentials without the password. Because the credential -cache does not store the password, less long\sphinxhyphen{}term damage can be done -to the user’s account if the machine is compromised. - -\sphinxAtStartPar -A credentials cache stores a default client principal name, set when -the cache is created. This is the name shown at the top of the -\DUrole{xref,std,std-ref}{klist(1)} \sphinxstyleemphasis{\sphinxhyphen{}A} output. - -\sphinxAtStartPar -Each normal cache entry includes a service principal name, a client -principal name (which, in some ccache types, need not be the same as -the default), lifetime information, and flags, along with the -credential itself. There are also other entries, indicated by special -names, that store additional information. - - -\section{ccache types} -\label{\detokenize{basic/ccache_def:ccache-types}} -\sphinxAtStartPar -The credential cache interface, like the {\hyperref[\detokenize{basic/keytab_def:keytab-definition}]{\sphinxcrossref{\DUrole{std,std-ref}{keytab}}}} and -{\hyperref[\detokenize{basic/rcache_def:rcache-definition}]{\sphinxcrossref{\DUrole{std,std-ref}{replay cache}}}} interfaces, uses \sphinxtitleref{TYPE:value} strings to -indicate the type of credential cache and any associated cache naming -data to use. - -\sphinxAtStartPar -There are several kinds of credentials cache supported in the MIT -Kerberos library. Not all are supported on every platform. In most -cases, it should be correct to use the default type built into the -library. -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -\sphinxstylestrong{API} is only implemented on Windows. It communicates with a -server process that holds the credentials in memory for the user, -rather than writing them to disk. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{DIR} points to the storage location of the collection of the -credential caches in \sphinxstyleemphasis{FILE:} format. It is most useful when dealing -with multiple Kerberos realms and KDCs. For release 1.10 the -directory must already exist. In post\sphinxhyphen{}1.10 releases the -requirement is for parent directory to exist and the current -process must have permissions to create the directory if it does -not exist. See {\hyperref[\detokenize{basic/ccache_def:col-ccache}]{\sphinxcrossref{\DUrole{std,std-ref}{Collections of caches}}}} for details. New in release 1.10. -The following residual forms are supported: -\begin{itemize} -\item {} -\sphinxAtStartPar -DIR:dirname - -\item {} -\sphinxAtStartPar -DIR::dirpath/filename \sphinxhyphen{} a single cache within the directory - -\end{itemize} - -\sphinxAtStartPar -Switching to a ccache of the latter type causes it to become the -primary for the directory. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{FILE} caches are the simplest and most portable. A simple flat -file format is used to store one credential after another. This is -the default ccache type if no type is specified in a ccache name. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{KCM} caches work by contacting a daemon process called \sphinxcode{\sphinxupquote{kcm}} -to perform cache operations. If the cache name is just \sphinxcode{\sphinxupquote{KCM:}}, -the default cache as determined by the KCM daemon will be used. -Newly created caches must generally be named \sphinxcode{\sphinxupquote{KCM:uid:name}}, -where \sphinxstyleemphasis{uid} is the effective user ID of the running process. - -\sphinxAtStartPar -KCM client support is new in release 1.13. A KCM daemon has not -yet been implemented in MIT krb5, but the client will interoperate -with the KCM daemon implemented by Heimdal. macOS 10.7 and higher -provides a KCM daemon as part of the operating system, and the -\sphinxstylestrong{KCM} cache type is used as the default cache on that platform in -a default build. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{KEYRING} is Linux\sphinxhyphen{}specific, and uses the kernel keyring support -to store credential data in unswappable kernel memory where only -the current user should be able to access it. The following -residual forms are supported: -\begin{itemize} -\item {} -\sphinxAtStartPar -KEYRING:name - -\item {} -\sphinxAtStartPar -KEYRING:process:name \sphinxhyphen{} process keyring - -\item {} -\sphinxAtStartPar -KEYRING:thread:name \sphinxhyphen{} thread keyring - -\end{itemize} - -\sphinxAtStartPar -Starting with release 1.12 the \sphinxstyleemphasis{KEYRING} type supports collections. -The following new residual forms were added: -\begin{itemize} -\item {} -\sphinxAtStartPar -KEYRING:session:name \sphinxhyphen{} session keyring - -\item {} -\sphinxAtStartPar -KEYRING:user:name \sphinxhyphen{} user keyring - -\item {} -\sphinxAtStartPar -KEYRING:persistent:uidnumber \sphinxhyphen{} persistent per\sphinxhyphen{}UID collection. -Unlike the user keyring, this collection survives after the user -logs out, until the cache credentials expire. This type of -ccache requires support from the kernel; otherwise, it will fall -back to the user keyring. - -\end{itemize} - -\sphinxAtStartPar -See {\hyperref[\detokenize{basic/ccache_def:col-ccache}]{\sphinxcrossref{\DUrole{std,std-ref}{Collections of caches}}}} for details. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{MEMORY} caches are for storage of credentials that don’t need to -be made available outside of the current process. For example, a -memory ccache is used by \DUrole{xref,std,std-ref}{kadmin(1)} to store the -administrative ticket used to contact the admin server. Memory -ccaches are faster than file ccaches and are automatically -destroyed when the process exits. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{MSLSA} is a Windows\sphinxhyphen{}specific cache type that accesses the -Windows credential store. - -\end{enumerate} - - -\section{Collections of caches} -\label{\detokenize{basic/ccache_def:collections-of-caches}}\label{\detokenize{basic/ccache_def:col-ccache}} -\sphinxAtStartPar -Some credential cache types can support collections of multiple -caches. One of the caches in the collection is designated as the -\sphinxstyleemphasis{primary} and will be used when the collection is resolved as a cache. -When a collection\sphinxhyphen{}enabled cache type is the default cache for a -process, applications can search the specified collection for a -specific client principal, and GSSAPI applications will automatically -select between the caches in the collection based on criteria such as -the target service realm. - -\sphinxAtStartPar -Credential cache collections are new in release 1.10, with support -from the \sphinxstylestrong{DIR} and \sphinxstylestrong{API} ccache types. Starting in release 1.12, -collections are also supported by the \sphinxstylestrong{KEYRING} ccache type. -Collections are supported by the \sphinxstylestrong{KCM} ccache type in release 1.13. - - -\subsection{Tool alterations to use cache collection} -\label{\detokenize{basic/ccache_def:tool-alterations-to-use-cache-collection}}\begin{itemize} -\item {} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{kdestroy(1)} \sphinxstyleemphasis{\sphinxhyphen{}A} will destroy all caches in the collection. - -\item {} -\sphinxAtStartPar -If the default cache type supports switching, \DUrole{xref,std,std-ref}{kinit(1)} -\sphinxstyleemphasis{princname} will search the collection for a matching cache and -store credentials there, or will store credentials in a new unique -cache of the default type if no existing cache for the principal -exists. Either way, kinit will switch to the selected cache. - -\item {} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{klist(1)} \sphinxstyleemphasis{\sphinxhyphen{}l} will list the caches in the collection. - -\item {} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{klist(1)} \sphinxstyleemphasis{\sphinxhyphen{}A} will show the content of all caches in the -collection. - -\item {} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{kswitch(1)} \sphinxstyleemphasis{\sphinxhyphen{}p princname} will search the collection for a -matching cache and switch to it. - -\item {} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{kswitch(1)} \sphinxstyleemphasis{\sphinxhyphen{}c cachename} will switch to a specified cache. - -\end{itemize} - - -\section{Default ccache name} -\label{\detokenize{basic/ccache_def:default-ccache-name}} -\sphinxAtStartPar -The default credential cache name is determined by the following, in -descending order of priority: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{KRB5CCNAME} environment variable. For example, -\sphinxcode{\sphinxupquote{KRB5CCNAME=DIR:/mydir/}}. - -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{default\_ccache\_name} profile variable in \DUrole{xref,std,std-ref}{libdefaults}. - -\item {} -\sphinxAtStartPar -The hardcoded default, \DUrole{xref,std,std-ref}{DEFCCNAME}. - -\end{enumerate} - -\sphinxstepscope - - -\chapter{keytab} -\label{\detokenize{basic/keytab_def:keytab}}\label{\detokenize{basic/keytab_def:keytab-definition}}\label{\detokenize{basic/keytab_def::doc}} -\sphinxAtStartPar -A keytab (short for “key table”) stores long\sphinxhyphen{}term keys for one or more -principals. Keytabs are normally represented by files in a standard -format, although in rare cases they can be represented in other ways. -Keytabs are used most often to allow server applications to accept -authentications from clients, but can also be used to obtain initial -credentials for client applications. - -\sphinxAtStartPar -Keytabs are named using the format \sphinxstyleemphasis{type}\sphinxcode{\sphinxupquote{:}}\sphinxstyleemphasis{value}. Usually -\sphinxstyleemphasis{type} is \sphinxcode{\sphinxupquote{FILE}} and \sphinxstyleemphasis{value} is the absolute pathname of the file. -The other possible value for \sphinxstyleemphasis{type} is \sphinxcode{\sphinxupquote{MEMORY}}, which indicates a -temporary keytab stored in the memory of the current process. - -\sphinxAtStartPar -A keytab contains one or more entries, where each entry consists of a -timestamp (indicating when the entry was written to the keytab), a -principal name, a key version number, an encryption type, and the -encryption key itself. - -\sphinxAtStartPar -A keytab can be displayed using the \DUrole{xref,std,std-ref}{klist(1)} command with the -\sphinxcode{\sphinxupquote{\sphinxhyphen{}k}} option. Keytabs can be created or appended to by extracting -keys from the KDC database using the \DUrole{xref,std,std-ref}{kadmin(1)} \DUrole{xref,std,std-ref}{ktadd} -command. Keytabs can be manipulated using the \DUrole{xref,std,std-ref}{ktutil(1)} and -\DUrole{xref,std,std-ref}{k5srvutil(1)} commands. - - -\section{Default keytab} -\label{\detokenize{basic/keytab_def:default-keytab}} -\sphinxAtStartPar -The default keytab is used by server applications if the application -does not request a specific keytab. The name of the default keytab is -determined by the following, in decreasing order of preference: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{KRB5\_KTNAME} environment variable. - -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{default\_keytab\_name} profile variable in \DUrole{xref,std,std-ref}{libdefaults}. - -\item {} -\sphinxAtStartPar -The hardcoded default, \DUrole{xref,std,std-ref}{DEFKTNAME}. - -\end{enumerate} - - -\section{Default client keytab} -\label{\detokenize{basic/keytab_def:default-client-keytab}} -\sphinxAtStartPar -The default client keytab is used, if it is present and readable, to -automatically obtain initial credentials for GSSAPI client -applications. The principal name of the first entry in the client -keytab is used by default when obtaining initial credentials. The -name of the default client keytab is determined by the following, in -decreasing order of preference: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{KRB5\_CLIENT\_KTNAME} environment variable. - -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{default\_client\_keytab\_name} profile variable in -\DUrole{xref,std,std-ref}{libdefaults}. - -\item {} -\sphinxAtStartPar -The hardcoded default, \DUrole{xref,std,std-ref}{DEFCKTNAME}. - -\end{enumerate} - -\sphinxstepscope - - -\chapter{replay cache} -\label{\detokenize{basic/rcache_def:replay-cache}}\label{\detokenize{basic/rcache_def:rcache-definition}}\label{\detokenize{basic/rcache_def::doc}} -\sphinxAtStartPar -A replay cache (or “rcache”) keeps track of all authenticators -recently presented to a service. If a duplicate authentication -request is detected in the replay cache, an error message is sent to -the application program. - -\sphinxAtStartPar -The replay cache interface, like the credential cache and -{\hyperref[\detokenize{basic/keytab_def:keytab-definition}]{\sphinxcrossref{\DUrole{std,std-ref}{keytab}}}} interfaces, uses \sphinxtitleref{type:residual} strings to -indicate the type of replay cache and any associated cache naming -data to use. - - -\section{Background information} -\label{\detokenize{basic/rcache_def:background-information}} -\sphinxAtStartPar -Some Kerberos or GSSAPI services use a simple authentication mechanism -where a message is sent containing an authenticator, which establishes -the encryption key that the client will use for talking to the -service. But nothing about that prevents an eavesdropper from -recording the messages sent by the client, establishing a new -connection, and re\sphinxhyphen{}sending or “replaying” the same messages; the -replayed authenticator will establish the same encryption key for the -new session, and the following messages will be decrypted and -processed. The attacker may not know what the messages say, and can’t -generate new messages under the same encryption key, but in some -instances it may be harmful to the user (or helpful to the attacker) -to cause the server to see the same messages again a second time. For -example, if the legitimate client sends “delete first message in -mailbox”, a replay from an attacker may delete another, different -“first” message. (Protocol design to guard against such problems has -been discussed in \index{RFC@\spxentry{RFC}!RFC 4120\#section\sphinxhyphen{}10@\spxentry{RFC 4120\#section\sphinxhyphen{}10}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc4120.html\#section-10}{\sphinxstylestrong{RFC 4120\#section\sphinxhyphen{}10}}.) - -\sphinxAtStartPar -Even if one protocol uses further protection to verify that the client -side of the connection actually knows the encryption keys (and thus is -presumably a legitimate user), if another service uses the same -service principal name, it may be possible to record an authenticator -used with the first protocol and “replay” it against the second. - -\sphinxAtStartPar -The replay cache mitigates these attacks somewhat, by keeping track of -authenticators that have been seen until their five\sphinxhyphen{}minute window -expires. Different authenticators generated by multiple connections -from the same legitimate client will generally have different -timestamps, and thus will not be considered the same. - -\sphinxAtStartPar -This mechanism isn’t perfect. If a message is sent to one application -server but a man\sphinxhyphen{}in\sphinxhyphen{}the\sphinxhyphen{}middle attacker can prevent it from actually -arriving at that server, the attacker could then use the authenticator -(once!) against a different service on the same host. This could be a -problem if the message from the client included something more than -authentication in the first message that could be useful to the -attacker (which is uncommon; in most protocols the server has to -indicate a successful authentication before the client sends -additional messages), or if the simple act of presenting the -authenticator triggers some interesting action in the service being -attacked. - - -\section{Replay cache types} -\label{\detokenize{basic/rcache_def:replay-cache-types}} -\sphinxAtStartPar -Unlike the credential cache and keytab interfaces, replay cache types -are in lowercase. The following types are defined: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -\sphinxstylestrong{none} disables the replay cache. The residual value is ignored. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{file2} (new in release 1.18) uses a hash\sphinxhyphen{}based format to store -replay records. The file may grow to accommodate hash collisions. -The residual value is the filename. - -\item {} -\sphinxAtStartPar -\sphinxstylestrong{dfl} is the default type if no environment variable or -configuration specifies a different type. It stores replay data in -a file2 replay cache with a filename based on the effective uid. -The residual value is ignored. - -\end{enumerate} - -\sphinxAtStartPar -For the dfl type, the location of the replay cache file is determined -as follows: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -The directory is taken from the \sphinxstylestrong{KRB5RCACHEDIR} environment -variable, or the \sphinxstylestrong{TMPDIR} environment variable, or a temporary -directory determined at configuration time such as \sphinxcode{\sphinxupquote{/var/tmp}}, in -descending order of preference. - -\item {} -\sphinxAtStartPar -The filename is \sphinxcode{\sphinxupquote{krb5\_EUID.rcache2}} where EUID is the effective -uid of the process. - -\item {} -\sphinxAtStartPar -The file is opened without following symbolic links, and ownership -of the file is verified to match the effective uid. - -\end{enumerate} - -\sphinxAtStartPar -On Windows, the directory for the dfl type is the local appdata -directory, unless overridden by the \sphinxstylestrong{KRB5RCACHEDIR} environment -variable. The filename on Windows is \sphinxcode{\sphinxupquote{krb5.rcache2}}, and the file -is opened normally. - - -\section{Default replay cache name} -\label{\detokenize{basic/rcache_def:default-replay-cache-name}} -\sphinxAtStartPar -The default replay cache name is determined by the following, in -descending order of priority: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{KRB5RCACHENAME} environment variable (new in release 1.18). - -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{KRB5RCACHETYPE} environment variable. If this variable is -set, the residual value is empty. - -\item {} -\sphinxAtStartPar -The \sphinxstylestrong{default\_rcache\_name} profile variable in \DUrole{xref,std,std-ref}{libdefaults} -(new in release 1.18). - -\item {} -\sphinxAtStartPar -If none of the above are set, the default replay cache name is -\sphinxcode{\sphinxupquote{dfl:}}. - -\end{enumerate} - -\sphinxstepscope - - -\chapter{stash file} -\label{\detokenize{basic/stash_file_def:stash-file}}\label{\detokenize{basic/stash_file_def:stash-definition}}\label{\detokenize{basic/stash_file_def::doc}} -\sphinxAtStartPar -The stash file is a local copy of the master key that resides in -encrypted form on the KDC’s local disk. The stash file is used to -authenticate the KDC to itself automatically before starting the -\DUrole{xref,std,std-ref}{kadmind(8)} and \DUrole{xref,std,std-ref}{krb5kdc(8)} daemons (e.g., as part of the -machine’s boot sequence). The stash file, like the keytab file (see -\DUrole{xref,std,std-ref}{keytab\_file}) is a potential point\sphinxhyphen{}of\sphinxhyphen{}entry for a break\sphinxhyphen{}in, and -if compromised, would allow unrestricted access to the Kerberos -database. If you choose to install a stash file, it should be -readable only by root, and should exist only on the KDC’s local disk. -The file should not be part of any backup of the machine, unless -access to the backup data is secured as tightly as access to the -master password itself. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -If you choose not to install a stash file, the KDC will prompt you for the master key each time it starts up. -This means that the KDC will not be able to start automatically, such as after a system reboot. -\end{sphinxadmonition} - -\sphinxstepscope - - -\chapter{Supported date and time formats} -\label{\detokenize{basic/date_format:supported-date-and-time-formats}}\label{\detokenize{basic/date_format:datetime}}\label{\detokenize{basic/date_format::doc}} - -\section{Time duration} -\label{\detokenize{basic/date_format:time-duration}}\label{\detokenize{basic/date_format:duration}} -\sphinxAtStartPar -This format is used to express a time duration in the Kerberos -configuration files and user commands. The allowed formats are: -\begin{quote} - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TTT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -Format -& -\sphinxAtStartPar -Example -& -\sphinxAtStartPar -Value -\\ -\sphinxhline -\sphinxAtStartPar -h:m{[}:s{]} -& -\sphinxAtStartPar -36:00 -& -\sphinxAtStartPar -36 hours -\\ -\sphinxhline -\sphinxAtStartPar -NdNhNmNs -& -\sphinxAtStartPar -8h30s -& -\sphinxAtStartPar -8 hours 30 seconds -\\ -\sphinxhline -\sphinxAtStartPar -N (number of seconds) -& -\sphinxAtStartPar -3600 -& -\sphinxAtStartPar -1 hour -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} -\end{quote} - -\sphinxAtStartPar -Here \sphinxstyleemphasis{N} denotes a number, \sphinxstyleemphasis{d} \sphinxhyphen{} days, \sphinxstyleemphasis{h} \sphinxhyphen{} hours, \sphinxstyleemphasis{m} \sphinxhyphen{} minutes, -\sphinxstyleemphasis{s} \sphinxhyphen{} seconds. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The time interval should not exceed 2147483647 seconds. -\end{sphinxadmonition} - -\sphinxAtStartPar -Examples: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{Request} \PYG{n}{a} \PYG{n}{ticket} \PYG{n}{valid} \PYG{k}{for} \PYG{n}{one} \PYG{n}{hour}\PYG{p}{,} \PYG{n}{five} \PYG{n}{hours}\PYG{p}{,} \PYG{l+m+mi}{30} \PYG{n}{minutes} -\PYG{o+ow}{and} \PYG{l+m+mi}{10} \PYG{n}{days} \PYG{n}{respectively}\PYG{p}{:} - - \PYG{n}{kinit} \PYG{o}{\PYGZhy{}}\PYG{n}{l} \PYG{l+m+mi}{3600} - \PYG{n}{kinit} \PYG{o}{\PYGZhy{}}\PYG{n}{l} \PYG{l+m+mi}{5}\PYG{p}{:}\PYG{l+m+mi}{00} - \PYG{n}{kinit} \PYG{o}{\PYGZhy{}}\PYG{n}{l} \PYG{l+m+mi}{30}\PYG{n}{m} - \PYG{n}{kinit} \PYG{o}{\PYGZhy{}}\PYG{n}{l} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{10d 0h 0m 0s}\PYG{l+s+s2}{\PYGZdq{}} -\end{sphinxVerbatim} - - -\section{getdate time} -\label{\detokenize{basic/date_format:getdate-time}}\label{\detokenize{basic/date_format:getdate}} -\sphinxAtStartPar -Some of the kadmin and kdb5\_util commands take a date\sphinxhyphen{}time in a -human\sphinxhyphen{}readable format. Some of the acceptable date\sphinxhyphen{}time -strings are: -\begin{quote} - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TTT} -\sphinxtoprule -\sphinxstyletheadfamily &\sphinxstyletheadfamily -\sphinxAtStartPar -Format -&\sphinxstyletheadfamily -\sphinxAtStartPar -Example -\\ -\sphinxmidrule -\sphinxtableatstartofbodyhook\sphinxmultirow{3}{4}{% -\begin{varwidth}[t]{\sphinxcolwidth{1}{3}} -\sphinxAtStartPar -Date -\par -\vskip-\baselineskip\vbox{\hbox{\strut}}\end{varwidth}% -}% -& -\sphinxAtStartPar -mm/dd/yy -& -\sphinxAtStartPar -07/27/12 -\\ -\sphinxcline{2-3}\sphinxfixclines{3}\sphinxtablestrut{4}& -\sphinxAtStartPar -month dd, yyyy -& -\sphinxAtStartPar -Jul 27, 2012 -\\ -\sphinxcline{2-3}\sphinxfixclines{3}\sphinxtablestrut{4}& -\sphinxAtStartPar -yyyy\sphinxhyphen{}mm\sphinxhyphen{}dd -& -\sphinxAtStartPar -2012\sphinxhyphen{}07\sphinxhyphen{}27 -\\ -\sphinxhline\sphinxmultirow{2}{11}{% -\begin{varwidth}[t]{\sphinxcolwidth{1}{3}} -\sphinxAtStartPar -Absolute -time -\par -\vskip-\baselineskip\vbox{\hbox{\strut}}\end{varwidth}% -}% -& -\sphinxAtStartPar -HH:mm{[}:ss{]}pp -& -\sphinxAtStartPar -08:30 PM -\\ -\sphinxcline{2-3}\sphinxfixclines{3}\sphinxtablestrut{11}& -\sphinxAtStartPar -hh:mm{[}:ss{]} -& -\sphinxAtStartPar -20:30 -\\ -\sphinxhline -\sphinxAtStartPar -Relative -time -& -\sphinxAtStartPar -N tt -& -\sphinxAtStartPar -30 sec -\\ -\sphinxhline\sphinxmultirow{2}{19}{% -\begin{varwidth}[t]{\sphinxcolwidth{1}{3}} -\sphinxAtStartPar -Time zone -\par -\vskip-\baselineskip\vbox{\hbox{\strut}}\end{varwidth}% -}% -& -\sphinxAtStartPar -Z -& -\sphinxAtStartPar -EST -\\ -\sphinxcline{2-3}\sphinxfixclines{3}\sphinxtablestrut{19}& -\sphinxAtStartPar -z -& -\sphinxAtStartPar -\sphinxhyphen{}0400 -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} -\end{quote} - -\sphinxAtStartPar -(See {\hyperref[\detokenize{basic/date_format:abbreviation}]{\sphinxcrossref{\DUrole{std,std-ref}{Abbreviations used in this document}}}}.) - -\sphinxAtStartPar -Examples: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{Create} \PYG{n}{a} \PYG{n}{principal} \PYG{n}{that} \PYG{n}{expires} \PYG{n}{on} \PYG{n}{the} \PYG{n}{date} \PYG{n}{indicated}\PYG{p}{:} - \PYG{n}{addprinc} \PYG{n}{test1} \PYG{o}{\PYGZhy{}}\PYG{n}{expire} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{3/27/12 10:00:07 EST}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{n}{addprinc} \PYG{n}{test2} \PYG{o}{\PYGZhy{}}\PYG{n}{expire} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{January 23, 2015 10:05pm}\PYG{l+s+s2}{\PYGZdq{}} - \PYG{n}{addprinc} \PYG{n}{test3} \PYG{o}{\PYGZhy{}}\PYG{n}{expire} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{22:00 GMT}\PYG{l+s+s2}{\PYGZdq{}} -\PYG{n}{Add} \PYG{n}{a} \PYG{n}{principal} \PYG{n}{that} \PYG{n}{will} \PYG{n}{expire} \PYG{o+ow}{in} \PYG{l+m+mi}{30} \PYG{n}{minutes}\PYG{p}{:} - \PYG{n}{addprinc} \PYG{n}{test4} \PYG{o}{\PYGZhy{}}\PYG{n}{expire} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{30 minutes}\PYG{l+s+s2}{\PYGZdq{}} -\end{sphinxVerbatim} - - -\section{Absolute time} -\label{\detokenize{basic/date_format:absolute-time}}\label{\detokenize{basic/date_format:abstime}} -\sphinxAtStartPar -This rarely used date\sphinxhyphen{}time format can be noted in one of the -following ways: -\begin{quote} - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TTT} -\sphinxtoprule -\sphinxstyletheadfamily -\sphinxAtStartPar -Format -&\sphinxstyletheadfamily -\sphinxAtStartPar -Example -&\sphinxstyletheadfamily -\sphinxAtStartPar -Value -\\ -\sphinxmidrule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -yyyymmddhhmmss -& -\sphinxAtStartPar -20141231235900 -&\sphinxmultirow{5}{6}{% -\begin{varwidth}[t]{\sphinxcolwidth{1}{3}} -\sphinxAtStartPar -One minute -before 2015 -\par -\vskip-\baselineskip\vbox{\hbox{\strut}}\end{varwidth}% -}% -\\ -\sphinxcline{1-2}\sphinxfixclines{3} -\sphinxAtStartPar -yyyy.mm.dd.hh.mm.ss -& -\sphinxAtStartPar -2014.12.31.23.59.00 -&\sphinxtablestrut{6}\\ -\sphinxcline{1-2}\sphinxfixclines{3} -\sphinxAtStartPar -yymmddhhmmss -& -\sphinxAtStartPar -141231235900 -&\sphinxtablestrut{6}\\ -\sphinxcline{1-2}\sphinxfixclines{3} -\sphinxAtStartPar -yy.mm.dd.hh.mm.ss -& -\sphinxAtStartPar -14.12.31.23.59.00 -&\sphinxtablestrut{6}\\ -\sphinxcline{1-2}\sphinxfixclines{3} -\sphinxAtStartPar -dd\sphinxhyphen{}month\sphinxhyphen{}yyyy:hh:mm:ss -& -\sphinxAtStartPar -31\sphinxhyphen{}Dec\sphinxhyphen{}2014:23:59:00 -&\sphinxtablestrut{6}\\ -\sphinxhline -\sphinxAtStartPar -hh:mm:ss -& -\sphinxAtStartPar -20:00:00 -&\sphinxmultirow{2}{17}{% -\begin{varwidth}[t]{\sphinxcolwidth{1}{3}} -\sphinxAtStartPar -8 o’clock in -the evening -\par -\vskip-\baselineskip\vbox{\hbox{\strut}}\end{varwidth}% -}% -\\ -\sphinxcline{1-2}\sphinxfixclines{3} -\sphinxAtStartPar -hhmmss -& -\sphinxAtStartPar -200000 -&\sphinxtablestrut{17}\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} -\end{quote} - -\sphinxAtStartPar -(See {\hyperref[\detokenize{basic/date_format:abbreviation}]{\sphinxcrossref{\DUrole{std,std-ref}{Abbreviations used in this document}}}}.) - -\sphinxAtStartPar -Example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{Set} \PYG{n}{the} \PYG{n}{default} \PYG{n}{expiration} \PYG{n}{date} \PYG{n}{to} \PYG{n}{July} \PYG{l+m+mi}{27}\PYG{p}{,} \PYG{l+m+mi}{2012} \PYG{n}{at} \PYG{l+m+mi}{20}\PYG{p}{:}\PYG{l+m+mi}{30} -\PYG{n}{default\PYGZus{}principal\PYGZus{}expiration} \PYG{o}{=} \PYG{l+m+mi}{20120727203000} -\end{sphinxVerbatim} - - -\subsection{Abbreviations used in this document} -\label{\detokenize{basic/date_format:abbreviations-used-in-this-document}}\label{\detokenize{basic/date_format:abbreviation}} -\begin{DUlineblock}{0em} -\item[] \sphinxstyleemphasis{month} : locale’s month name or its abbreviation; -\item[] \sphinxstyleemphasis{dd} : day of month (01\sphinxhyphen{}31); -\item[] \sphinxstyleemphasis{HH} : hours (00\sphinxhyphen{}12); -\item[] \sphinxstyleemphasis{hh} : hours (00\sphinxhyphen{}23); -\item[] \sphinxstyleemphasis{mm} : in time \sphinxhyphen{} minutes (00\sphinxhyphen{}59); in date \sphinxhyphen{} month (01\sphinxhyphen{}12); -\item[] \sphinxstyleemphasis{N} : number; -\item[] \sphinxstyleemphasis{pp} : AM or PM; -\item[] \sphinxstyleemphasis{ss} : seconds (00\sphinxhyphen{}60); -\item[] \sphinxstyleemphasis{tt} : time units (hours, minutes, min, seconds, sec); -\item[] \sphinxstyleemphasis{yyyy} : year; -\item[] \sphinxstyleemphasis{yy} : last two digits of the year; -\item[] \sphinxstyleemphasis{Z} : alphabetic time zone abbreviation; -\item[] \sphinxstyleemphasis{z} : numeric time zone; -\end{DUlineblock} - -\begin{sphinxadmonition}{note}{Note:}\begin{itemize} -\item {} -\sphinxAtStartPar -If the date specification contains spaces, you may need to -enclose it in double quotes; - -\item {} -\sphinxAtStartPar -All keywords are case\sphinxhyphen{}insensitive. - -\end{itemize} -\end{sphinxadmonition} - - - -\renewcommand{\indexname}{Index} -\printindex -\end{document}
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/build.pdf b/crypto/krb5/doc/pdf/build.pdf Binary files differdeleted file mode 100644 index 68cef693a1ab..000000000000 --- a/crypto/krb5/doc/pdf/build.pdf +++ /dev/null diff --git a/crypto/krb5/doc/pdf/build.tex b/crypto/krb5/doc/pdf/build.tex deleted file mode 100644 index 010cda924370..000000000000 --- a/crypto/krb5/doc/pdf/build.tex +++ /dev/null @@ -1,1112 +0,0 @@ -%% Generated by Sphinx. -\def\sphinxdocclass{report} -\documentclass[letterpaper,10pt,english]{sphinxmanual} -\ifdefined\pdfpxdimen - \let\sphinxpxdimen\pdfpxdimen\else\newdimen\sphinxpxdimen -\fi \sphinxpxdimen=.75bp\relax -\ifdefined\pdfimageresolution - \pdfimageresolution= \numexpr \dimexpr1in\relax/\sphinxpxdimen\relax -\fi -%% let collapsible pdf bookmarks panel have high depth per default -\PassOptionsToPackage{bookmarksdepth=5}{hyperref} - -\PassOptionsToPackage{booktabs}{sphinx} -\PassOptionsToPackage{colorrows}{sphinx} - -\PassOptionsToPackage{warn}{textcomp} -\usepackage[utf8]{inputenc} -\ifdefined\DeclareUnicodeCharacter -% support both utf8 and utf8x syntaxes - \ifdefined\DeclareUnicodeCharacterAsOptional - \def\sphinxDUC#1{\DeclareUnicodeCharacter{"#1}} - \else - \let\sphinxDUC\DeclareUnicodeCharacter - \fi - \sphinxDUC{00A0}{\nobreakspace} - \sphinxDUC{2500}{\sphinxunichar{2500}} - \sphinxDUC{2502}{\sphinxunichar{2502}} - \sphinxDUC{2514}{\sphinxunichar{2514}} - \sphinxDUC{251C}{\sphinxunichar{251C}} - \sphinxDUC{2572}{\textbackslash} -\fi -\usepackage{cmap} -\usepackage[T1]{fontenc} -\usepackage{amsmath,amssymb,amstext} -\usepackage{babel} - - - -\usepackage{tgtermes} -\usepackage{tgheros} -\renewcommand{\ttdefault}{txtt} - - - -\usepackage[Bjarne]{fncychap} -\usepackage{sphinx} - -\fvset{fontsize=auto} -\usepackage{geometry} - - -% Include hyperref last. -\usepackage{hyperref} -% Fix anchor placement for figures with captions. -\usepackage{hypcap}% it must be loaded after hyperref. -% Set up styles of URL: it should be placed after hyperref. -\urlstyle{same} - - -\usepackage{sphinxmessages} -\setcounter{tocdepth}{0} - - - -\title{Building MIT Kerberos} -\date{ } -\release{1.22\sphinxhyphen{}final} -\author{MIT} -\newcommand{\sphinxlogo}{\vbox{}} -\renewcommand{\releasename}{Release} -\makeindex -\begin{document} - -\ifdefined\shorthandoff - \ifnum\catcode`\=\string=\active\shorthandoff{=}\fi - \ifnum\catcode`\"=\active\shorthandoff{"}\fi -\fi - -\pagestyle{empty} -\sphinxmaketitle -\pagestyle{plain} -\sphinxtableofcontents -\pagestyle{normal} -\phantomsection\label{\detokenize{build/index::doc}} - - -\sphinxAtStartPar -This section details how to build and install MIT Kerberos software -from the source. - - -\chapter{Prerequisites} -\label{\detokenize{build/index:prerequisites}} -\sphinxAtStartPar -In order to build Kerberos V5, you will need approximately 60\sphinxhyphen{}70 -megabytes of disk space. The exact amount will vary depending on the -platform and whether the distribution is compiled with debugging -symbol tables or not. - -\sphinxAtStartPar -Your C compiler must conform to ANSI C (ISO/IEC 9899:1990, “c89”). -Some operating systems do not have an ANSI C compiler, or their -default compiler requires extra command\sphinxhyphen{}line options to enable ANSI C -conformance. - -\sphinxAtStartPar -If you wish to keep a separate build tree, which contains the compiled -*.o file and executables, separate from your source tree, you will -need a make program which supports \sphinxstylestrong{VPATH}, or you will need to use -a tool such as lndir to produce a symbolic link tree for your build -tree. - - -\chapter{Obtaining the software} -\label{\detokenize{build/index:obtaining-the-software}} -\sphinxAtStartPar -The source code can be obtained from MIT Kerberos Distribution page, -at \sphinxurl{https://kerberos.org/dist/index.html}. -The MIT Kerberos distribution comes in an archive file, generally -named krb5\sphinxhyphen{}VERSION\sphinxhyphen{}signed.tar, where \sphinxstyleemphasis{VERSION} is a placeholder for -the major and minor versions of MIT Kerberos. (For example, MIT -Kerberos 1.9 has major version “1” and minor version “9”.) - -\sphinxAtStartPar -The krb5\sphinxhyphen{}VERSION\sphinxhyphen{}signed.tar contains a compressed tar file consisting -of the sources for all of Kerberos (generally named -krb5\sphinxhyphen{}VERSION.tar.gz) and a PGP signature file for this source tree -(generally named krb5\sphinxhyphen{}VERSION.tar.gz.asc). MIT highly recommends that -you verify the integrity of the source code using this signature, -e.g., by running: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{tar} \PYG{n}{xf} \PYG{n}{krb5}\PYG{o}{\PYGZhy{}}\PYG{n}{VERSION}\PYG{o}{\PYGZhy{}}\PYG{n}{signed}\PYG{o}{.}\PYG{n}{tar} -\PYG{n}{gpg} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{n}{verify} \PYG{n}{krb5}\PYG{o}{\PYGZhy{}}\PYG{n}{VERSION}\PYG{o}{.}\PYG{n}{tar}\PYG{o}{.}\PYG{n}{gz}\PYG{o}{.}\PYG{n}{asc} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Unpack krb5\sphinxhyphen{}VERSION.tar.gz in some directory. In this section we will assume -that you have chosen the top directory of the distribution the directory -\sphinxcode{\sphinxupquote{/u1/krb5\sphinxhyphen{}VERSION}}. - -\sphinxAtStartPar -Review the README file for the license, copyright and other sprecific to the -distribution information. - - -\chapter{Contents} -\label{\detokenize{build/index:contents}} -\sphinxstepscope - - -\section{Organization of the source directory} -\label{\detokenize{build/directory_org:organization-of-the-source-directory}}\label{\detokenize{build/directory_org::doc}} -\sphinxAtStartPar -Below is a brief overview of the organization of the complete source -directory. More detailed descriptions follow. - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -appl -& -\sphinxAtStartPar -Kerberos application client and server programs -\\ -\sphinxhline -\sphinxAtStartPar -ccapi -& -\sphinxAtStartPar -Credential cache services -\\ -\sphinxhline -\sphinxAtStartPar -clients -& -\sphinxAtStartPar -Kerberos V5 user programs (See \DUrole{xref,std,std-ref}{user\_commands}) -\\ -\sphinxhline -\sphinxAtStartPar -config -& -\sphinxAtStartPar -Configure scripts -\\ -\sphinxhline -\sphinxAtStartPar -config\sphinxhyphen{}files -& -\sphinxAtStartPar -Sample Kerberos configuration files -\\ -\sphinxhline -\sphinxAtStartPar -include -& -\sphinxAtStartPar -include files needed to build the Kerberos system -\\ -\sphinxhline -\sphinxAtStartPar -kadmin -& -\sphinxAtStartPar -Administrative interface to the Kerberos database: \DUrole{xref,std,std-ref}{kadmin(1)}, \DUrole{xref,std,std-ref}{kdb5\_util(8)}, \DUrole{xref,std,std-ref}{ktutil(1)}. -\\ -\sphinxhline -\sphinxAtStartPar -kdc -& -\sphinxAtStartPar -Kerberos V5 Authentication Service and Key Distribution Center -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{build/directory_org:lib}]{\sphinxcrossref{lib}}} -& -\sphinxAtStartPar -Libraries for use with/by Kerberos V5 -\\ -\sphinxhline -\sphinxAtStartPar -plugins -& -\sphinxAtStartPar -Kerberos plugins directory -\\ -\sphinxhline -\sphinxAtStartPar -po -& -\sphinxAtStartPar -Localization infrastructure -\\ -\sphinxhline -\sphinxAtStartPar -prototype -& -\sphinxAtStartPar -Templates files containing the MIT copyright message and a placeholder for the title and description of the file. -\\ -\sphinxhline -\sphinxAtStartPar -kprop -& -\sphinxAtStartPar -Utilities for propagating the database to replica KDCs \DUrole{xref,std,std-ref}{kprop(8)} and \DUrole{xref,std,std-ref}{kpropd(8)} -\\ -\sphinxhline -\sphinxAtStartPar -tests -& -\sphinxAtStartPar -Test suite -\\ -\sphinxhline -\sphinxAtStartPar -{\hyperref[\detokenize{build/directory_org:util}]{\sphinxcrossref{util}}} -& -\sphinxAtStartPar -Various utilities for building/configuring the code, sending bug reports, etc. -\\ -\sphinxhline -\sphinxAtStartPar -windows -& -\sphinxAtStartPar -Source code for building Kerberos V5 on Windows (see windows/README) -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - - -\subsection{lib} -\label{\detokenize{build/directory_org:lib}}\label{\detokenize{build/directory_org:id1}} -\sphinxAtStartPar -The lib directory contain several subdirectories as well as some -definition and glue files. -\begin{itemize} -\item {} -\sphinxAtStartPar -The apputils directory contains the code for the generic network -servicing. - -\item {} -\sphinxAtStartPar -The crypto subdirectory contains the Kerberos V5 encryption -library. - -\item {} -\sphinxAtStartPar -The gssapi library contains the Generic Security Services API, -which is a library of commands to be used in secure client\sphinxhyphen{}server -communication. - -\item {} -\sphinxAtStartPar -The kadm5 directory contains the libraries for the KADM5 -administration utilities. - -\item {} -\sphinxAtStartPar -The Kerberos 5 database libraries are contained in kdb. - -\item {} -\sphinxAtStartPar -The krb5 directory contains Kerberos 5 API. - -\item {} -\sphinxAtStartPar -The rpc directory contains the API for the Kerberos Remote -Procedure Call protocol. - -\end{itemize} - - -\subsection{util} -\label{\detokenize{build/directory_org:util}}\label{\detokenize{build/directory_org:id2}}\begin{description} -\sphinxlineitem{The util directory contains several utility programs and libraries.}\begin{itemize} -\item {} -\sphinxAtStartPar -the programs used to configure and build the code, such as -autoconf, lndir, kbuild, reconf, and makedepend, are in this -directory. - -\item {} -\sphinxAtStartPar -the profile directory contains most of the functions which parse -the Kerberos configuration files (krb5.conf and kdc.conf). - -\item {} -\sphinxAtStartPar -the Kerberos error table library and utilities (et); - -\item {} -\sphinxAtStartPar -the Sub\sphinxhyphen{}system library and utilities (ss); - -\item {} -\sphinxAtStartPar -database utilities (db2); - -\item {} -\sphinxAtStartPar -pseudo\sphinxhyphen{}terminal utilities (pty); - -\item {} -\sphinxAtStartPar -bug\sphinxhyphen{}reporting program send\sphinxhyphen{}pr; - -\item {} -\sphinxAtStartPar -a generic support library support used by several of our other -libraries; - -\item {} -\sphinxAtStartPar -the build infrastructure for building lightweight Kerberos client -(collected\sphinxhyphen{}client\sphinxhyphen{}lib) - -\item {} -\sphinxAtStartPar -the tool for validating Kerberos configuration files -(confvalidator); - -\item {} -\sphinxAtStartPar -the toolkit for kernel integrators for building krb5 code subsets -(gss\sphinxhyphen{}kernel\sphinxhyphen{}lib); - -\item {} -\sphinxAtStartPar -source code for building Kerberos V5 on MacOS (mac) - -\item {} -\sphinxAtStartPar -Windows getopt operations (windows) - -\end{itemize} - -\end{description} - -\sphinxstepscope - - -\section{Doing the build} -\label{\detokenize{build/doing_build:doing-the-build}}\label{\detokenize{build/doing_build::doc}} - -\subsection{Building within a single tree} -\label{\detokenize{build/doing_build:building-within-a-single-tree}}\label{\detokenize{build/doing_build:do-build}} -\sphinxAtStartPar -If you only need to build Kerberos for one platform, using a single -directory tree which contains both the source files and the object -files is the simplest. However, if you need to maintain Kerberos for -a large number of platforms, you will probably want to use separate -build trees for each platform. We recommend that you look at OS -Incompatibilities, for notes that we have on particular operating -systems. - -\sphinxAtStartPar -If you don’t want separate build trees for each architecture, then use -the following abbreviated procedure: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{cd} \PYG{o}{/}\PYG{n}{u1}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{\PYGZhy{}}\PYG{n}{VERSION}\PYG{o}{/}\PYG{n}{src} -\PYG{o}{.}\PYG{o}{/}\PYG{n}{configure} -\PYG{n}{make} -\end{sphinxVerbatim} - -\sphinxAtStartPar -That’s it! - - -\subsection{Building with separate build directories} -\label{\detokenize{build/doing_build:building-with-separate-build-directories}} -\sphinxAtStartPar -If you wish to keep separate build directories for each platform, you -can do so using the following procedure. (Note, this requires that -your make program support VPATH. GNU’s make will provide this -functionality, for example.) If your make program does not support -this, see the next section. - -\sphinxAtStartPar -For example, if you wish to store the binaries in \sphinxcode{\sphinxupquote{tmpbuild}} build -directory you might use the following procedure: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{mkdir} \PYG{o}{/}\PYG{n}{u1}\PYG{o}{/}\PYG{n}{tmpbuild} -\PYG{n}{cd} \PYG{o}{/}\PYG{n}{u1}\PYG{o}{/}\PYG{n}{tmpbuild} -\PYG{o}{/}\PYG{n}{u1}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{\PYGZhy{}}\PYG{n}{VERSION}\PYG{o}{/}\PYG{n}{src}\PYG{o}{/}\PYG{n}{configure} -\PYG{n}{make} -\end{sphinxVerbatim} - - -\subsection{Building using lndir} -\label{\detokenize{build/doing_build:building-using-lndir}} -\sphinxAtStartPar -If you wish to keep separate build directories for each platform, and -you do not have access to a make program which supports VPATH, all is -not lost. You can use the lndir program to create symbolic link trees -in your build directory. - -\sphinxAtStartPar -For example, if you wish to create a build directory for solaris -binaries you might use the following procedure: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -mkdir /u1/krb5\PYGZhy{}VERSION/solaris -cd /u1/krb5\PYGZhy{}VERSION/solaris -/u1/krb5\PYGZhy{}VERSION/src/util/lndir `pwd`/../src -./configure -make -\end{sphinxVerbatim} - -\sphinxAtStartPar -You must give an absolute pathname to lndir because it has a bug that -makes it fail for relative pathnames. Note that this version differs -from the latest version as distributed and installed by the -XConsortium with X11R6. Either version should be acceptable. - - -\subsection{Installing the binaries} -\label{\detokenize{build/doing_build:installing-the-binaries}} -\sphinxAtStartPar -Once you have built Kerberos, you should install the binaries. You can -do this by running: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{make} \PYG{n}{install} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If you want to install the binaries into a destination directory that -is not their final destination, which may be convenient if you want to -build a binary distribution to be deployed on multiple hosts, you may -use: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{make} \PYG{n}{install} \PYG{n}{DESTDIR}\PYG{o}{=}\PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{destdir} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This will install the binaries under \sphinxstyleemphasis{DESTDIR/PREFIX}, e.g., the user -programs will install into \sphinxstyleemphasis{DESTDIR/PREFIX/bin}, the libraries into -\sphinxstyleemphasis{DESTDIR/PREFIX/lib}, etc. \sphinxstyleemphasis{DESTDIR} must be an absolute path. - -\sphinxAtStartPar -Some implementations of make allow multiple commands to be run in -parallel, for faster builds. We test our Makefiles in parallel builds -with GNU make only; they may not be compatible with other parallel -build implementations. - - -\subsection{Testing the build} -\label{\detokenize{build/doing_build:testing-the-build}} -\sphinxAtStartPar -The Kerberos V5 distribution comes with built\sphinxhyphen{}in regression tests. To -run them, simply type the following command while in the top\sphinxhyphen{}level -build directory (i.e., the directory where you sent typed make to -start building Kerberos; see {\hyperref[\detokenize{build/doing_build:do-build}]{\sphinxcrossref{\DUrole{std,std-ref}{Building within a single tree}}}}): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{make} \PYG{n}{check} -\end{sphinxVerbatim} - -\sphinxAtStartPar -On some operating systems, you have to run \sphinxcode{\sphinxupquote{make install}} before -running \sphinxcode{\sphinxupquote{make check}}, or the test suite will pick up installed -versions of Kerberos libraries rather than the newly built ones. You -can install into a prefix that isn’t in the system library search -path, though. Alternatively, you can configure with -\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}rpath}, which renders the build tree less suitable -for installation, but allows testing without interference from -previously installed libraries. - -\sphinxAtStartPar -There are additional regression tests available, which are not run -by \sphinxcode{\sphinxupquote{make check}}. These tests require manual setup and teardown of -support infrastructure which is not easily automated, or require -excessive resources for ordinary use. The procedure for running -the manual tests is documented at -\sphinxurl{https://k5wiki.kerberos.org/wiki/Manual\_Testing}. - - -\subsection{Cleaning up the build} -\label{\detokenize{build/doing_build:cleaning-up-the-build}}\begin{itemize} -\item {} -\sphinxAtStartPar -Use \sphinxcode{\sphinxupquote{make clean}} to remove all files generated by running make -command. - -\item {} -\sphinxAtStartPar -Use \sphinxcode{\sphinxupquote{make distclean}} to remove all files generated by running -./configure script. After running \sphinxcode{\sphinxupquote{make distclean}} your source -tree (ideally) should look like the raw (just un\sphinxhyphen{}tarred) source -tree. - -\end{itemize} - - -\subsection{Using autoconf} -\label{\detokenize{build/doing_build:using-autoconf}} -\sphinxAtStartPar -(If you are not a developer, you can ignore this section.) - -\sphinxAtStartPar -In the Kerberos V5 source directory, there is a configure script which -automatically determines the compilation environment and creates the -proper Makefiles for a particular platform. This configure script is -generated using autoconf, which you should already have installed if -you will be making changes to \sphinxcode{\sphinxupquote{src/configure.in}}. - -\sphinxAtStartPar -Normal users will not need to worry about running autoconf; the -distribution comes with the configure script already prebuilt. - -\sphinxAtStartPar -The autoconf package comes with a script called \sphinxcode{\sphinxupquote{autoreconf}} that -will automatically run \sphinxcode{\sphinxupquote{autoconf}} and \sphinxcode{\sphinxupquote{autoheader}} as needed. You -should run \sphinxcode{\sphinxupquote{autoreconf}} from the top source directory, e.g.: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{cd} \PYG{o}{/}\PYG{n}{u1}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{\PYGZhy{}}\PYG{n}{VERSION}\PYG{o}{/}\PYG{n}{src} -\PYG{n}{autoreconf} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{n}{verbose} -\end{sphinxVerbatim} - -\sphinxstepscope - - -\section{Options to \sphinxstyleemphasis{configure}} -\label{\detokenize{build/options2configure:options-to-configure}}\label{\detokenize{build/options2configure:options2configure}}\label{\detokenize{build/options2configure::doc}} -\sphinxAtStartPar -There are a number of options to configure which you can use to -control how the Kerberos distribution is built. - - -\subsection{Most commonly used options} -\label{\detokenize{build/options2configure:most-commonly-used-options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}help}} -\sphinxAtStartPar -Provides help to configure. This will list the set of commonly -used options for building Kerberos. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}prefix=}\sphinxstyleemphasis{PREFIX}} -\sphinxAtStartPar -By default, Kerberos will install the package’s files rooted at -\sphinxcode{\sphinxupquote{/usr/local}}. If you desire to place the binaries into the -directory \sphinxstyleemphasis{PREFIX}, use this option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}exec\sphinxhyphen{}prefix=}\sphinxstyleemphasis{EXECPREFIX}} -\sphinxAtStartPar -This option allows one to separate the architecture independent -programs from the host\sphinxhyphen{}dependent files (configuration files, -manual pages). Use this option to install architecture\sphinxhyphen{}dependent -programs in \sphinxstyleemphasis{EXECPREFIX}. The default location is the value of -specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}prefix} option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}localstatedir=}\sphinxstyleemphasis{LOCALSTATEDIR}} -\sphinxAtStartPar -This option sets the directory for locally modifiable -single\sphinxhyphen{}machine data. In Kerberos, this mostly is useful for -setting a location for the KDC data files, as they will be -installed in \sphinxcode{\sphinxupquote{LOCALSTATEDIR/krb5kdc}}, which is by default -\sphinxcode{\sphinxupquote{PREFIX/var/krb5kdc}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}netlib}{[}=\sphinxstyleemphasis{libs}{]}} -\sphinxAtStartPar -Allows for suppression of or replacement of network libraries. By -default, Kerberos V5 configuration will look for \sphinxcode{\sphinxupquote{\sphinxhyphen{}lnsl}} and -\sphinxcode{\sphinxupquote{\sphinxhyphen{}lsocket}}. If your operating system has a broken resolver -library or fails to pass the tests in \sphinxcode{\sphinxupquote{src/tests/resolv}}, you -will need to use this option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}enable\sphinxhyphen{}dns\sphinxhyphen{}for\sphinxhyphen{}realm}} -\sphinxAtStartPar -Enable the use of DNS to look up a host’s Kerberos realm, -if the information is not provided in -\DUrole{xref,std,std-ref}{krb5.conf(5)}. See \DUrole{xref,std,std-ref}{mapping\_hostnames} -for information about using DNS to determine the default realm. -DNS lookups for realm names are disabled by default. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}system\sphinxhyphen{}et}} -\sphinxAtStartPar -Use an installed version of the error\sphinxhyphen{}table (et) support software, -the compile\_et program, the com\_err.h header file and the com\_err -library. If these are not in the default locations, you may wish -to specify \sphinxcode{\sphinxupquote{CPPFLAGS=\sphinxhyphen{}I/some/dir}} and -\sphinxcode{\sphinxupquote{LDFLAGS=\sphinxhyphen{}L/some/other/dir}} options at configuration time as -well. - -\sphinxAtStartPar -If this option is not given, a version supplied with the Kerberos -sources will be built and installed along with the rest of the -Kerberos tree, for Kerberos applications to link against. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}system\sphinxhyphen{}ss}} -\sphinxAtStartPar -Use an installed version of the subsystem command\sphinxhyphen{}line interface -software, the mk\_cmds program, the \sphinxcode{\sphinxupquote{ss/ss.h}} header file and the -ss library. If these are not in the default locations, you may -wish to specify \sphinxcode{\sphinxupquote{CPPFLAGS=\sphinxhyphen{}I/some/dir}} and -\sphinxcode{\sphinxupquote{LDFLAGS=\sphinxhyphen{}L/some/other/dir}} options at configuration time as -well. See also the \sphinxstylestrong{SS\_LIB} option. - -\sphinxAtStartPar -If this option is not given, the ss library supplied with the -Kerberos sources will be compiled and linked into those programs -that need it; it will not be installed separately. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}system\sphinxhyphen{}db}} -\sphinxAtStartPar -Use an installed version of the Berkeley DB package, which must -provide an API compatible with version 1.85. This option is -unsupported and untested. In particular, we do not know if the -database\sphinxhyphen{}rename code used in the dumpfile load operation will -behave properly. - -\sphinxAtStartPar -If this option is not given, a version supplied with the Kerberos -sources will be built and installed. (We are not updating this -version at this time because of licensing issues with newer -versions that we haven’t investigated sufficiently yet.) - -\end{description} - - -\subsection{Environment variables} -\label{\detokenize{build/options2configure:environment-variables}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{CC=}\sphinxstyleemphasis{COMPILER}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{COMPILER} as the C compiler. - -\sphinxlineitem{\sphinxstylestrong{CFLAGS=}\sphinxstyleemphasis{FLAGS}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{FLAGS} as the default set of C compiler flags. - -\sphinxlineitem{\sphinxstylestrong{CPP=}\sphinxstyleemphasis{CPP}} -\sphinxAtStartPar -C preprocessor to use. (e.g., \sphinxcode{\sphinxupquote{CPP=\textquotesingle{}gcc \sphinxhyphen{}E\textquotesingle{}}}) - -\sphinxlineitem{\sphinxstylestrong{CPPFLAGS=}\sphinxstyleemphasis{CPPOPTS}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{CPPOPTS} as the default set of C preprocessor flags. The -most common use of this option is to select certain \#define’s for -use with the operating system’s include files. - -\sphinxlineitem{\sphinxstylestrong{DB\_HEADER=}\sphinxstyleemphasis{headername}} -\sphinxAtStartPar -If db.h is not the correct header file to include to compile -against the Berkeley DB 1.85 API, specify the correct header file -name with this option. For example, \sphinxcode{\sphinxupquote{DB\_HEADER=db3/db\_185.h}}. - -\sphinxlineitem{\sphinxstylestrong{DB\_LIB=}\sphinxstyleemphasis{libs}…} -\sphinxAtStartPar -If \sphinxcode{\sphinxupquote{\sphinxhyphen{}ldb}} is not the correct library specification for the -Berkeley DB library version to be used, override it with this -option. For example, \sphinxcode{\sphinxupquote{DB\_LIB=\sphinxhyphen{}ldb\sphinxhyphen{}3.3}}. - -\sphinxlineitem{\sphinxstylestrong{DEFCCNAME=}\sphinxstyleemphasis{ccachename}} -\sphinxAtStartPar -Override the built\sphinxhyphen{}in default credential cache name. -For example, \sphinxcode{\sphinxupquote{DEFCCNAME=DIR:/var/run/user/\%\{USERID\}/ccache}} -See \DUrole{xref,std,std-ref}{parameter\_expansion} for information about supported -parameter expansions. - -\sphinxlineitem{\sphinxstylestrong{DEFCKTNAME=}\sphinxstyleemphasis{keytabname}} -\sphinxAtStartPar -Override the built\sphinxhyphen{}in default client keytab name. -The format is the same as for \sphinxstyleemphasis{DEFCCNAME}. - -\sphinxlineitem{\sphinxstylestrong{DEFKTNAME=}\sphinxstyleemphasis{keytabname}} -\sphinxAtStartPar -Override the built\sphinxhyphen{}in default keytab name. -The format is the same as for \sphinxstyleemphasis{DEFCCNAME}. - -\sphinxlineitem{\sphinxstylestrong{LD=}\sphinxstyleemphasis{LINKER}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{LINKER} as the default loader if it should be different from -C compiler as specified above. - -\sphinxlineitem{\sphinxstylestrong{LDFLAGS=}\sphinxstyleemphasis{LDOPTS}} -\sphinxAtStartPar -This option informs the linker where to get additional libraries -(e.g., \sphinxcode{\sphinxupquote{\sphinxhyphen{}L\textless{}lib dir\textgreater{}}}). - -\sphinxlineitem{\sphinxstylestrong{LIBS=}\sphinxstyleemphasis{LDNAME}} -\sphinxAtStartPar -This option allows one to specify libraries to be passed to the -linker (e.g., \sphinxcode{\sphinxupquote{\sphinxhyphen{}l\textless{}library\textgreater{}}}) - -\sphinxlineitem{\sphinxstylestrong{PKCS11\_MODNAME=}\sphinxstyleemphasis{library}} -\sphinxAtStartPar -Override the built\sphinxhyphen{}in default PKCS11 library name. - -\sphinxlineitem{\sphinxstylestrong{SS\_LIB=}\sphinxstyleemphasis{libs}…} -\sphinxAtStartPar -If \sphinxcode{\sphinxupquote{\sphinxhyphen{}lss}} is not the correct way to link in your installed ss -library, for example if additional support libraries are needed, -specify the correct link options here. Some variants of this -library are around which allow for Emacs\sphinxhyphen{}like line editing, but -different versions require different support libraries to be -explicitly specified. - -\sphinxAtStartPar -This option is ignored if \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}system\sphinxhyphen{}ss} is not specified. - -\sphinxlineitem{\sphinxstylestrong{YACC}} -\sphinxAtStartPar -The ‘Yet Another C Compiler’ implementation to use. Defaults to -the first program found out of: ‘\sphinxtitleref{bison \sphinxhyphen{}y}’, ‘\sphinxtitleref{byacc}’, -‘\sphinxtitleref{yacc}’. - -\sphinxlineitem{\sphinxstylestrong{YFLAGS}} -\sphinxAtStartPar -The list of arguments that will be passed by default to \$YACC. -This script will default YFLAGS to the empty string to avoid a -default value of \sphinxcode{\sphinxupquote{\sphinxhyphen{}d}} given by some make applications. - -\end{description} - - -\subsection{Fine tuning of the installation directories} -\label{\detokenize{build/options2configure:fine-tuning-of-the-installation-directories}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}bindir=}\sphinxstyleemphasis{DIR}} -\sphinxAtStartPar -User executables. Defaults to \sphinxcode{\sphinxupquote{EXECPREFIX/bin}}, where -\sphinxstyleemphasis{EXECPREFIX} is the path specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}exec\sphinxhyphen{}prefix} -configuration option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}sbindir=}\sphinxstyleemphasis{DIR}} -\sphinxAtStartPar -System admin executables. Defaults to \sphinxcode{\sphinxupquote{EXECPREFIX/sbin}}, where -\sphinxstyleemphasis{EXECPREFIX} is the path specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}exec\sphinxhyphen{}prefix} -configuration option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}sysconfdir=}\sphinxstyleemphasis{DIR}} -\sphinxAtStartPar -Read\sphinxhyphen{}only single\sphinxhyphen{}machine data such as krb5.conf. -Defaults to \sphinxcode{\sphinxupquote{PREFIX/etc}}, where -\sphinxstyleemphasis{PREFIX} is the path specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}prefix} configuration -option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}libdir=}\sphinxstyleemphasis{DIR}} -\sphinxAtStartPar -Object code libraries. Defaults to \sphinxcode{\sphinxupquote{EXECPREFIX/lib}}, where -\sphinxstyleemphasis{EXECPREFIX} is the path specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}exec\sphinxhyphen{}prefix} -configuration option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}includedir=}\sphinxstyleemphasis{DIR}} -\sphinxAtStartPar -C header files. Defaults to \sphinxcode{\sphinxupquote{PREFIX/include}}, where \sphinxstyleemphasis{PREFIX} is -the path specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}prefix} configuration option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}datarootdir=}\sphinxstyleemphasis{DATAROOTDIR}} -\sphinxAtStartPar -Read\sphinxhyphen{}only architecture\sphinxhyphen{}independent data root. Defaults to -\sphinxcode{\sphinxupquote{PREFIX/share}}, where \sphinxstyleemphasis{PREFIX} is the path specified by -\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}prefix} configuration option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}datadir=}\sphinxstyleemphasis{DIR}} -\sphinxAtStartPar -Read\sphinxhyphen{}only architecture\sphinxhyphen{}independent data. Defaults to path -specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}datarootdir} configuration option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}localedir=}\sphinxstyleemphasis{DIR}} -\sphinxAtStartPar -Locale\sphinxhyphen{}dependent data. Defaults to \sphinxcode{\sphinxupquote{DATAROOTDIR/locale}}, where -\sphinxstyleemphasis{DATAROOTDIR} is the path specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}datarootdir} -configuration option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}mandir=}\sphinxstyleemphasis{DIR}} -\sphinxAtStartPar -Man documentation. Defaults to \sphinxcode{\sphinxupquote{DATAROOTDIR/man}}, where -\sphinxstyleemphasis{DATAROOTDIR} is the path specified by \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}datarootdir} -configuration option. - -\end{description} - - -\subsection{Program names} -\label{\detokenize{build/options2configure:program-names}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}program\sphinxhyphen{}prefix=}\sphinxstyleemphasis{PREFIX}} -\sphinxAtStartPar -Prepend \sphinxstyleemphasis{PREFIX} to the names of the programs when installing -them. For example, specifying \sphinxcode{\sphinxupquote{\sphinxhyphen{}\sphinxhyphen{}program\sphinxhyphen{}prefix=mit\sphinxhyphen{}}} at the -configure time will cause the program named \sphinxcode{\sphinxupquote{abc}} to be -installed as \sphinxcode{\sphinxupquote{mit\sphinxhyphen{}abc}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}program\sphinxhyphen{}suffix=}\sphinxstyleemphasis{SUFFIX}} -\sphinxAtStartPar -Append \sphinxstyleemphasis{SUFFIX} to the names of the programs when installing them. -For example, specifying \sphinxcode{\sphinxupquote{\sphinxhyphen{}\sphinxhyphen{}program\sphinxhyphen{}suffix=\sphinxhyphen{}mit}} at the configure -time will cause the program named \sphinxcode{\sphinxupquote{abc}} to be installed as -\sphinxcode{\sphinxupquote{abc\sphinxhyphen{}mit}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}program\sphinxhyphen{}transform\sphinxhyphen{}name=}\sphinxstyleemphasis{PROGRAM}} -\sphinxAtStartPar -Run \sphinxcode{\sphinxupquote{sed \sphinxhyphen{}e PROGRAM}} on installed program names. (\sphinxstyleemphasis{PROGRAM} is a -sed script). - -\end{description} - - -\subsection{System types} -\label{\detokenize{build/options2configure:system-types}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}build=}\sphinxstyleemphasis{BUILD}} -\sphinxAtStartPar -Configure for building on \sphinxstyleemphasis{BUILD} -(e.g., \sphinxcode{\sphinxupquote{\sphinxhyphen{}\sphinxhyphen{}build=x86\_64\sphinxhyphen{}linux\sphinxhyphen{}gnu}}). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}host=}\sphinxstyleemphasis{HOST}} -\sphinxAtStartPar -Cross\sphinxhyphen{}compile to build programs to run on \sphinxstyleemphasis{HOST} -(e.g., \sphinxcode{\sphinxupquote{\sphinxhyphen{}\sphinxhyphen{}host=x86\_64\sphinxhyphen{}linux\sphinxhyphen{}gnu}}). By default, Kerberos V5 -configuration will look for “build” option. - -\end{description} - - -\subsection{Optional features} -\label{\detokenize{build/options2configure:optional-features}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}option\sphinxhyphen{}checking}} -\sphinxAtStartPar -Ignore unrecognized \textendash{}enable/\textendash{}with options. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}}\sphinxstyleemphasis{FEATURE}} -\sphinxAtStartPar -Do not include \sphinxstyleemphasis{FEATURE} (same as \textendash{}enable\sphinxhyphen{}FEATURE=no). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}enable\sphinxhyphen{}}\sphinxstyleemphasis{FEATURE}{[}=\sphinxstyleemphasis{ARG}{]}} -\sphinxAtStartPar -Include \sphinxstyleemphasis{FEATURE} {[}ARG=yes{]}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}enable\sphinxhyphen{}maintainer\sphinxhyphen{}mode}} -\sphinxAtStartPar -Enable rebuilding of source files, Makefiles, etc. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}delayed\sphinxhyphen{}initialization}} -\sphinxAtStartPar -Initialize library code when loaded. Defaults to delay until -first use. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}thread\sphinxhyphen{}support}} -\sphinxAtStartPar -Don’t enable thread support. Defaults to enabled. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}rpath}} -\sphinxAtStartPar -Suppress run path flags in link lines. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}enable\sphinxhyphen{}athena}} -\sphinxAtStartPar -Build with MIT Project Athena configuration. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}kdc\sphinxhyphen{}lookaside\sphinxhyphen{}cache}} -\sphinxAtStartPar -Disable the cache which detects client retransmits. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}pkinit}} -\sphinxAtStartPar -Disable PKINIT plugin support. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}disable\sphinxhyphen{}aesni}} -\sphinxAtStartPar -Disable support for using AES instructions on x86 platforms. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}enable\sphinxhyphen{}asan}{[}=\sphinxstyleemphasis{ARG}{]}} -\sphinxAtStartPar -Enable building with asan memory error checking. If \sphinxstyleemphasis{ARG} is -given, it controls the \sphinxhyphen{}fsanitize compilation flag value (the -default is “address”). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}enable\sphinxhyphen{}ossfuzz}} -\sphinxAtStartPar -Enable building fuzzing targets with OSS\sphinxhyphen{}Fuzz build support. - -\end{description} - - -\subsection{Optional packages} -\label{\detokenize{build/options2configure:optional-packages}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}}\sphinxstyleemphasis{PACKAGE}{[}=ARG{]}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{PACKAGE} (e.g., \sphinxcode{\sphinxupquote{\sphinxhyphen{}\sphinxhyphen{}with\sphinxhyphen{}imap}}). The default value of \sphinxstyleemphasis{ARG} -is \sphinxcode{\sphinxupquote{yes}}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}without\sphinxhyphen{}}\sphinxstyleemphasis{PACKAGE}} -\sphinxAtStartPar -Do not use \sphinxstyleemphasis{PACKAGE} (same as \sphinxcode{\sphinxupquote{\sphinxhyphen{}\sphinxhyphen{}with\sphinxhyphen{}PACKAGE=no}}) -(e.g., \sphinxcode{\sphinxupquote{\sphinxhyphen{}\sphinxhyphen{}without\sphinxhyphen{}libedit}}). - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}size\sphinxhyphen{}optimizations}} -\sphinxAtStartPar -Enable a few optimizations to reduce code size possibly at some -run\sphinxhyphen{}time cost. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}system\sphinxhyphen{}et}} -\sphinxAtStartPar -Use the com\_err library and compile\_et utility that are already -installed on the system, instead of building and installing -local versions. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}system\sphinxhyphen{}ss}} -\sphinxAtStartPar -Use the ss library and mk\_cmds utility that are already installed -on the system, instead of building and using private versions. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}system\sphinxhyphen{}db}} -\sphinxAtStartPar -Use the berkeley db utility already installed on the system, -instead of using a private version. This option is not -recommended; enabling it may result in incompatibility with key -databases originating on other systems. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}netlib=}\sphinxstyleemphasis{LIBS}} -\sphinxAtStartPar -Use the resolver library specified in \sphinxstyleemphasis{LIBS}. Use this variable -if the C library resolver is insufficient or broken. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}hesiod=}\sphinxstyleemphasis{path}} -\sphinxAtStartPar -Compile with Hesiod support. The \sphinxstyleemphasis{path} points to the Hesiod -directory. By default Hesiod is unsupported. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}ldap}} -\sphinxAtStartPar -Compile OpenLDAP database backend module. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}lmdb}} -\sphinxAtStartPar -Compile LMDB database backend module. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}vague\sphinxhyphen{}errors}} -\sphinxAtStartPar -Do not send helpful errors to client. For example, if the KDC -should return only vague error codes to clients. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}crypto\sphinxhyphen{}impl=}\sphinxstyleemphasis{IMPL}} -\sphinxAtStartPar -Use specified crypto implementation (e.g., \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}crypto\sphinxhyphen{}impl=}\sphinxstyleemphasis{openssl}). The default is the native MIT -Kerberos implementation \sphinxcode{\sphinxupquote{builtin}}. The other currently -implemented crypto backend is \sphinxcode{\sphinxupquote{openssl}}. (See -\DUrole{xref,std,std-ref}{mitK5features}) - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}without\sphinxhyphen{}libedit}} -\sphinxAtStartPar -Do not compile and link against libedit. Some utilities will no -longer offer command history or completion in interactive mode if -libedit is disabled. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}readline}} -\sphinxAtStartPar -Compile and link against GNU readline, as an alternative to libedit. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}system\sphinxhyphen{}verto}} -\sphinxAtStartPar -Use an installed version of libverto. If the libverto header and -library are not in default locations, you may wish to specify -\sphinxcode{\sphinxupquote{CPPFLAGS=\sphinxhyphen{}I/some/dir}} and \sphinxcode{\sphinxupquote{LDFLAGS=\sphinxhyphen{}L/some/other/dir}} options -at configuration time as well. - -\sphinxAtStartPar -If this option is not given, the build system will try to detect -an installed version of libverto and use it if it is found. -Otherwise, a version supplied with the Kerberos sources will be -built and installed. The built\sphinxhyphen{}in version does not contain the -full set of back\sphinxhyphen{}end modules and is not a suitable general -replacement for the upstream version, but will work for the -purposes of Kerberos. - -\sphinxAtStartPar -Specifying \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}without\sphinxhyphen{}system\sphinxhyphen{}verto} will cause the built\sphinxhyphen{}in -version of libverto to be used unconditionally. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}with\sphinxhyphen{}krb5\sphinxhyphen{}config=}\sphinxstyleemphasis{PATH}} -\sphinxAtStartPar -Use the krb5\sphinxhyphen{}config program at \sphinxstyleemphasis{PATH} to obtain the build\sphinxhyphen{}time -default credential cache, keytab, and client keytab names. The -default is to use \sphinxcode{\sphinxupquote{krb5\sphinxhyphen{}config}} from the program path. Specify -\sphinxcode{\sphinxupquote{\sphinxhyphen{}\sphinxhyphen{}without\sphinxhyphen{}krb5\sphinxhyphen{}config}} to disable the use of krb5\sphinxhyphen{}config and -use the usual built\sphinxhyphen{}in defaults. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}without\sphinxhyphen{}keyutils}} -\sphinxAtStartPar -Build without libkeyutils support. This disables the KEYRING -credential cache type. - -\end{description} - - -\subsection{Examples} -\label{\detokenize{build/options2configure:examples}} -\sphinxAtStartPar -For example, in order to configure Kerberos on a Solaris machine using -the suncc compiler with the optimizer turned on, run the configure -script with the following options: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{o}{\PYGZpc{}} \PYG{o}{.}\PYG{o}{/}\PYG{n}{configure} \PYG{n}{CC}\PYG{o}{=}\PYG{n}{suncc} \PYG{n}{CFLAGS}\PYG{o}{=}\PYG{o}{\PYGZhy{}}\PYG{n}{O} -\end{sphinxVerbatim} - -\sphinxAtStartPar -For a slightly more complicated example, consider a system where -several packages to be used by Kerberos are installed in -\sphinxcode{\sphinxupquote{/usr/foobar}}, including Berkeley DB 3.3, and an ss library that -needs to link against the curses library. The configuration of -Kerberos might be done thus: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{o}{.}\PYG{o}{/}\PYG{n}{configure} \PYG{n}{CPPFLAGS}\PYG{o}{=}\PYG{o}{\PYGZhy{}}\PYG{n}{I}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{foobar}\PYG{o}{/}\PYG{n}{include} \PYG{n}{LDFLAGS}\PYG{o}{=}\PYG{o}{\PYGZhy{}}\PYG{n}{L}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{foobar}\PYG{o}{/}\PYG{n}{lib} \PYGZbs{} -\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{k}{with}\PYG{o}{\PYGZhy{}}\PYG{n}{system}\PYG{o}{\PYGZhy{}}\PYG{n}{et} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{k}{with}\PYG{o}{\PYGZhy{}}\PYG{n}{system}\PYG{o}{\PYGZhy{}}\PYG{n}{ss} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{k}{with}\PYG{o}{\PYGZhy{}}\PYG{n}{system}\PYG{o}{\PYGZhy{}}\PYG{n}{db} \PYGZbs{} -\PYG{n}{SS\PYGZus{}LIB}\PYG{o}{=}\PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{\PYGZhy{}lss \PYGZhy{}lcurses}\PYG{l+s+s1}{\PYGZsq{}} \PYG{n}{DB\PYGZus{}HEADER}\PYG{o}{=}\PYG{n}{db3}\PYG{o}{/}\PYG{n}{db\PYGZus{}185}\PYG{o}{.}\PYG{n}{h} \PYG{n}{DB\PYGZus{}LIB}\PYG{o}{=}\PYG{o}{\PYGZhy{}}\PYG{n}{ldb}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{3.3} -\end{sphinxVerbatim} - -\sphinxstepscope - - -\section{osconf.hin} -\label{\detokenize{build/osconf:osconf-hin}}\label{\detokenize{build/osconf::doc}} -\sphinxAtStartPar -There is one configuration file which you may wish to edit to control -various compile\sphinxhyphen{}time parameters in the Kerberos distribution: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{include}\PYG{o}{/}\PYG{n}{osconf}\PYG{o}{.}\PYG{n}{hin} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The list that follows is by no means complete, just some of the more -interesting variables. -\begin{description} -\sphinxlineitem{\sphinxstylestrong{DEFAULT\_PROFILE\_PATH}} -\sphinxAtStartPar -The pathname to the file which contains the profiles for the known -realms, their KDCs, etc. The default value is \sphinxcode{\sphinxupquote{/etc/krb5.conf}}. - -\sphinxlineitem{\sphinxstylestrong{DEFAULT\_KEYTAB\_NAME}} -\sphinxAtStartPar -The type and pathname to the default server keytab file. The -default is \DUrole{xref,std,std-ref}{DEFKTNAME}. - -\sphinxlineitem{\sphinxstylestrong{DEFAULT\_KDC\_ENCTYPE}} -\sphinxAtStartPar -The default encryption type for the KDC database master key. The -default value is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96}}. - -\sphinxlineitem{\sphinxstylestrong{RCTMPDIR}} -\sphinxAtStartPar -The directory which stores replay caches. The default is -\sphinxcode{\sphinxupquote{/var/tmp}}. - -\sphinxlineitem{\sphinxstylestrong{DEFAULT\_KDB\_FILE}} -\sphinxAtStartPar -The location of the default database. The default value is -\DUrole{xref,std,std-ref}{LOCALSTATEDIR}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/principal}}. - -\end{description} - - - -\renewcommand{\indexname}{Index} -\printindex -\end{document}
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/latexmkjarc b/crypto/krb5/doc/pdf/latexmkjarc deleted file mode 100644 index 6e36b195b2d3..000000000000 --- a/crypto/krb5/doc/pdf/latexmkjarc +++ /dev/null @@ -1,22 +0,0 @@ -$latex = 'pdflatex ' . $ENV{'LATEXOPTS'} . ' -kanji=utf8 %O %S'; -$dvipdf = 'dvipdfmx %O -o %D %S'; -$makeindex = 'internal mendex %S %B %D'; -sub mendex { - my ($source, $basename, $destination) = @_; - my $dictfile = $basename . ".dic"; - unlink($destination); - system("mendex", "-U", "-f", "-d", $dictfile, "-s", "python.ist", $source); - if ($? > 0) { - print("mendex exited with error code $? (ignored)\n"); - } - if (!-e $destination) { - # create an empty .ind file if nothing - open(FH, ">" . $destination); - close(FH); - } - return 0; -} -add_cus_dep( "glo", "gls", 0, "makeglo" ); -sub makeglo { - return system( "mendex -J -f -s gglo.ist -o '$_[0].gls' '$_[0].glo'" ); -}
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/latexmkrc b/crypto/krb5/doc/pdf/latexmkrc deleted file mode 100644 index bba17fa6bc6a..000000000000 --- a/crypto/krb5/doc/pdf/latexmkrc +++ /dev/null @@ -1,9 +0,0 @@ -$latex = 'latex ' . $ENV{'LATEXOPTS'} . ' %O %S'; -$pdflatex = 'pdflatex ' . $ENV{'LATEXOPTS'} . ' %O %S'; -$lualatex = 'lualatex ' . $ENV{'LATEXOPTS'} . ' %O %S'; -$xelatex = 'xelatex --no-pdf ' . $ENV{'LATEXOPTS'} . ' %O %S'; -$makeindex = 'makeindex -s python.ist %O -o %D %S'; -add_cus_dep( "glo", "gls", 0, "makeglo" ); -sub makeglo { - return system( "makeindex -s gglo.ist -o '$_[0].gls' '$_[0].glo'" ); -}
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/make.bat b/crypto/krb5/doc/pdf/make.bat deleted file mode 100644 index 94bda2139156..000000000000 --- a/crypto/krb5/doc/pdf/make.bat +++ /dev/null @@ -1,31 +0,0 @@ -@ECHO OFF - -REM Command file for Sphinx documentation - -pushd %~dp0 - -set PDFLATEX=latexmk -pdf -dvi- -ps- - -set "LATEXOPTS= " - -if "%1" == "" goto all-pdf - -if "%1" == "all-pdf" ( - :all-pdf - for %%i in (*.tex) do ( - %PDFLATEX% %LATEXMKOPTS% %%i - ) - goto end -) - -if "%1" == "all-pdf-ja" ( - goto all-pdf -) - -if "%1" == "clean" ( - del /q /s *.dvi *.log *.ind *.aux *.toc *.syn *.idx *.out *.ilg *.pla *.ps *.tar *.tar.gz *.tar.bz2 *.tar.xz *.fls *.fdb_latexmk - goto end -) - -:end -popd
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/plugindev.pdf b/crypto/krb5/doc/pdf/plugindev.pdf Binary files differdeleted file mode 100644 index 4c97d4028a39..000000000000 --- a/crypto/krb5/doc/pdf/plugindev.pdf +++ /dev/null diff --git a/crypto/krb5/doc/pdf/plugindev.tex b/crypto/krb5/doc/pdf/plugindev.tex deleted file mode 100644 index 86349d63e3aa..000000000000 --- a/crypto/krb5/doc/pdf/plugindev.tex +++ /dev/null @@ -1,1058 +0,0 @@ -%% Generated by Sphinx. -\def\sphinxdocclass{report} -\documentclass[letterpaper,10pt,english]{sphinxmanual} -\ifdefined\pdfpxdimen - \let\sphinxpxdimen\pdfpxdimen\else\newdimen\sphinxpxdimen -\fi \sphinxpxdimen=.75bp\relax -\ifdefined\pdfimageresolution - \pdfimageresolution= \numexpr \dimexpr1in\relax/\sphinxpxdimen\relax -\fi -%% let collapsible pdf bookmarks panel have high depth per default -\PassOptionsToPackage{bookmarksdepth=5}{hyperref} - -\PassOptionsToPackage{booktabs}{sphinx} -\PassOptionsToPackage{colorrows}{sphinx} - -\PassOptionsToPackage{warn}{textcomp} -\usepackage[utf8]{inputenc} -\ifdefined\DeclareUnicodeCharacter -% support both utf8 and utf8x syntaxes - \ifdefined\DeclareUnicodeCharacterAsOptional - \def\sphinxDUC#1{\DeclareUnicodeCharacter{"#1}} - \else - \let\sphinxDUC\DeclareUnicodeCharacter - \fi - \sphinxDUC{00A0}{\nobreakspace} - \sphinxDUC{2500}{\sphinxunichar{2500}} - \sphinxDUC{2502}{\sphinxunichar{2502}} - \sphinxDUC{2514}{\sphinxunichar{2514}} - \sphinxDUC{251C}{\sphinxunichar{251C}} - \sphinxDUC{2572}{\textbackslash} -\fi -\usepackage{cmap} -\usepackage[T1]{fontenc} -\usepackage{amsmath,amssymb,amstext} -\usepackage{babel} - - - -\usepackage{tgtermes} -\usepackage{tgheros} -\renewcommand{\ttdefault}{txtt} - - - -\usepackage[Bjarne]{fncychap} -\usepackage{sphinx} - -\fvset{fontsize=auto} -\usepackage{geometry} - - -% Include hyperref last. -\usepackage{hyperref} -% Fix anchor placement for figures with captions. -\usepackage{hypcap}% it must be loaded after hyperref. -% Set up styles of URL: it should be placed after hyperref. -\urlstyle{same} - - -\usepackage{sphinxmessages} -\setcounter{tocdepth}{1} - - - -\title{Kerberos Plugin Module Developer Guide} -\date{ } -\release{1.22\sphinxhyphen{}final} -\author{MIT} -\newcommand{\sphinxlogo}{\vbox{}} -\renewcommand{\releasename}{Release} -\makeindex -\begin{document} - -\ifdefined\shorthandoff - \ifnum\catcode`\=\string=\active\shorthandoff{=}\fi - \ifnum\catcode`\"=\active\shorthandoff{"}\fi -\fi - -\pagestyle{empty} -\sphinxmaketitle -\pagestyle{plain} -\sphinxtableofcontents -\pagestyle{normal} -\phantomsection\label{\detokenize{plugindev/index::doc}} - - -\sphinxAtStartPar -Kerberos plugin modules allow increased control over MIT krb5 library -and server behavior. This guide describes how to create dynamic -plugin modules and the currently available pluggable interfaces. - -\sphinxAtStartPar -See \DUrole{xref,std,std-ref}{plugin\_config} for information on how to register dynamic -plugin modules and how to enable and disable modules via -\DUrole{xref,std,std-ref}{krb5.conf(5)}. - - -\chapter{Contents} -\label{\detokenize{plugindev/index:contents}} -\sphinxstepscope - - -\section{General plugin concepts} -\label{\detokenize{plugindev/general:general-plugin-concepts}}\label{\detokenize{plugindev/general::doc}} -\sphinxAtStartPar -A krb5 dynamic plugin module is a Unix shared object or Windows DLL. -Typically, the source code for a dynamic plugin module should live in -its own project with a build system using \sphinxhref{https://www.gnu.org/software/automake/}{automake} and \sphinxhref{https://www.gnu.org/software/libtool/}{libtool}, or -tools with similar functionality. - -\sphinxAtStartPar -A plugin module must define a specific symbol name, which depends on -the pluggable interface and module name. For most pluggable -interfaces, the exported symbol is a function named -\sphinxcode{\sphinxupquote{INTERFACE\_MODULE\_initvt}}, where \sphinxstyleemphasis{INTERFACE} is the name of the -pluggable interface and \sphinxstyleemphasis{MODULE} is the name of the module. For these -interfaces, it is possible for one shared object or DLL to implement -multiple plugin modules, either for the same pluggable interface or -for different ones. For example, a shared object could implement both -KDC and client preauthentication mechanisms, by exporting functions -named \sphinxcode{\sphinxupquote{kdcpreauth\_mymech\_initvt}} and \sphinxcode{\sphinxupquote{clpreauth\_mymech\_initvt}}. - -\sphinxAtStartPar -A plugin module implementation should include the header file -\sphinxcode{\sphinxupquote{\textless{}krb5/INTERFACE\_plugin.h\textgreater{}}}, where \sphinxstyleemphasis{INTERFACE} is the name of the -pluggable interface. For instance, a ccselect plugin module -implementation should use \sphinxcode{\sphinxupquote{\#include \textless{}krb5/ccselect\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -initvt functions have the following prototype: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5\PYGZus{}error\PYGZus{}code} \PYG{n}{interface\PYGZus{}modname\PYGZus{}initvt}\PYG{p}{(}\PYG{n}{krb5\PYGZus{}context} \PYG{n}{context}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{maj\PYGZus{}ver}\PYG{p}{,} \PYG{n+nb}{int} \PYG{n}{min\PYGZus{}ver}\PYG{p}{,} - \PYG{n}{krb5\PYGZus{}plugin\PYGZus{}vtable} \PYG{n}{vtable}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -and should do the following: -\begin{enumerate} -\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% -\item {} -\sphinxAtStartPar -Check that the supplied maj\_ver argument is supported by the -module. If it is not supported, the function should return -KRB5\_PLUGIN\_VER\_NOTSUPP. - -\item {} -\sphinxAtStartPar -Cast the supplied vtable pointer to the structure type -corresponding to the major version, as documented in the pluggable -interface header file. - -\item {} -\sphinxAtStartPar -Fill in the structure fields with pointers to method functions and -static data, stopping at the field indicated by the supplied minor -version. Fields for unimplemented optional methods can be left -alone; it is not necessary to initialize them to NULL. - -\end{enumerate} - -\sphinxAtStartPar -In most cases, the context argument will not be used. The initvt -function should not allocate memory; think of it as a glorified -structure initializer. Each pluggable interface defines methods for -allocating and freeing module state if doing so is necessary for the -interface. - -\sphinxAtStartPar -Pluggable interfaces typically include a \sphinxstylestrong{name} field in the vtable -structure, which should be filled in with a pointer to a string -literal containing the module name. - -\sphinxAtStartPar -Here is an example of what an initvt function might look like for a -fictional pluggable interface named fences, for a module named -“wicker”: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5\PYGZus{}error\PYGZus{}code} -\PYG{n}{fences\PYGZus{}wicker\PYGZus{}initvt}\PYG{p}{(}\PYG{n}{krb5\PYGZus{}context} \PYG{n}{context}\PYG{p}{,} \PYG{n+nb}{int} \PYG{n}{maj\PYGZus{}ver}\PYG{p}{,} - \PYG{n+nb}{int} \PYG{n}{min\PYGZus{}ver}\PYG{p}{,} \PYG{n}{krb5\PYGZus{}plugin\PYGZus{}vtable} \PYG{n}{vtable}\PYG{p}{)} -\PYG{p}{\PYGZob{}} - \PYG{n}{krb5\PYGZus{}ccselect\PYGZus{}vtable} \PYG{n}{vt}\PYG{p}{;} - - \PYG{k}{if} \PYG{p}{(}\PYG{n}{maj\PYGZus{}ver} \PYG{o}{==} \PYG{l+m+mi}{1}\PYG{p}{)} \PYG{p}{\PYGZob{}} - \PYG{n}{krb5\PYGZus{}fences\PYGZus{}vtable} \PYG{n}{vt} \PYG{o}{=} \PYG{p}{(}\PYG{n}{krb5\PYGZus{}fences\PYGZus{}vtable}\PYG{p}{)}\PYG{n}{vtable}\PYG{p}{;} - \PYG{n}{vt}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{name} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{wicker}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} - \PYG{n}{vt}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{slats} \PYG{o}{=} \PYG{n}{wicker\PYGZus{}slats}\PYG{p}{;} - \PYG{n}{vt}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{braces} \PYG{o}{=} \PYG{n}{wicker\PYGZus{}braces}\PYG{p}{;} - \PYG{p}{\PYGZcb{}} \PYG{k}{else} \PYG{k}{if} \PYG{p}{(}\PYG{n}{maj\PYGZus{}ver} \PYG{o}{==} \PYG{l+m+mi}{2}\PYG{p}{)} \PYG{p}{\PYGZob{}} - \PYG{n}{krb5\PYGZus{}fences\PYGZus{}vtable\PYGZus{}v2} \PYG{n}{vt} \PYG{o}{=} \PYG{p}{(}\PYG{n}{krb5\PYGZus{}fences\PYGZus{}vtable\PYGZus{}v2}\PYG{p}{)}\PYG{n}{vtable}\PYG{p}{;} - \PYG{n}{vt}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{name} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{wicker}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} - \PYG{n}{vt}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{material} \PYG{o}{=} \PYG{n}{wicker\PYGZus{}material}\PYG{p}{;} - \PYG{n}{vt}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{construction} \PYG{o}{=} \PYG{n}{wicker\PYGZus{}construction}\PYG{p}{;} - \PYG{k}{if} \PYG{p}{(}\PYG{n}{min\PYGZus{}ver} \PYG{o}{\PYGZlt{}} \PYG{l+m+mi}{2}\PYG{p}{)} - \PYG{k}{return} \PYG{l+m+mi}{0}\PYG{p}{;} - \PYG{n}{vt}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{footing} \PYG{o}{=} \PYG{n}{wicker\PYGZus{}footing}\PYG{p}{;} - \PYG{k}{if} \PYG{p}{(}\PYG{n}{min\PYGZus{}ver} \PYG{o}{\PYGZlt{}} \PYG{l+m+mi}{3}\PYG{p}{)} - \PYG{k}{return} \PYG{l+m+mi}{0}\PYG{p}{;} - \PYG{n}{vt}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{appearance} \PYG{o}{=} \PYG{n}{wicker\PYGZus{}appearance}\PYG{p}{;} - \PYG{p}{\PYGZcb{}} \PYG{k}{else} \PYG{p}{\PYGZob{}} - \PYG{k}{return} \PYG{n}{KRB5\PYGZus{}PLUGIN\PYGZus{}VER\PYGZus{}NOTSUPP}\PYG{p}{;} - \PYG{p}{\PYGZcb{}} - \PYG{k}{return} \PYG{l+m+mi}{0}\PYG{p}{;} -\PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - - -\subsection{Logging from KDC and kadmind plugin modules} -\label{\detokenize{plugindev/general:logging-from-kdc-and-kadmind-plugin-modules}} -\sphinxAtStartPar -Plugin modules for the KDC or kadmind daemons can write to the -configured logging outputs (see \DUrole{xref,std,std-ref}{logging}) by calling the -\sphinxstylestrong{com\_err} function. The first argument (\sphinxstyleemphasis{whoami}) is ignored. If -the second argument (\sphinxstyleemphasis{code}) is zero, the formatted message is logged -at informational severity; otherwise, the formatted message is logged -at error severity and includes the error message for the supplied -code. Here are examples: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{com\PYGZus{}err}\PYG{p}{(}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{,} \PYG{l+m+mi}{0}\PYG{p}{,} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{Client message contains }\PYG{l+s+si}{\PYGZpc{}d}\PYG{l+s+s2}{ items}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{,} \PYG{n}{nitems}\PYG{p}{)}\PYG{p}{;} -\PYG{n}{com\PYGZus{}err}\PYG{p}{(}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{,} \PYG{n}{retval}\PYG{p}{,} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{while decoding client message}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -(The behavior described above is new in release 1.17. In prior -releases, the \sphinxstyleemphasis{whoami} argument is included for some logging output -types, the logged message does not include the usual header for some -output types, and the severity for syslog outputs is configured as -part of the logging specification, defaulting to error severity.) - -\sphinxstepscope - - -\section{Client preauthentication interface (clpreauth)} -\label{\detokenize{plugindev/clpreauth:client-preauthentication-interface-clpreauth}}\label{\detokenize{plugindev/clpreauth::doc}} -\sphinxAtStartPar -During an initial ticket request, a KDC may ask a client to prove its -knowledge of the password before issuing an encrypted ticket, or to -use credentials other than a password. This process is called -preauthentication, and is described in \index{RFC@\spxentry{RFC}!RFC 4120@\spxentry{RFC 4120}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc4120.html}{\sphinxstylestrong{RFC 4120}} and \index{RFC@\spxentry{RFC}!RFC 6113@\spxentry{RFC 6113}}\sphinxhref{https://datatracker.ietf.org/doc/html/rfc6113.html}{\sphinxstylestrong{RFC 6113}}. -The clpreauth interface allows the addition of client support for -preauthentication mechanisms beyond those included in the core MIT -krb5 code base. For a detailed description of the clpreauth -interface, see the header file \sphinxcode{\sphinxupquote{\textless{}krb5/clpreauth\_plugin.h\textgreater{}}} (or -\sphinxcode{\sphinxupquote{\textless{}krb5/preauth\_plugin.h\textgreater{}}} before release 1.12). - -\sphinxAtStartPar -A clpreauth module is generally responsible for: -\begin{itemize} -\item {} -\sphinxAtStartPar -Supplying a list of preauth type numbers used by the module in the -\sphinxstylestrong{pa\_type\_list} field of the vtable structure. - -\item {} -\sphinxAtStartPar -Indicating what kind of preauthentication mechanism it implements, -with the \sphinxstylestrong{flags} method. In the most common case, this method -just returns \sphinxcode{\sphinxupquote{PA\_REAL}}, indicating that it implements a normal -preauthentication type. - -\item {} -\sphinxAtStartPar -Examining the padata information included in a PREAUTH\_REQUIRED or -MORE\_PREAUTH\_DATA\_REQUIRED error and producing padata values for the -next AS request. This is done with the \sphinxstylestrong{process} method. - -\item {} -\sphinxAtStartPar -Examining the padata information included in a successful ticket -reply, possibly verifying the KDC identity and computing a reply -key. This is also done with the \sphinxstylestrong{process} method. - -\item {} -\sphinxAtStartPar -For preauthentication types which support it, recovering from errors -by examining the error data from the KDC and producing a padata -value for another AS request. This is done with the \sphinxstylestrong{tryagain} -method. - -\item {} -\sphinxAtStartPar -Receiving option information (supplied by \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}X}} or by an -application), with the \sphinxstylestrong{gic\_opts} method. - -\end{itemize} - -\sphinxAtStartPar -A clpreauth module can create and destroy per\sphinxhyphen{}library\sphinxhyphen{}context and -per\sphinxhyphen{}request state objects by implementing the \sphinxstylestrong{init}, \sphinxstylestrong{fini}, -\sphinxstylestrong{request\_init}, and \sphinxstylestrong{request\_fini} methods. Per\sphinxhyphen{}context state -objects have the type krb5\_clpreauth\_moddata, and per\sphinxhyphen{}request state -objects have the type krb5\_clpreauth\_modreq. These are abstract -pointer types; a module should typically cast these to internal -types for the state objects. - -\sphinxAtStartPar -The \sphinxstylestrong{process} and \sphinxstylestrong{tryagain} methods have access to a callback -function and handle (called a “rock”) which can be used to get -additional information about the current request, including the -expected enctype of the AS reply, the FAST armor key, and the client -long\sphinxhyphen{}term key (prompting for the user password if necessary). A -callback can also be used to replace the AS reply key if the -preauthentication mechanism computes one. - -\sphinxstepscope - - -\section{KDC preauthentication interface (kdcpreauth)} -\label{\detokenize{plugindev/kdcpreauth:kdc-preauthentication-interface-kdcpreauth}}\label{\detokenize{plugindev/kdcpreauth::doc}} -\sphinxAtStartPar -The kdcpreauth interface allows the addition of KDC support for -preauthentication mechanisms beyond those included in the core MIT -krb5 code base. For a detailed description of the kdcpreauth -interface, see the header file \sphinxcode{\sphinxupquote{\textless{}krb5/kdcpreauth\_plugin.h\textgreater{}}} (or -\sphinxcode{\sphinxupquote{\textless{}krb5/preauth\_plugin.h\textgreater{}}} before release 1.12). - -\sphinxAtStartPar -A kdcpreauth module is generally responsible for: -\begin{itemize} -\item {} -\sphinxAtStartPar -Supplying a list of preauth type numbers used by the module in the -\sphinxstylestrong{pa\_type\_list} field of the vtable structure. - -\item {} -\sphinxAtStartPar -Indicating what kind of preauthentication mechanism it implements, -with the \sphinxstylestrong{flags} method. If the mechanism computes a new reply -key, it must specify the \sphinxcode{\sphinxupquote{PA\_REPLACES\_KEY}} flag. If the mechanism -is generally only used with hardware tokens, the \sphinxcode{\sphinxupquote{PA\_HARDWARE}} -flag allows the mechanism to work with principals which have the -\sphinxstylestrong{requires\_hwauth} flag set. - -\item {} -\sphinxAtStartPar -Producing a padata value to be sent with a preauth\_required error, -with the \sphinxstylestrong{edata} method. - -\item {} -\sphinxAtStartPar -Examining a padata value sent by a client and verifying that it -proves knowledge of the appropriate client credential information. -This is done with the \sphinxstylestrong{verify} method. - -\item {} -\sphinxAtStartPar -Producing a padata response value for the client, and possibly -computing a reply key. This is done with the \sphinxstylestrong{return\_padata} -method. - -\end{itemize} - -\sphinxAtStartPar -A module can create and destroy per\sphinxhyphen{}KDC state objects by implementing -the \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. Per\sphinxhyphen{}KDC state objects have the -type krb5\_kdcpreauth\_moddata, which is an abstract pointer types. A -module should typically cast this to an internal type for the state -object. - -\sphinxAtStartPar -A module can create a per\sphinxhyphen{}request state object by returning one in the -\sphinxstylestrong{verify} method, receiving it in the \sphinxstylestrong{return\_padata} method, and -destroying it in the \sphinxstylestrong{free\_modreq} method. Note that these state -objects only apply to the processing of a single AS request packet, -not to an entire authentication exchange (since an authentication -exchange may remain unfinished by the client or may involve multiple -different KDC hosts). Per\sphinxhyphen{}request state objects have the type -krb5\_kdcpreauth\_modreq, which is an abstract pointer type. - -\sphinxAtStartPar -The \sphinxstylestrong{edata}, \sphinxstylestrong{verify}, and \sphinxstylestrong{return\_padata} methods have access -to a callback function and handle (called a “rock”) which can be used -to get additional information about the current request, including the -maximum allowable clock skew, the client’s long\sphinxhyphen{}term keys, the -DER\sphinxhyphen{}encoded request body, the FAST armor key, string attributes on the -client’s database entry, and the client’s database entry itself. The -\sphinxstylestrong{verify} method can assert one or more authentication indicators to -be included in the issued ticket using the \sphinxcode{\sphinxupquote{add\_auth\_indicator}} -callback (new in release 1.14). - -\sphinxAtStartPar -A module can generate state information to be included with the next -client request using the \sphinxcode{\sphinxupquote{set\_cookie}} callback (new in release -1.14). On the next request, the module can read this state -information using the \sphinxcode{\sphinxupquote{get\_cookie}} callback. Cookie information is -encrypted, timestamped, and transmitted to the client in a -\sphinxcode{\sphinxupquote{PA\sphinxhyphen{}FX\sphinxhyphen{}COOKIE}} pa\sphinxhyphen{}data item. Older clients may not support cookies -and therefore may not transmit the cookie in the next request; in this -case, \sphinxcode{\sphinxupquote{get\_cookie}} will not yield the saved information. - -\sphinxAtStartPar -If a module implements a mechanism which requires multiple round -trips, its \sphinxstylestrong{verify} method can respond with the code -\sphinxcode{\sphinxupquote{KRB5KDC\_ERR\_MORE\_PREAUTH\_DATA\_REQUIRED}} and a list of pa\sphinxhyphen{}data in -the \sphinxstyleemphasis{e\_data} parameter to be processed by the client. - -\sphinxAtStartPar -The \sphinxstylestrong{edata} and \sphinxstylestrong{verify} methods can be implemented -asynchronously. Because of this, they do not return values directly -to the caller, but must instead invoke responder functions with their -results. A synchronous implementation can invoke the responder -function immediately. An asynchronous implementation can use the -callback to get an event context for use with the \sphinxhref{https://fedorahosted.org/libverto/}{libverto} API. - -\sphinxstepscope - - -\section{Credential cache selection interface (ccselect)} -\label{\detokenize{plugindev/ccselect:credential-cache-selection-interface-ccselect}}\label{\detokenize{plugindev/ccselect:ccselect-plugin}}\label{\detokenize{plugindev/ccselect::doc}} -\sphinxAtStartPar -The ccselect interface allows modules to control how credential caches -are chosen when a GSSAPI client contacts a service. For a detailed -description of the ccselect interface, see the header file -\sphinxcode{\sphinxupquote{\textless{}krb5/ccselect\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -The primary ccselect method is \sphinxstylestrong{choose}, which accepts a server -principal as input and returns a ccache and/or principal name as -output. A module can use the krb5\_cccol APIs to iterate over the -cache collection in order to find an appropriate ccache to use. - -\sphinxAtStartPar -A module can create and destroy per\sphinxhyphen{}library\sphinxhyphen{}context state objects by -implementing the \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. State objects have -the type krb5\_ccselect\_moddata, which is an abstract pointer type. A -module should typically cast this to an internal type for the state -object. - -\sphinxAtStartPar -A module can have one of two priorities, “authoritative” or -“heuristic”. Results from authoritative modules, if any are -available, will take priority over results from heuristic modules. A -module communicates its priority as a result of the \sphinxstylestrong{init} method. - -\sphinxstepscope - - -\section{Password quality interface (pwqual)} -\label{\detokenize{plugindev/pwqual:password-quality-interface-pwqual}}\label{\detokenize{plugindev/pwqual:pwqual-plugin}}\label{\detokenize{plugindev/pwqual::doc}} -\sphinxAtStartPar -The pwqual interface allows modules to control what passwords are -allowed when a user changes passwords. For a detailed description of -the pwqual interface, see the header file \sphinxcode{\sphinxupquote{\textless{}krb5/pwqual\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -The primary pwqual method is \sphinxstylestrong{check}, which receives a password as -input and returns success (0) or a \sphinxcode{\sphinxupquote{KADM5\_PASS\_Q\_}} failure code -depending on whether the password is allowed. The \sphinxstylestrong{check} method -also receives the principal name and the name of the principal’s -password policy as input; although there is no stable interface for -the module to obtain the fields of the password policy, it can define -its own configuration or data store based on the policy name. - -\sphinxAtStartPar -A module can create and destroy per\sphinxhyphen{}process state objects by -implementing the \sphinxstylestrong{open} and \sphinxstylestrong{close} methods. State objects have -the type krb5\_pwqual\_moddata, which is an abstract pointer type. A -module should typically cast this to an internal type for the state -object. The \sphinxstylestrong{open} method also receives the name of the realm’s -dictionary file (as configured by the \sphinxstylestrong{dict\_file} variable in the -\DUrole{xref,std,std-ref}{kdc\_realms} section of \DUrole{xref,std,std-ref}{kdc.conf(5)}) if it wishes to use -it. - -\sphinxstepscope - - -\section{KADM5 hook interface (kadm5\_hook)} -\label{\detokenize{plugindev/kadm5_hook:kadm5-hook-interface-kadm5-hook}}\label{\detokenize{plugindev/kadm5_hook:kadm5-hook-plugin}}\label{\detokenize{plugindev/kadm5_hook::doc}} -\sphinxAtStartPar -The kadm5\_hook interface allows modules to perform actions when -changes are made to the Kerberos database through \DUrole{xref,std,std-ref}{kadmin(1)}. -For a detailed description of the kadm5\_hook interface, see the header -file \sphinxcode{\sphinxupquote{\textless{}krb5/kadm5\_hook\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -The kadm5\_hook interface has five primary methods: \sphinxstylestrong{chpass}, -\sphinxstylestrong{create}, \sphinxstylestrong{modify}, \sphinxstylestrong{remove}, and \sphinxstylestrong{rename}. (The \sphinxstylestrong{rename} -method was introduced in release 1.14.) Each of these methods is -called twice when the corresponding administrative action takes place, -once before the action is committed and once afterwards. A module can -prevent the action from taking place by returning an error code during -the pre\sphinxhyphen{}commit stage. - -\sphinxAtStartPar -A module can create and destroy per\sphinxhyphen{}process state objects by -implementing the \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. State objects have -the type kadm5\_hook\_modinfo, which is an abstract pointer type. A -module should typically cast this to an internal type for the state -object. - -\sphinxAtStartPar -Because the kadm5\_hook interface is tied closely to the kadmin -interface (which is explicitly unstable), it may not remain as stable -across versions as other public pluggable interfaces. - -\sphinxstepscope - - -\section{kadmin authorization interface (kadm5\_auth)} -\label{\detokenize{plugindev/kadm5_auth:kadmin-authorization-interface-kadm5-auth}}\label{\detokenize{plugindev/kadm5_auth:kadm5-auth-plugin}}\label{\detokenize{plugindev/kadm5_auth::doc}} -\sphinxAtStartPar -The kadm5\_auth interface (new in release 1.16) allows modules to -determine whether a client principal is authorized to perform an -operation in the kadmin protocol, and to apply restrictions to -principal operations. For a detailed description of the kadm5\_auth -interface, see the header file \sphinxcode{\sphinxupquote{\textless{}krb5/kadm5\_auth\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -A module can create and destroy per\sphinxhyphen{}process state objects by -implementing the \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. State objects have -the type kadm5\_auth\_modinfo, which is an abstract pointer type. A -module should typically cast this to an internal type for the state -object. - -\sphinxAtStartPar -The kadm5\_auth interface has one method for each kadmin operation, -with parameters specific to the operation. Each method can return -either 0 to authorize access, KRB5\_PLUGIN\_NO\_HANDLE to defer the -decision to other modules, or another error (canonically EPERM) to -authoritatively deny access. Access is granted if at least one module -grants access and no module authoritatively denies access. - -\sphinxAtStartPar -The \sphinxstylestrong{addprinc} and \sphinxstylestrong{modprinc} methods can also impose restrictions -on the principal operation by returning a \sphinxcode{\sphinxupquote{struct -kadm5\_auth\_restrictions}} object. The module should also implement -the \sphinxstylestrong{free\_restrictions} method if it dynamically allocates -restrictions objects for principal operations. - -\sphinxAtStartPar -kadm5\_auth modules can optionally inspect principal or policy objects. -To do this, the module must also include \sphinxcode{\sphinxupquote{\textless{}kadm5/admin.h\textgreater{}}} to gain -access to the structure definitions for those objects. As the kadmin -interface is explicitly not as stable as other public interfaces, -modules which do this may not retain compatibility across releases. - -\sphinxstepscope - - -\section{Host\sphinxhyphen{}to\sphinxhyphen{}realm interface (hostrealm)} -\label{\detokenize{plugindev/hostrealm:host-to-realm-interface-hostrealm}}\label{\detokenize{plugindev/hostrealm:hostrealm-plugin}}\label{\detokenize{plugindev/hostrealm::doc}} -\sphinxAtStartPar -The host\sphinxhyphen{}to\sphinxhyphen{}realm interface was first introduced in release 1.12. It -allows modules to control the local mapping of hostnames to realm -names as well as the default realm. For a detailed description of the -hostrealm interface, see the header file -\sphinxcode{\sphinxupquote{\textless{}krb5/hostrealm\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -Although the mapping methods in the hostrealm interface return a list -of one or more realms, only the first realm in the list is currently -used by callers. Callers may begin using later responses in the -future. - -\sphinxAtStartPar -Any mapping method may return KRB5\_PLUGIN\_NO\_HANDLE to defer -processing to a later module. - -\sphinxAtStartPar -A module can create and destroy per\sphinxhyphen{}library\sphinxhyphen{}context state objects -using the \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. If the module does not need -any state, it does not need to implement these methods. - -\sphinxAtStartPar -The optional \sphinxstylestrong{host\_realm} method allows a module to determine -authoritative realm mappings for a hostname. The first authoritative -mapping is used in preference to KDC referrals when getting service -credentials. - -\sphinxAtStartPar -The optional \sphinxstylestrong{fallback\_realm} method allows a module to determine -fallback mappings for a hostname. The first fallback mapping is tried -if there is no authoritative mapping for a realm, and KDC referrals -failed to produce a successful result. - -\sphinxAtStartPar -The optional \sphinxstylestrong{default\_realm} method allows a module to determine the -local default realm. - -\sphinxAtStartPar -If a module implements any of the above methods, it must also -implement \sphinxstylestrong{free\_list} to ensure that memory is allocated and -deallocated consistently. - -\sphinxstepscope - - -\section{Local authorization interface (localauth)} -\label{\detokenize{plugindev/localauth:local-authorization-interface-localauth}}\label{\detokenize{plugindev/localauth:localauth-plugin}}\label{\detokenize{plugindev/localauth::doc}} -\sphinxAtStartPar -The localauth interface was first introduced in release 1.12. It -allows modules to control the relationship between Kerberos principals -and local system accounts. When an application calls -\sphinxcode{\sphinxupquote{krb5\_kuserok()}} or \sphinxcode{\sphinxupquote{krb5\_aname\_to\_localname()}}, localauth -modules are consulted to determine the result. For a detailed -description of the localauth interface, see the header file -\sphinxcode{\sphinxupquote{\textless{}krb5/localauth\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -A module can create and destroy per\sphinxhyphen{}library\sphinxhyphen{}context state objects -using the \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. If the module does not need -any state, it does not need to implement these methods. - -\sphinxAtStartPar -The optional \sphinxstylestrong{userok} method allows a module to control the behavior -of \sphinxcode{\sphinxupquote{krb5\_kuserok()}}. The module receives the authenticated name -and the local account name as inputs, and can return either 0 to -authorize access, KRB5\_PLUGIN\_NO\_HANDLE to defer the decision to other -modules, or another error (canonically EPERM) to authoritatively deny -access. Access is granted if at least one module grants access and no -module authoritatively denies access. - -\sphinxAtStartPar -The optional \sphinxstylestrong{an2ln} method can work in two different ways. If the -module sets an array of uppercase type names in \sphinxstylestrong{an2ln\_types}, then -the module’s \sphinxstylestrong{an2ln} method will only be invoked by -\sphinxcode{\sphinxupquote{krb5\_aname\_to\_localname()}} if an \sphinxstylestrong{auth\_to\_local} value in -\DUrole{xref,std,std-ref}{krb5.conf(5)} refers to one of the module’s types. In this -case, the \sphinxstyleemphasis{type} and \sphinxstyleemphasis{residual} arguments will give the type name and -residual string of the \sphinxstylestrong{auth\_to\_local} value. - -\sphinxAtStartPar -If the module does not set \sphinxstylestrong{an2ln\_types} but does implement -\sphinxstylestrong{an2ln}, the module’s \sphinxstylestrong{an2ln} method will be invoked for all -\sphinxcode{\sphinxupquote{krb5\_aname\_to\_localname()}} operations unless an earlier module -determines a mapping, with \sphinxstyleemphasis{type} and \sphinxstyleemphasis{residual} set to NULL. The -module can return KRB5\_LNAME\_NO\_TRANS to defer mapping to later -modules. - -\sphinxAtStartPar -If a module implements \sphinxstylestrong{an2ln}, it must also implement -\sphinxstylestrong{free\_string} to ensure that memory is allocated and deallocated -consistently. - -\sphinxstepscope - - -\section{Server location interface (locate)} -\label{\detokenize{plugindev/locate:server-location-interface-locate}}\label{\detokenize{plugindev/locate::doc}} -\sphinxAtStartPar -The locate interface allows modules to control how KDCs and similar -services are located by clients. For a detailed description of the -ccselect interface, see the header file \sphinxcode{\sphinxupquote{\textless{}krb5/locate\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -A locate module exports a structure object of type -krb5plugin\_service\_locate\_ftable, with the name \sphinxcode{\sphinxupquote{service\_locator}}. -The structure contains a minor version and pointers to the module’s -methods. - -\sphinxAtStartPar -The primary locate method is \sphinxstylestrong{lookup}, which accepts a service type, -realm name, desired socket type, and desired address family (which -will be AF\_UNSPEC if no specific address family is desired). The -method should invoke the callback function once for each server -address it wants to return, passing a socket type (SOCK\_STREAM for TCP -or SOCK\_DGRAM for UDP) and socket address. The \sphinxstylestrong{lookup} method -should return 0 if it has authoritatively determined the server -addresses for the realm, KRB5\_PLUGIN\_NO\_HANDLE if it wants to let -other location mechanisms determine the server addresses, or another -code if it experienced a failure which should abort the location -process. - -\sphinxAtStartPar -A module can create and destroy per\sphinxhyphen{}library\sphinxhyphen{}context state objects by -implementing the \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. State objects have -the type void *, and should be cast to an internal type for the state -object. - -\sphinxstepscope - - -\section{Configuration interface (profile)} -\label{\detokenize{plugindev/profile:configuration-interface-profile}}\label{\detokenize{plugindev/profile:profile-plugin}}\label{\detokenize{plugindev/profile::doc}} -\sphinxAtStartPar -The profile interface allows a module to control how krb5 -configuration information is obtained by the Kerberos library and -applications. For a detailed description of the profile interface, -see the header file \sphinxcode{\sphinxupquote{\textless{}profile.h\textgreater{}}}. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -The profile interface does not follow the normal conventions -for MIT krb5 pluggable interfaces, because it is part of a -lower\sphinxhyphen{}level component of the krb5 library. -\end{sphinxadmonition} - -\sphinxAtStartPar -As with other types of plugin modules, a profile module is a Unix -shared object or Windows DLL, built separately from the krb5 tree. -The krb5 library will dynamically load and use a profile plugin module -if it reads a \sphinxcode{\sphinxupquote{module}} directive at the beginning of krb5.conf, as -described in \DUrole{xref,std,std-ref}{profile\_plugin\_config}. - -\sphinxAtStartPar -A profile module exports a function named \sphinxcode{\sphinxupquote{profile\_module\_init}} -matching the signature of the profile\_module\_init\_fn type. This -function accepts a residual string, which may be used to help locate -the configuration source. The function fills in a vtable and may also -create a per\sphinxhyphen{}profile state object. If the module uses state objects, -it should implement the \sphinxstylestrong{copy} and \sphinxstylestrong{cleanup} methods to manage -them. - -\sphinxAtStartPar -A basic read\sphinxhyphen{}only profile module need only implement the -\sphinxstylestrong{get\_values} and \sphinxstylestrong{free\_values} methods. The \sphinxstylestrong{get\_values} method -accepts a null\sphinxhyphen{}terminated list of C string names (e.g., an array -containing “libdefaults”, “clockskew”, and NULL for the \sphinxstylestrong{clockskew} -variable in the \DUrole{xref,std,std-ref}{libdefaults} section) and returns a -null\sphinxhyphen{}terminated list of values, which will be cleaned up with the -\sphinxstylestrong{free\_values} method when the caller is done with them. - -\sphinxAtStartPar -Iterable profile modules must also define the \sphinxstylestrong{iterator\_create}, -\sphinxstylestrong{iterator}, \sphinxstylestrong{iterator\_free}, and \sphinxstylestrong{free\_string} methods. The -core krb5 code does not require profiles to be iterable, but some -applications may iterate over the krb5 profile object in order to -present configuration interfaces. - -\sphinxAtStartPar -Writable profile modules must also define the \sphinxstylestrong{writable}, -\sphinxstylestrong{modified}, \sphinxstylestrong{update\_relation}, \sphinxstylestrong{rename\_section}, -\sphinxstylestrong{add\_relation}, and \sphinxstylestrong{flush} methods. The core krb5 code does not -require profiles to be writable, but some applications may write to -the krb5 profile in order to present configuration interfaces. - -\sphinxAtStartPar -The following is an example of a very basic read\sphinxhyphen{}only profile module -which returns a hardcoded value for the \sphinxstylestrong{default\_realm} variable in -\DUrole{xref,std,std-ref}{libdefaults}, and provides no other configuration information. -(For conciseness, the example omits code for checking the return -values of malloc and strdup.) - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{c+c1}{\PYGZsh{}include \PYGZlt{}stdlib.h\PYGZgt{}} -\PYG{c+c1}{\PYGZsh{}include \PYGZlt{}string.h\PYGZgt{}} -\PYG{c+c1}{\PYGZsh{}include \PYGZlt{}profile.h\PYGZgt{}} - -\PYG{n}{static} \PYG{n}{long} -\PYG{n}{get\PYGZus{}values}\PYG{p}{(}\PYG{n}{void} \PYG{o}{*}\PYG{n}{cbdata}\PYG{p}{,} \PYG{n}{const} \PYG{n}{char} \PYG{o}{*}\PYG{n}{const} \PYG{o}{*}\PYG{n}{names}\PYG{p}{,} \PYG{n}{char} \PYG{o}{*}\PYG{o}{*}\PYG{o}{*}\PYG{n}{values}\PYG{p}{)} -\PYG{p}{\PYGZob{}} - \PYG{k}{if} \PYG{p}{(}\PYG{n}{names}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]} \PYG{o}{!=} \PYG{n}{NULL} \PYG{o}{\PYGZam{}}\PYG{o}{\PYGZam{}} \PYG{n}{strcmp}\PYG{p}{(}\PYG{n}{names}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]}\PYG{p}{,} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{libdefaults}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{)} \PYG{o}{==} \PYG{l+m+mi}{0} \PYG{o}{\PYGZam{}}\PYG{o}{\PYGZam{}} - \PYG{n}{names}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]} \PYG{o}{!=} \PYG{n}{NULL} \PYG{o}{\PYGZam{}}\PYG{o}{\PYGZam{}} \PYG{n}{strcmp}\PYG{p}{(}\PYG{n}{names}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]}\PYG{p}{,} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{default\PYGZus{}realm}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{)} \PYG{o}{==} \PYG{l+m+mi}{0}\PYG{p}{)} \PYG{p}{\PYGZob{}} - \PYG{o}{*}\PYG{n}{values} \PYG{o}{=} \PYG{n}{malloc}\PYG{p}{(}\PYG{l+m+mi}{2} \PYG{o}{*} \PYG{n}{sizeof}\PYG{p}{(}\PYG{n}{char} \PYG{o}{*}\PYG{p}{)}\PYG{p}{)}\PYG{p}{;} - \PYG{p}{(}\PYG{o}{*}\PYG{n}{values}\PYG{p}{)}\PYG{p}{[}\PYG{l+m+mi}{0}\PYG{p}{]} \PYG{o}{=} \PYG{n}{strdup}\PYG{p}{(}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{)}\PYG{p}{;} - \PYG{p}{(}\PYG{o}{*}\PYG{n}{values}\PYG{p}{)}\PYG{p}{[}\PYG{l+m+mi}{1}\PYG{p}{]} \PYG{o}{=} \PYG{n}{NULL}\PYG{p}{;} - \PYG{k}{return} \PYG{l+m+mi}{0}\PYG{p}{;} - \PYG{p}{\PYGZcb{}} - \PYG{k}{return} \PYG{n}{PROF\PYGZus{}NO\PYGZus{}RELATION}\PYG{p}{;} -\PYG{p}{\PYGZcb{}} - -\PYG{n}{static} \PYG{n}{void} -\PYG{n}{free\PYGZus{}values}\PYG{p}{(}\PYG{n}{void} \PYG{o}{*}\PYG{n}{cbdata}\PYG{p}{,} \PYG{n}{char} \PYG{o}{*}\PYG{o}{*}\PYG{n}{values}\PYG{p}{)} -\PYG{p}{\PYGZob{}} - \PYG{n}{char} \PYG{o}{*}\PYG{o}{*}\PYG{n}{v}\PYG{p}{;} - - \PYG{k}{for} \PYG{p}{(}\PYG{n}{v} \PYG{o}{=} \PYG{n}{values}\PYG{p}{;} \PYG{o}{*}\PYG{n}{v}\PYG{p}{;} \PYG{n}{v}\PYG{o}{+}\PYG{o}{+}\PYG{p}{)} - \PYG{n}{free}\PYG{p}{(}\PYG{o}{*}\PYG{n}{v}\PYG{p}{)}\PYG{p}{;} - \PYG{n}{free}\PYG{p}{(}\PYG{n}{values}\PYG{p}{)}\PYG{p}{;} -\PYG{p}{\PYGZcb{}} - -\PYG{n}{long} -\PYG{n}{profile\PYGZus{}module\PYGZus{}init}\PYG{p}{(}\PYG{n}{const} \PYG{n}{char} \PYG{o}{*}\PYG{n}{residual}\PYG{p}{,} \PYG{n}{struct} \PYG{n}{profile\PYGZus{}vtable} \PYG{o}{*}\PYG{n}{vtable}\PYG{p}{,} - \PYG{n}{void} \PYG{o}{*}\PYG{o}{*}\PYG{n}{cb\PYGZus{}ret}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{long} -\PYG{n}{profile\PYGZus{}module\PYGZus{}init}\PYG{p}{(}\PYG{n}{const} \PYG{n}{char} \PYG{o}{*}\PYG{n}{residual}\PYG{p}{,} \PYG{n}{struct} \PYG{n}{profile\PYGZus{}vtable} \PYG{o}{*}\PYG{n}{vtable}\PYG{p}{,} - \PYG{n}{void} \PYG{o}{*}\PYG{o}{*}\PYG{n}{cb\PYGZus{}ret}\PYG{p}{)} -\PYG{p}{\PYGZob{}} - \PYG{o}{*}\PYG{n}{cb\PYGZus{}ret} \PYG{o}{=} \PYG{n}{NULL}\PYG{p}{;} - \PYG{n}{vtable}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{get\PYGZus{}values} \PYG{o}{=} \PYG{n}{get\PYGZus{}values}\PYG{p}{;} - \PYG{n}{vtable}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}}\PYG{n}{free\PYGZus{}values} \PYG{o}{=} \PYG{n}{free\PYGZus{}values}\PYG{p}{;} - \PYG{k}{return} \PYG{l+m+mi}{0}\PYG{p}{;} -\PYG{p}{\PYGZcb{}} -\end{sphinxVerbatim} - -\sphinxstepscope - - -\section{GSSAPI mechanism interface} -\label{\detokenize{plugindev/gssapi:gssapi-mechanism-interface}}\label{\detokenize{plugindev/gssapi::doc}} -\sphinxAtStartPar -The GSSAPI library in MIT krb5 can load mechanism modules to augment -the set of built\sphinxhyphen{}in mechanisms. - -\sphinxAtStartPar -A mechanism module is a Unix shared object or Windows DLL, built -separately from the krb5 tree. Modules are loaded according to the -GSS mechanism config files described in \DUrole{xref,std,std-ref}{gssapi\_plugin\_config}. - -\sphinxAtStartPar -For the most part, a GSSAPI mechanism module exports the same -functions as would a GSSAPI implementation itself, with the same -function signatures. The mechanism selection layer within the GSSAPI -library (called the “mechglue”) will dispatch calls from the -application to the module if the module’s mechanism is requested. If -a module does not wish to implement a GSSAPI extension, it can simply -refrain from exporting it, and the mechglue will fail gracefully if -the application calls that function. - -\sphinxAtStartPar -The mechglue does not invoke a module’s \sphinxstylestrong{gss\_add\_cred}, -\sphinxstylestrong{gss\_add\_cred\_from}, \sphinxstylestrong{gss\_add\_cred\_impersonate\_name}, or -\sphinxstylestrong{gss\_add\_cred\_with\_password} function. A mechanism only needs to -implement the “acquire” variants of those functions. - -\sphinxAtStartPar -A module does not need to coordinate its minor status codes with those -of other mechanisms. If the mechglue detects conflicts, it will map -the mechanism’s status codes onto unique values, and then map them -back again when \sphinxstylestrong{gss\_display\_status} is called. - - -\subsection{NegoEx modules} -\label{\detokenize{plugindev/gssapi:negoex-modules}} -\sphinxAtStartPar -Some Windows GSSAPI mechanisms can only be negotiated via a Microsoft -extension to SPNEGO called NegoEx. Beginning with release 1.18, -mechanism modules can support NegoEx as follows: -\begin{itemize} -\item {} -\sphinxAtStartPar -Implement the gssspi\_query\_meta\_data(), gssspi\_exchange\_meta\_data(), -and gssspi\_query\_mechanism\_info() SPIs declared in -\sphinxcode{\sphinxupquote{\textless{}gssapi/gssapi\_ext.h\textgreater{}}}. - -\item {} -\sphinxAtStartPar -Implement gss\_inquire\_sec\_context\_by\_oid() and answer the -\sphinxstylestrong{GSS\_C\_INQ\_NEGOEX\_KEY} and \sphinxstylestrong{GSS\_C\_INQ\_NEGOEX\_VERIFY\_KEY} OIDs -to provide the checksum keys for outgoing and incoming checksums, -respectively. The answer must be in two buffers: the first buffer -contains the key contents, and the second buffer contains the key -encryption type as a four\sphinxhyphen{}byte little\sphinxhyphen{}endian integer. - -\end{itemize} - -\sphinxAtStartPar -By default, NegoEx mechanisms will not be directly negotiated via -SPNEGO. If direct SPNEGO negotiation is required for -interoperability, implement gss\_inquire\_attrs\_for\_mech() and assert -the GSS\_C\_MA\_NEGOEX\_AND\_SPNEGO attribute (along with any applicable -RFC 5587 attributes). - - -\subsection{Interposer modules} -\label{\detokenize{plugindev/gssapi:interposer-modules}} -\sphinxAtStartPar -The mechglue also supports a kind of loadable module, called an -interposer module, which intercepts calls to existing mechanisms -rather than implementing a new mechanism. - -\sphinxAtStartPar -An interposer module must export the symbol \sphinxstylestrong{gss\_mech\_interposer} -with the following signature: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{gss\PYGZus{}OID\PYGZus{}set} \PYG{n}{gss\PYGZus{}mech\PYGZus{}interposer}\PYG{p}{(}\PYG{n}{gss\PYGZus{}OID} \PYG{n}{mech\PYGZus{}type}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This function is invoked with the OID of the interposer mechanism as -specified in the mechanism config file, and returns a set of mechanism -OIDs to be interposed. The returned OID set must have been created -using the mechglue’s gss\_create\_empty\_oid\_set and -gss\_add\_oid\_set\_member functions. - -\sphinxAtStartPar -An interposer module must use the prefix \sphinxcode{\sphinxupquote{gssi\_}} for the GSSAPI -functions it exports, instead of the prefix \sphinxcode{\sphinxupquote{gss\_}}. In most cases, -unexported \sphinxcode{\sphinxupquote{gssi\_}} functions will result in failure from their -corresponding \sphinxcode{\sphinxupquote{gss\_}} calls. - -\sphinxAtStartPar -An interposer module can link against the GSSAPI library in order to -make calls to the original mechanism. To do so, it must specify a -special mechanism OID which is the concatention of the interposer’s -own OID byte string and the original mechanism’s OID byte string. - -\sphinxAtStartPar -Functions that do not accept a mechanism argument directly require no -special handling, with the following exceptions: - -\sphinxAtStartPar -Since \sphinxstylestrong{gss\_accept\_sec\_context} does not accept a mechanism argument, -an interposer mechanism must, in order to invoke the original -mechanism’s function, acquire a credential for the concatenated OID -and pass that as the \sphinxstyleemphasis{verifier\_cred\_handle} parameter. - -\sphinxAtStartPar -Since \sphinxstylestrong{gss\_import\_name}, \sphinxstylestrong{gss\_import\_cred}, and -\sphinxstylestrong{gss\_import\_sec\_context} do not accept mechanism parameters, the SPI -has been extended to include variants which do. This allows the -interposer module to know which mechanism should be used to interpret -the token. These functions have the following signatures: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gssi\PYGZus{}import\PYGZus{}sec\PYGZus{}context\PYGZus{}by\PYGZus{}mech}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID} \PYG{n}{desired\PYGZus{}mech}\PYG{p}{,} \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{interprocess\PYGZus{}token}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}ctx\PYGZus{}id\PYGZus{}t} \PYG{o}{*}\PYG{n}{context\PYGZus{}handle}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gssi\PYGZus{}import\PYGZus{}name\PYGZus{}by\PYGZus{}mech}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID} \PYG{n}{mech\PYGZus{}type}\PYG{p}{,} \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{input\PYGZus{}name\PYGZus{}buffer}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID} \PYG{n}{input\PYGZus{}name\PYGZus{}type}\PYG{p}{,} \PYG{n}{gss\PYGZus{}name\PYGZus{}t} \PYG{n}{output\PYGZus{}name}\PYG{p}{)}\PYG{p}{;} - -\PYG{n}{OM\PYGZus{}uint32} \PYG{n}{gssi\PYGZus{}import\PYGZus{}cred\PYGZus{}by\PYGZus{}mech}\PYG{p}{(}\PYG{n}{OM\PYGZus{}uint32} \PYG{o}{*}\PYG{n}{minor\PYGZus{}status}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}OID} \PYG{n}{mech\PYGZus{}type}\PYG{p}{,} \PYG{n}{gss\PYGZus{}buffer\PYGZus{}t} \PYG{n}{token}\PYG{p}{,} - \PYG{n}{gss\PYGZus{}cred\PYGZus{}id\PYGZus{}t} \PYG{o}{*}\PYG{n}{cred\PYGZus{}handle}\PYG{p}{)}\PYG{p}{;} -\end{sphinxVerbatim} - -\sphinxAtStartPar -To re\sphinxhyphen{}enter the original mechanism when importing tokens for the above -functions, the interposer module must wrap the mechanism token in the -mechglue’s format, using the concatenated OID (except in -\sphinxstylestrong{gss\_import\_name}). The mechglue token formats are: -\begin{itemize} -\item {} -\sphinxAtStartPar -For \sphinxstylestrong{gss\_import\_sec\_context}, a four\sphinxhyphen{}byte OID length in big\sphinxhyphen{}endian -order, followed by the concatenated OID, followed by the mechanism -token. - -\item {} -\sphinxAtStartPar -For \sphinxstylestrong{gss\_import\_name}, the bytes 04 01, followed by a two\sphinxhyphen{}byte OID -length in big\sphinxhyphen{}endian order, followed by the mechanism OID, followed -by a four\sphinxhyphen{}byte token length in big\sphinxhyphen{}endian order, followed by the -mechanism token. Unlike most uses of OIDs in the API, the mechanism -OID encoding must include the DER tag and length for an object -identifier (06 followed by the DER length of the OID byte string), -and this prefix must be included in the two\sphinxhyphen{}byte OID length. -input\_name\_type must also be set to GSS\_C\_NT\_EXPORT\_NAME. - -\item {} -\sphinxAtStartPar -For \sphinxstylestrong{gss\_import\_cred}, a four\sphinxhyphen{}byte OID length in big\sphinxhyphen{}endian order, -followed by the concatenated OID, followed by a four\sphinxhyphen{}byte token -length in big\sphinxhyphen{}endian order, followed by the mechanism token. This -sequence may be repeated multiple times. - -\end{itemize} - -\sphinxstepscope - - -\section{Internal pluggable interfaces} -\label{\detokenize{plugindev/internal:internal-pluggable-interfaces}}\label{\detokenize{plugindev/internal::doc}} -\sphinxAtStartPar -Following are brief discussions of pluggable interfaces which have not -yet been made public. These interfaces are functional, but the -interfaces are likely to change in incompatible ways from release to -release. In some cases, it may be necessary to copy header files from -the krb5 source tree to use an internal interface. Use these with -care, and expect to need to update your modules for each new release -of MIT krb5. - - -\subsection{Kerberos database interface (KDB)} -\label{\detokenize{plugindev/internal:kerberos-database-interface-kdb}} -\sphinxAtStartPar -A KDB module implements a database back end for KDC principal and -policy information, and can also control many aspects of KDC behavior. -For a full description of the interface, see the header file -\sphinxcode{\sphinxupquote{\textless{}kdb.h\textgreater{}}}. - -\sphinxAtStartPar -The KDB pluggable interface is often referred to as the DAL (Database -Access Layer). - - -\subsection{Authorization data interface (authdata)} -\label{\detokenize{plugindev/internal:authorization-data-interface-authdata}} -\sphinxAtStartPar -The authdata interface allows a module to provide (from the KDC) or -consume (in application servers) authorization data of types beyond -those handled by the core MIT krb5 code base. The interface is -defined in the header file \sphinxcode{\sphinxupquote{\textless{}krb5/authdata\_plugin.h\textgreater{}}}, which is not -installed by the build. - -\sphinxstepscope - - -\section{PKINIT certificate authorization interface (certauth)} -\label{\detokenize{plugindev/certauth:pkinit-certificate-authorization-interface-certauth}}\label{\detokenize{plugindev/certauth:certauth-plugin}}\label{\detokenize{plugindev/certauth::doc}} -\sphinxAtStartPar -The certauth interface was first introduced in release 1.16. It -allows customization of the X.509 certificate attribute requirements -placed on certificates used by PKINIT enabled clients. For a detailed -description of the certauth interface, see the header file -\sphinxcode{\sphinxupquote{\textless{}krb5/certauth\_plugin.h\textgreater{}}} - -\sphinxAtStartPar -A certauth module implements the \sphinxstylestrong{authorize} method to determine -whether a client’s certificate is authorized to authenticate a client -principal. \sphinxstylestrong{authorize} receives the DER\sphinxhyphen{}encoded certificate, the -requested client principal, and a pointer to the client’s -krb5\_db\_entry (for modules that link against libkdb5). The method -must decode the certificate and inspect its attributes to determine if -it should authorize PKINIT authentication. It returns the -authorization status and optionally outputs a list of authentication -indicator strings to be added to the ticket. - -\sphinxAtStartPar -Beginning in release 1.19, the authorize method can request that the -hardware authentication bit be set in the ticket by returning -\sphinxstylestrong{KRB5\_CERTAUTH\_HWAUTH}. Beginning in release 1.20, the authorize -method can return \sphinxstylestrong{KRB5\_CERTAUTH\_HWAUTH\_PASS} to request that the -hardware authentication bit be set in the ticket but otherwise defer -authorization to another certauth module. A module must use its own -internal or library\sphinxhyphen{}provided ASN.1 certificate decoder. - -\sphinxAtStartPar -A module can optionally create and destroy module data with the -\sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. Module data objects last for the -lifetime of the KDC process. - -\sphinxAtStartPar -If a module allocates and returns a list of authentication indicators -from \sphinxstylestrong{authorize}, it must also implement the \sphinxstylestrong{free\_ind} method -to free the list. - -\sphinxstepscope - - -\section{KDC policy interface (kdcpolicy)} -\label{\detokenize{plugindev/kdcpolicy:kdc-policy-interface-kdcpolicy}}\label{\detokenize{plugindev/kdcpolicy:kdcpolicy-plugin}}\label{\detokenize{plugindev/kdcpolicy::doc}} -\sphinxAtStartPar -The kdcpolicy interface was first introduced in release 1.16. It -allows modules to veto otherwise valid AS and TGS requests or restrict -the lifetime and renew time of the resulting ticket. For a detailed -description of the kdcpolicy interface, see the header file -\sphinxcode{\sphinxupquote{\textless{}krb5/kdcpolicy\_plugin.h\textgreater{}}}. - -\sphinxAtStartPar -The optional \sphinxstylestrong{check\_as} and \sphinxstylestrong{check\_tgs} functions allow the module -to perform access control. Additionally, a module can create and -destroy module data with the \sphinxstylestrong{init} and \sphinxstylestrong{fini} methods. Module -data objects last for the lifetime of the KDC process, and are -provided to all other methods. The data has the type -krb5\_kdcpolicy\_moddata, which should be cast to the appropriate -internal type. - -\sphinxAtStartPar -kdcpolicy modules can optionally inspect principal entries. To do -this, the module must also include \sphinxcode{\sphinxupquote{\textless{}kdb.h\textgreater{}}} to gain access to the -principal entry structure definition. As the KDB interface is -explicitly not as stable as other public interfaces, modules which do -this may not retain compatibility across releases. - - - -\renewcommand{\indexname}{Index} -\printindex -\end{document}
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/python.ist b/crypto/krb5/doc/pdf/python.ist deleted file mode 100644 index 70536a668357..000000000000 --- a/crypto/krb5/doc/pdf/python.ist +++ /dev/null @@ -1,16 +0,0 @@ -line_max 100 -headings_flag 1 -heading_prefix " \\bigletter " - -preamble "\\begin{sphinxtheindex} -\\let\\bigletter\\sphinxstyleindexlettergroup -\\let\\spxpagem \\sphinxstyleindexpagemain -\\let\\spxentry \\sphinxstyleindexentry -\\let\\spxextra \\sphinxstyleindexextra - -" - -postamble "\n\n\\end{sphinxtheindex}\n" - -symhead_positive "{\\sphinxsymbolsname}" -numhead_positive "{\\sphinxnumbersname}" diff --git a/crypto/krb5/doc/pdf/sphinx.sty b/crypto/krb5/doc/pdf/sphinx.sty deleted file mode 100644 index 6c31f329c658..000000000000 --- a/crypto/krb5/doc/pdf/sphinx.sty +++ /dev/null @@ -1,1013 +0,0 @@ -% -% sphinx.sty -% -% Adapted from the old python.sty, mostly written by Fred Drake, -% by Georg Brandl. -% - -\NeedsTeXFormat{LaTeX2e}[1995/12/01] -\ProvidesPackage{sphinx}[2023/03/19 v6.2.0 LaTeX package (Sphinx markup)] - -% provides \ltx@ifundefined -% (many packages load ltxcmds: graphicx does for pdftex and lualatex but -% not xelatex, and anyhow kvoptions does, but it may be needed in future to -% use \sphinxdeprecationwarning earlier, and it needs \ltx@ifundefined) -\RequirePackage{ltxcmds} - -%% for deprecation warnings -\newcommand\sphinxdeprecationwarning[4]{% #1 the deprecated macro or name, -% #2 = when deprecated, #3 = when removed, #4 = additional info - {% limit scope of \spx@tempa, \AtEndDocument works even if nested. - \edef\spx@tempa{\detokenize{#1}}% - \ltx@ifundefined{sphinx_depr_\spx@tempa}{% - \global\expandafter\let\csname sphinx_depr_\spx@tempa\endcsname\spx@tempa - \expandafter\AtEndDocument\expandafter{\expandafter\let\expandafter - \sphinxdeprecatedmacro\csname sphinx_depr_\spx@tempa\endcsname - \PackageWarningNoLine{sphinx}{^^J**** SPHINX DEPRECATION WARNING:^^J - \sphinxdeprecatedmacro^^J - \@spaces- is deprecated at Sphinx #2^^J - \@spaces- and removed at Sphinx #3.^^J - #4^^J****}}% - }{% warning already emitted (at end of latex log), don't repeat - }% - }% end of scope limiting group for \spx@tempa -} -%% important build warnings use an undefined reference to induce latexmk -%% into complaining (once per warning) at very end of console output -\newcommand\sphinxbuildwarning[1]{% - \ifcsname sphinx_emitted_#1\endcsname - \else - \global\expandafter\let\csname sphinx_emitted_#1\endcsname\@empty - \AtEndDocument{\hbox{% should the printing of text be made conditional on - % some boolean? - \bfseries\color{red}% - \@nameuse{sphinx_buildwarning_#1}% - % place an undefined reference deliberately - \let\nfss@text\@gobble % no ?? - \ref{!!\@nameuse{sphinx_buildwarning_#1}}% - }}% - \fi -} -\@namedef{sphinx_buildwarning_coloursyntax}{% - The colours whose definition used xcolor syntax were set to white - as xcolor was not found; check the latex log warnings for details} -\@namedef{sphinx_buildwarning_colorblend}{% - Command \string\sphinxcolorblend\space seen but ignored in tables - as xcolor was not found; check the latex log warnings for details} -\@namedef{sphinx_buildwarning_badtitlesec}{% - Your system has titlesec version 2.10.1 which causes disappearance - of section numbers; check the latex log warning for details} -\@namedef{sphinx_buildwarning_booktabs}{% - Some tables with booktabs class (check latex log) but booktabs - package not loaded; add its loading to the latex preamble}% -\@namedef{sphinx_buildwarning_badfootnotes}{% - Footnote rendering may have had problems, due to extra package or - document class; check latex log for instructions}% - - -%% OPTION HANDLING -% - -% We generally first handle options then load packages, but we need -% \definecolor from xcolor/color to handle the options. - -% MEMO: xcolor \fcolorbox coloured boxes render better in some PDF viewers -% than with color package \fcolorbox. Since 1.6.3, Sphinx uses only its own -% custom variant of \fcolorbox when handling code-blocks. But \fcolorbox -% appears also in Pygmentize output mark-up. Also, since 5.3.0, 'sphinxsetup' -% color options get a richer input syntax if Sphinx knows xcolor is loaded, -% and the \sphinxcolorblend (for tables) is made available only if xcolor is -% loaded. -\IfFileExists{xcolor.sty}{ -% Should Sphinx load xcolor with its dvipsnames and svgnames options? - \RequirePackage{xcolor} -}{ - \RequirePackage{color} -} - -% the \colorlet of xcolor (if at all loaded) is overkill for most internal use -\newcommand{\sphinxcolorlet}[2] - {\expandafter\let\csname\@backslashchar color@#1\expandafter\endcsname - \csname\@backslashchar color@#2\endcsname } - -% (5.3.0) Allow colour options to use both the \definecolor and the \colorlet -% syntaxes, for example VerbatimColor={gray}{0.9} or VerbatimColor=red!10 -% In the latter case we need the real \colorlet from xcolor package. -\def\spx@defineorletcolor#1{% - \def\spx@definedcolor{{#1}}% - \futurelet\spx@token\spx@defineorlet} -\def\spx@defineorlet{% - \ifx\spx@token\bgroup - \expandafter\spx@definecolor\else\expandafter\spx@colorlet\fi} -\def\spx@colorlet#1\relax{\expandafter\colorlet\spx@definedcolor{#1}} -\def\spx@definecolor{\expandafter\definecolor\spx@definedcolor} -% -\@ifpackageloaded{xcolor}% - {}% - {% xcolor not loaded because it was not found in the LaTeX installation -\def\spx@colorlet#1\relax{% - \sphinxbuildwarning{coloursyntax}% - \PackageWarning{sphinx}{% -Sorry, the #1 syntax requires package xcolor,\MessageBreak -which was not found on your TeX/LaTeX installation.\MessageBreak -\@spaces\expandafter\@firstofone\spx@definedcolor\MessageBreak -will be set to white}% - \expandafter\definecolor\spx@definedcolor{rgb}{1,1,1}% - }% end of redefinition of \spx@colorlet - }% end of xcolor not found branch - - -% Handle options via "kvoptions" (later loaded by hyperref anyhow) -\RequirePackage{kvoptions} -\SetupKeyvalOptions{prefix=spx@opt@} % use \spx@opt@ prefix - -% Optional usage of booktabs package for tables -\DeclareBoolOption[false]{booktabs} -\DeclareBoolOption[false]{borderless} -\DeclareBoolOption[true]{booktabscolorgaps} -\DeclareVoidOption{booktabsnogaps}{% - \ifx\@nodocument\relax - % in body - \expandafter\@firstofone - \else - % in preamble, wait for at begin document - \expandafter\AtBeginDocument - \fi - {\ifdefined\abovetopsep % silently do nothing if booktabs not loaded - \abovetopsep\z@\belowrulesep\z@\aboverulesep\z@\belowbottomsep\z@ - \fi - }% -} -% Coloured table rows -\DeclareBoolOption[false]{colorrows} -% Sphinx legacy text layout: 1in margins on all four sides -\ifx\@jsc@uplatextrue\@undefined -\DeclareStringOption[1in]{hmargin} -\DeclareStringOption[1in]{vmargin} -\DeclareStringOption[.5in]{marginpar} -\else -% Japanese standard document classes handle \mag in a special way -\DeclareStringOption[\inv@mag in]{hmargin} -\DeclareStringOption[\inv@mag in]{vmargin} -\DeclareStringOption[.5\dimexpr\inv@mag in\relax]{marginpar} -\fi - -\DeclareStringOption[0]{maxlistdepth}% \newcommand*\spx@opt@maxlistdepth{0} -\DeclareStringOption[-1]{numfigreset} -\DeclareBoolOption[false]{nonumfigreset} -\DeclareBoolOption[false]{mathnumfig} -\define@key{sphinx}{bookmarksdepth}{\AtBeginDocument{\hypersetup{bookmarksdepth=#1}}} -\AtBeginDocument{\define@key{sphinx}{bookmarksdepth}{\hypersetup{bookmarksdepth=#1}}} -% \DeclareBoolOption[false]{usespart}% not used -% INFO: the keys for padding and border widths were extended at 5.1.0, -% and legacy names for user interface were kept, but their definitions -% are delayed further down. The legacy internally used dimen registers -% \sphinxverbatimborder and \sphinxverbatimsep got removed at 6.2.0. -\DeclareBoolOption[true]{verbatimwithframe} -\DeclareBoolOption[true]{verbatimwrapslines} -\DeclareBoolOption[false]{verbatimforcewraps} -\DeclareStringOption[3]{verbatimmaxoverfull} -\DeclareStringOption[100]{verbatimmaxunderfull} -\DeclareBoolOption[true]{verbatimhintsturnover} -\DeclareBoolOption[true]{inlineliteralwraps} -\DeclareStringOption[t]{literalblockcappos} -\DeclareStringOption[r]{verbatimcontinuedalign} -\DeclareStringOption[r]{verbatimcontinuesalign} -% parsed literal -\DeclareBoolOption[true]{parsedliteralwraps} -% \textvisiblespace for compatibility with fontspec+XeTeX/LuaTeX -\DeclareStringOption[\textcolor{red}{\textvisiblespace}]{verbatimvisiblespace} -\DeclareStringOption % must use braces to hide the brackets - [{\makebox[2\fontcharwd\font`\x][r]{\textcolor{red}{\tiny$\m@th\hookrightarrow$}}}]% - {verbatimcontinued} -% topic boxes -% -% 5.1.0 added new keys for configuration. The legacy keys shadowsep, -% shadowsize, shadowrule were kept for backward compatibility. Unfortunately -% this had bugs due to typos, which got fixed later at 6.1.2. -% -% All configuration is now to be found in the "CSS" section below. -% -% \sphinxshadowsep, \sphinxshadowsize, \sphinxshadowrule \dimen registers -% became at 5.1.0 either no-op or, for the latter, were used under an aliased -% name. They got removed at 6.2.0. -% -% notices/admonitions -% -% 5.1.0 added much customizability to warning, caution, attention, danger and -% error types of notices via an enhanced sphinxheavybox environment. -% -% 6.2.0 added the possibility to use the same kind of rendering also for -% note, hint, important, and tip. -% -% Legacy user interface for options was kept working. All of it is handled in -% the "CSS" section below. -% -% These 6.2.0 added booleans serve internally. There is no reason for user to -% know about them, except if it is desired to toggle mid-way in the document -% whether note, hint, important, and tip should use the "lightbox" or the -% "heavybox" rendering. -\DeclareBoolOption[false]{heavynote} -\DeclareBoolOption[false]{heavyhint} -\DeclareBoolOption[false]{heavyimportant} -\DeclareBoolOption[false]{heavytip} -% footnotes -\DeclareStringOption[\mbox{ }]{AtStartFootnote} -% we need a public macro name for direct use in latex file -\newcommand*{\sphinxAtStartFootnote}{\spx@opt@AtStartFootnote} -% no such need for this one, as it is used inside other macros -\DeclareStringOption[\leavevmode\unskip]{BeforeFootnote} -% some font styling. -\DeclareStringOption[\sffamily\bfseries]{HeaderFamily} -% colours -% same problems as for dimensions: we want the key handler to use \definecolor. -% first, some colours with no prefix, for backward compatibility -\newcommand*{\sphinxDeclareColorOption}[2]{% - % set the initial default; only \definecolor syntax for defaults! - \definecolor{#1}#2% - % set the key handler to accept both \definecolor and \colorlet syntax - \define@key{sphinx}{#1}{\spx@defineorletcolor{#1}##1\relax}% -}% -\sphinxDeclareColorOption{TitleColor}{{rgb}{0.126,0.263,0.361}} -\sphinxDeclareColorOption{InnerLinkColor}{{rgb}{0.208,0.374,0.486}} -\sphinxDeclareColorOption{OuterLinkColor}{{rgb}{0.216,0.439,0.388}} -\sphinxDeclareColorOption{VerbatimColor}{{gray}{0.95}} -\sphinxDeclareColorOption{VerbatimBorderColor}{{RGB}{32,32,32}} -% all other colours will be named with a "sphinx" prefix -\newcommand*{\sphinxDeclareSphinxColorOption}[2]{% - % set the initial default; only \definecolor syntax for defaults! - \definecolor{sphinx#1}#2% - % set the key handler to accept both \definecolor and \colorlet syntax - \define@key{sphinx}{#1}{\spx@defineorletcolor{sphinx#1}##1\relax}% -}% -% table row colors -\sphinxDeclareSphinxColorOption{TableRowColorHeader}{{gray}{0.86}} -\sphinxDeclareSphinxColorOption{TableRowColorOdd}{{gray}{0.92}} -\sphinxDeclareSphinxColorOption{TableRowColorEven}{{gray}{0.98}} -% if not set, the "Merge" colour will keep in sync with the "Row" colour -\def\sphinxTableMergeColorHeader{sphinxTableRowColorHeader} -\define@key{sphinx}{TableMergeColorHeader}{% - \spx@defineorletcolor{sphinxTableMergeColorHeader}#1\relax - \def\sphinxTableMergeColorHeader{sphinxTableMergeColorHeader}% -}% -\def\sphinxTableMergeColorOdd{sphinxTableRowColorOdd} -\define@key{sphinx}{TableMergeColorOdd}{% - \spx@defineorletcolor{sphinxTableMergeColorOdd}#1\relax - \def\sphinxTableMergeColorOdd{sphinxTableMergeColorOdd}% -}% -\def\sphinxTableMergeColorEven{sphinxTableRowColorEven} -\define@key{sphinx}{TableMergeColorEven}{% - \spx@defineorletcolor{sphinxTableMergeColorEven}#1\relax - \def\sphinxTableMergeColorEven{sphinxTableMergeColorEven}% -}% -% Default color chosen to be as in minted.sty LaTeX package! -\sphinxDeclareSphinxColorOption{VerbatimHighlightColor}{{rgb}{0.878,1,1}} -% admonition boxes, "light" style -% border color defaults to black -% at 6.2.0 also background color is possible, but it then triggers -% usage of the "sphinxheavybox" from sphinxlatexadmonitions.sty. -\sphinxDeclareSphinxColorOption{noteBorderColor}{{rgb}{0,0,0}} -\sphinxDeclareSphinxColorOption{hintBorderColor}{{rgb}{0,0,0}} -\sphinxDeclareSphinxColorOption{importantBorderColor}{{rgb}{0,0,0}} -\sphinxDeclareSphinxColorOption{tipBorderColor}{{rgb}{0,0,0}} -\sphinxDeclareSphinxColorOption{noteBgColor}{{rgb}{1,1,1}} -\sphinxDeclareSphinxColorOption{hintBgColor}{{rgb}{1,1,1}} -\sphinxDeclareSphinxColorOption{importantBgColor}{{rgb}{1,1,1}} -\sphinxDeclareSphinxColorOption{tipBgColor}{{rgb}{1,1,1}} -% admonition boxes, "heavy" style -% border color defaults to black and background color to white -% As long as the color are not explicitly set via user options, -% the sphinxpackageboxes.sty code will actually not use them anyhow. -\sphinxDeclareSphinxColorOption{warningBorderColor}{{rgb}{0,0,0}} -\sphinxDeclareSphinxColorOption{cautionBorderColor}{{rgb}{0,0,0}} -\sphinxDeclareSphinxColorOption{attentionBorderColor}{{rgb}{0,0,0}} -\sphinxDeclareSphinxColorOption{dangerBorderColor}{{rgb}{0,0,0}} -\sphinxDeclareSphinxColorOption{errorBorderColor}{{rgb}{0,0,0}} -% BgColor should have been from the start BackgroundColor for better -% match with CSS property names, but this is legacy interface -% which is too late to change because the internal color names -% and not only the option names have been documented at user level. -\sphinxDeclareSphinxColorOption{warningBgColor}{{rgb}{1,1,1}} -\sphinxDeclareSphinxColorOption{cautionBgColor}{{rgb}{1,1,1}} -\sphinxDeclareSphinxColorOption{attentionBgColor}{{rgb}{1,1,1}} -\sphinxDeclareSphinxColorOption{dangerBgColor}{{rgb}{1,1,1}} -\sphinxDeclareSphinxColorOption{errorBgColor}{{rgb}{1,1,1}} -%%%%%%%% -% -% Additions of CSS-like keys at 5.1.0 (and possibility of rounded boxes) -% ----------------------------------- -% -% These CSS-named alikes allow to configure 4 border widths, 4 padding seps, 4 -% corner radii, optional shadow, border color, background color, shadow color. -% -% In future, an alternative user interface will perhaps be provided to parse -% genuine CSS, but this will be easier to do in Python than in LaTeX. -% -% Refactoring (and extension) at 6.2.0 -% ------------------------------------ -% -% 6.2.0 batch defines in one go all auxiliaries for code-blocks, topics, and -% admonitions. The needed steps to maintain the legacy option names working -% and to set some specific defaults are handled in a second step. -% -% This allowed to: -% -% - associate these CSS-named options also to note, hint, important, and tip -% which thus can access the full customizability of sphinxheavybox if they use -% it. -% -% - provide a \sphinxbox command for boxing inline text elements with the same -% full customizability. -% -% The \dimen's \sphinxverbatimborder, \sphinxverbatimsep, \sphinxshadowsep, -% \sphinxshadowsize, and \sphinxshadowrule, which had been deprecated have -% finally been removed entirely. No more \dimen register is used here only -% storage in macros. -% -\def\spxstring@none{none} -\def\spxstring@clone{clone} -% -% Border keys -% -\def\spx@tempa#1{% #1 = macro prefix - \expandafter\spx@tempb - \csname #1border\expandafter\endcsname - \csname #1border@top\expandafter\endcsname - \csname #1border@right\expandafter\endcsname - \csname #1border@bottom\expandafter\endcsname - \csname #1border@left\expandafter\endcsname - \csname if#1border@open\expandafter\endcsname - \csname #1border@opentrue\expandafter\endcsname - \csname #1border@openfalse\endcsname -}% -\def\spx@tempb #1#2#3#4#5#6#7#8#9{% #9 = option prefix - \define@key{sphinx}{#9border-top-width}{\def#2{##1}}% - \define@key{sphinx}{#9border-right-width}{\def#3{##1}}% - \define@key{sphinx}{#9border-bottom-width}{\def#4{##1}}% - \define@key{sphinx}{#9border-left-width}{\def#5{##1}}% - \define@key{sphinx}{#9border-width}{% - \def#1{##1}% MEMO: not immediately expanded, should this be changed? - \def#2{#1}\let#3#2\let#4#2\let#5#2% - }% - \newif#6% - \define@key{sphinx}{#9box-decoration-break}% - {\begingroup\edef\spx@tempa{##1}\expandafter\endgroup - \ifx\spx@tempa\spxstring@clone#8\else#7\fi}% - \spx@tempc{#9}% option prefix -} -\def\spx@tempc #1#2{% #1 = option prefix, #2 = legacy option name - % keep legacy option names as aliases to new-named options - \expandafter\let\csname KV@sphinx@#2\expandafter\endcsname - \csname KV@sphinx@#1border-width\endcsname - % init border-width (fetches next argument) - \csname KV@sphinx@#1border-width\endcsname -} -% MEMO: prior to 6.2.0 the \fboxrule value (0.4pt, a priori) was frozen here via -% a \dimen assignment done immediately. Now it remains \fboxrule until being used. -% macro prefix option prefix legacy option init value -\spx@tempa{spx@pre@} {pre_} {verbatimborder} \fboxrule -\spx@tempa{spx@topic@} {div.topic_} {shadowrule} \fboxrule -\spx@tempa{spx@note@} {div.note_} {noteborder} {0.5pt} -\spx@tempa{spx@hint@} {div.hint_} {hintborder} {0.5pt} -\spx@tempa{spx@important@}{div.important_}{importantborder}{0.5pt} -\spx@tempa{spx@tip@} {div.tip_} {tipborder} {0.5pt} -\spx@tempa{spx@warning@} {div.warning_} {warningborder} {1pt} -\spx@tempa{spx@caution@} {div.caution_} {cautionborder} {1pt} -\spx@tempa{spx@attention@}{div.attention_}{attentionborder}{1pt} -\spx@tempa{spx@danger@} {div.danger_} {dangerborder} {1pt} -\spx@tempa{spx@error@} {div.error_} {errorborder} {1pt} -% this one new at 6.2.0: (we do not create a "legacy name" for it) -\spx@tempa{spx@box@} {box_} {box_border-width}\fboxrule -% Set default box-decoration-break style for codeblocks to slice -\spx@pre@border@opentrue % new default at 6.0.0: slice, not clone -% 6.2.0 has added support for box-decoration-break=slice to all -% other directives, formerly the option setting was ignored for them. - -% Padding keys -% -\def\spx@tempa#1{% - \expandafter\spx@tempb - \csname #1padding\expandafter\endcsname - \csname #1padding@top\expandafter\endcsname - \csname #1padding@right\expandafter\endcsname - \csname #1padding@bottom\expandafter\endcsname - \csname #1padding@left\endcsname -}% -\def\spx@tempb #1#2#3#4#5#6{% #6 = option prefix - \define@key{sphinx}{#6padding-top}{\def#2{##1}}% - \define@key{sphinx}{#6padding-right}{\def#3{##1}}% - \define@key{sphinx}{#6padding-bottom}{\def#4{##1}}% - \define@key{sphinx}{#6padding-left}{\def#5{##1}}% - \define@key{sphinx}{#6padding}{% - \def#1{##1}% - \def#2{#1}\let#3#2\let#4#2\let#5#2% - }% - % initialization (will fetch "init" argument next): - \csname KV@sphinx@#6padding\endcsname -} -% MEMO: prior to 6.2.0 the \fboxsep value (3pt, a priori) was frozen here via -% a \dimen assignment done immediately. Now it remains \fboxsep until being used. -% #1 macro prefix #6 option prefix init value -\spx@tempa{spx@pre@} {pre_} \fboxsep -\spx@tempa{spx@topic@} {div.topic_} {5pt} -% MEMO: prior to 6.2.0, "note" type admonitions used sphinxlightbox automatically -% and had no interface to set the padding parameters needed by sphinxheavybox. -% At 6.2.0 they acquired such interface and the default is set as for legacy -% default of "warning" type. I hesitated using \fboxsep, but if I did I would -% then need to explain how to change "note etc..." into behaving exactly -% as "warning etc...", which goes via the \dimexpr here which is too scary to -% put sanely into documentation. -\spx@tempa{spx@note@} {div.note_} {\dimexpr.6\baselineskip-\spx@note@border\relax} -\spx@tempa{spx@hint@} {div.hint_} {\dimexpr.6\baselineskip-\spx@hint@border\relax} -\spx@tempa{spx@important@}{div.important_} {\dimexpr.6\baselineskip-\spx@important@border\relax} -\spx@tempa{spx@tip@} {div.tip_} {\dimexpr.6\baselineskip-\spx@tip@border\relax} -% MEMO: prior to 5.1.0 padding was not separately customizable from border -% width for warning type admonitions. The below keeps the legacy behavior of a -% constant borderwidth+padding. The dim expression is not evaluated yet, only -% at time of use (so that it dynamically adapts to the border width setting). -% MEMO: I could use everywhere \spx@notice@border, as sphinxadmonition environment -% configures it to hold the \spx@<type>@border value. -\spx@tempa{spx@warning@} {div.warning_} {\dimexpr.6\baselineskip-\spx@warning@border\relax} -\spx@tempa{spx@caution@} {div.caution_} {\dimexpr.6\baselineskip-\spx@caution@border\relax} -\spx@tempa{spx@attention@}{div.attention_} {\dimexpr.6\baselineskip-\spx@attention@border\relax} -\spx@tempa{spx@danger@} {div.danger_} {\dimexpr.6\baselineskip-\spx@danger@border\relax} -\spx@tempa{spx@error@} {div.error_} {\dimexpr.6\baselineskip-\spx@error@border\relax} -\spx@tempa{spx@box@} {box_} \fboxsep -% define legacy verbatimsep key as alias of pre_padding key -\expandafter\let\expandafter\KV@sphinx@verbatimsep\csname KV@sphinx@pre_padding\endcsname -% define legacy shadowsep key as alias of div.topic_padding key -\expandafter\let\expandafter\KV@sphinx@shadowsep\csname KV@sphinx@div.topic_padding\endcsname - -% Corner radii keys -% -% Prior to 6.2.0, the "rounded box" branch obeyed the 4 radii but ignored -% the separate border widths and used only the border-width setting. -% Now, all 4 + 4 parameters are obeyed. -\def\spx@tempa#1{% #1 = macro prefix - \expandafter\spx@tempb - \csname #1radius@topleft\expandafter\endcsname - \csname #1radius@topright\expandafter\endcsname - \csname #1radius@bottomright\expandafter\endcsname - \csname #1radius@bottomleft\endcsname -}% -\def\spx@tempb #1#2#3#4#5{% #5 = option prefix - \define@key{sphinx}{#5border-top-left-radius}{\def#1{##1}}% - \define@key{sphinx}{#5border-top-right-radius}{\def#2{##1}}% - \define@key{sphinx}{#5border-bottom-right-radius}{\def#3{##1}}% - \define@key{sphinx}{#5border-bottom-left-radius}{\def#4{##1}}% - \define@key{sphinx}{#5border-radius}{\def#1{##1}\let#2#1\let#3#1\let#4#1}% - \csname KV@sphinx@#5border-radius\endcsname % fetches next argument -} -% The init value for corner radius in code-blocks was \z@ (i.e. 0pt) prior -% to 6.0.0., then 3pt, then \fboxsep at 6.2.0 as padding is \fboxsep, -% and \fboxsep=3pt per default (also with platex). -% macro prefix option prefix init value -\spx@tempa{spx@pre@} {pre_} \fboxsep -\spx@tempa{spx@topic@} {div.topic_} \z@ -\spx@tempa{spx@note@} {div.note_} \z@ -\spx@tempa{spx@hint@} {div.hint_} \z@ -\spx@tempa{spx@important@}{div.important_} \z@ -\spx@tempa{spx@tip@} {div.tip_} \z@ -\spx@tempa{spx@warning@} {div.warning_} \z@ -\spx@tempa{spx@caution@} {div.caution_} \z@ -\spx@tempa{spx@attention@}{div.attention_} \z@ -\spx@tempa{spx@danger@} {div.danger_} \z@ -\spx@tempa{spx@error@} {div.error_} \z@ -\spx@tempa{spx@box@} {box_} \fboxsep - -% Shadow keys -% -% Prior to 6.2.0, an "inset" shadow caused the rendering to ignore -% rounded corners. Starting with 6.2.0, an "inset" shadow is simply -% ignored (not implemented) if any of the corner radii is positive, -% rather than forcing a rectangle+inset shadow output. -\def\spx@tempa#1{% - \expandafter\spx@tempb - \csname if#1withshadow\expandafter\endcsname - \csname if#1insetshadow\endcsname -}% -\def\spx@tempb#1#2{\newif#1\newif#2}% -% macro prefix -\spx@tempa{spx@pre@} -\spx@tempa{spx@topic@} -\spx@tempa{spx@note@} -\spx@tempa{spx@hint@} -\spx@tempa{spx@important@} -\spx@tempa{spx@tip@} -\spx@tempa{spx@warning@} -\spx@tempa{spx@caution@} -\spx@tempa{spx@attention@} -\spx@tempa{spx@danger@} -\spx@tempa{spx@error@} -\spx@tempa{spx@box@} -% -\def\spx@tempa#1{% #1 = macro prefix - \expandafter\spx@tempb - \csname #1withshadowtrue\expandafter\endcsname - \csname #1withshadowfalse\expandafter\endcsname - \csname #1insetshadowtrue\expandafter\endcsname - \csname #1insetshadowfalse\expandafter\endcsname - \csname #1shadow@setter\expandafter\endcsname - \csname #1shadow@xoffset\expandafter\endcsname - \csname #1shadow@yoffset\endcsname -}% -\def\spx@tempb#1#2#3#4#5#6#7#8{% #8 = option prefix - \define@key{sphinx}{#8box-shadow}{#5##1 {} {} \@nnil}% - \def#5##1 ##2 ##3 ##4\@nnil{% - \begingroup\edef\spx@tempa{##1}\expandafter\endgroup - \ifx\spx@tempa\spxstring@none - #2% - % MEMO: at 5.1.0 and up to 6.2.0, an \edef with \number\dimexpr was - % used here. Since 6.2.0, expansion is delayed to time of use as for - % the other dimensions handled above. This is synched with an added - % encapsulation in \dimexpr...\relax by the "setup" from - % sphinxpackageboxes.sty. An induced regression had to be fixed in - % the sphinxShadowBox environment as it was using in an \ifdim the - % \spx@topic@shadow@yoffset macro, now holding by default 4pt+\z@ - % rather than an already digested 262144sp. The +\z@ is in case ##2 - % is empty. - \else #1% - \def#6{##1}\def#7{##2+\z@}% - \if\relax\detokenize{##3}\relax#4\else#3\fi - \fi - }% - #5none {} {} \@nnil % no shadow by default (except for topic, see below) -} -\spx@tempa{spx@pre@} {pre_} -\spx@tempa{spx@topic@} {div.topic_} -% This corresponds to the legacy parameters of ShadowBox - \spx@topic@shadow@setter 4pt 4pt {} \@nnil -\spx@tempa{spx@note@} {div.note_} -\spx@tempa{spx@hint@} {div.hint_} -\spx@tempa{spx@important@}{div.important_} -\spx@tempa{spx@tip@} {div.tip_} -\spx@tempa{spx@warning@} {div.warning_} -\spx@tempa{spx@caution@} {div.caution_} -\spx@tempa{spx@attention@}{div.attention_} -\spx@tempa{spx@danger@} {div.danger_} -\spx@tempa{spx@error@} {div.error_} -\spx@tempa{spx@box@} {box_} - -% Support for legacy shadowsize (topic/contents) -% This definition was broken due to a typo at 5.1.0 and got fixed at 6.1.2 -% MEMO: at 6.2.0 this no longer does \number\dimexpr in an \edef. Reason is to -% keep in sync with div.topic_box-shadow handling of xoffset and yoffset. -% Attention in particular to \ifdim context, we add a \dimexpr to the one here. -\define@key{sphinx}{shadowsize}{% - \def\spx@topic@shadow@xoffset{#1}% - \let\spx@topic@shadow@yoffset\spx@topic@shadow@xoffset - \ifdim\dimexpr\spx@topic@shadow@xoffset=\z@ - \spx@topic@withshadowfalse - \else - \spx@topic@withshadowtrue - \spx@topic@insetshadowfalse - \fi -}% - -% Color keys -% (four of them: border, background, shadow and the text color) -% -% Some problems due to legacy naming scheme which had diverging conventions -% for code-blocks (VerbatimBorderColor, VerbatimColor) and admonitions -% (sphinxwarningBorderColor, sphinxwarningBgColor, etc...) regarding the -% internal names of the used colors. Unfortunately VerbatimColor and for -% example sphinxwarningBgColor are also documented at user level, they are not -% only internally used. -% -% For topic directive, "legacy" (by this I mean Sphinx around 2016-2017 after -% my first additions to LaTeX) had no interface for colors, so I could change -% some internals with no breakage during 5.x up to 6.2.0. So topic -% (shadowbox) could be unified with admonitions (sphinxheavybox), and the -% "set-up" macros could all be moved into a single one in the -% sphinxpackageboxes.sty file, with only one argument holding the directive -% type. -% -% It was then needed only for sphinxlatexliterals.sty to let its -% \spx@verb@boxes@fcolorbox@setup incorporate some extra adjustment. -% -% We associate a boolean to each color, so that the box code can -% decide to insert a \color command or consider it is not needed. -\def\spx@tempa#1{% - \expandafter\spx@tempb - \csname if#1withshadowcolor\expandafter\endcsname - \csname if#1withbordercolor\expandafter\endcsname - \csname if#1withbackgroundcolor\expandafter\endcsname - \csname if#1withtextcolor\endcsname -}% -\def\spx@tempb#1#2#3#4{\newif#1\newif#2\newif#3\newif#4}% -% macro prefix -\spx@tempa{spx@pre@} -\spx@tempa{spx@topic@} -\spx@tempa{spx@note@} -\spx@tempa{spx@hint@} -\spx@tempa{spx@important@} -\spx@tempa{spx@tip@} -\spx@tempa{spx@warning@} -\spx@tempa{spx@caution@} -\spx@tempa{spx@attention@} -\spx@tempa{spx@danger@} -\spx@tempa{spx@error@} -\spx@tempa{spx@box@} -% -\def\spx@tempa#1{% #1 = macro prefix - \expandafter\spx@tempb - \csname #1withbordercolortrue\expandafter\endcsname - \csname #1withbackgroundcolortrue\expandafter\endcsname - \csname #1withshadowcolortrue\expandafter\endcsname - \csname #1withtextcolortrue\endcsname -} -\def\spx@tempb#1#2#3#4#5#6{% #5 = option prefix, #6 = color name prefix - \define@key{sphinx}{#5border-TeXcolor}% - {#1\spx@defineorletcolor{#6BorderColor}##1\relax}% - \define@key{sphinx}{#5background-TeXcolor}% - {#2\spx@defineorletcolor{#6BgColor}##1\relax}% - \define@key{sphinx}{#5box-shadow-TeXcolor}% - {#3\spx@defineorletcolor{#6ShadowColor}##1\relax}% - \define@key{sphinx}{#5TeXcolor}% - {#4\spx@defineorletcolor{#6TextColor}##1\relax}% -} -% macro prefix option prefix color name prefix -\spx@tempa{spx@pre@} {pre_} {Verbatim} - % (memo: internal VerbatimShadowColor was formerly sphinxVerbatimShadowColor) - % internal legacy color name is VerbatimColor not VerbatimBgColor, so redefine: - \define@key{sphinx}{pre_background-TeXcolor}% - {\spx@pre@withbackgroundcolortrue\spx@defineorletcolor{VerbatimColor}#1\relax}% - \spx@pre@withbordercolortrue % 6.0.0 VerbatimBorderColor {RGB}{32,32,32} - \spx@pre@withbackgroundcolortrue % 6.0.0 VerbatimColor {gray}{0.95} - % Keep legacy option names working - \expandafter\let\expandafter\KV@sphinx@VerbatimBorderColor - \csname KV@sphinx@pre_border-TeXcolor\endcsname - \expandafter\let\expandafter\KV@sphinx@VerbatimColor - \csname KV@sphinx@pre_background-TeXcolor\endcsname -% (6.2.0 modified some internal namings for the colors of topic boxes) -% macro prefix option prefix color name prefix -\spx@tempa{spx@topic@} {div.topic_} {sphinxtopic}% (no legacy interface) -\spx@tempa{spx@note@} {div.note_} {sphinxnote} -\spx@tempa{spx@hint@} {div.hint_} {sphinxhint} -\spx@tempa{spx@important@}{div.important_} {sphinximportant} -\spx@tempa{spx@tip@} {div.tip_} {sphinxtip} -\spx@tempa{spx@warning@} {div.warning_} {sphinxwarning} -\spx@tempa{spx@caution@} {div.caution_} {sphinxcaution} -\spx@tempa{spx@attention@}{div.attention_} {sphinxattention} -\spx@tempa{spx@danger@} {div.danger_} {sphinxdanger} -\spx@tempa{spx@error@} {div.error_} {sphinxerror} -\spx@tempa{spx@box@} {box_} {sphinxbox} - % Keep legacy sphinxsetup color options interface for "strong" admonitions - \def\spx@tempa#1#2{% #1 = option prefix, #2 = legacy option prefix - \expandafter\let\csname KV@sphinx@#2BorderColor\expandafter\endcsname - \csname KV@sphinx@#1border-TeXcolor\endcsname - \expandafter\let\csname KV@sphinx@#2BgColor\expandafter\endcsname - \csname KV@sphinx@#1background-TeXcolor\endcsname - } - \spx@tempa{div.warning_} {warning} - \spx@tempa{div.caution_} {caution} - \spx@tempa{div.attention_} {attention} - \spx@tempa{div.danger_} {danger} - \spx@tempa{div.error_} {error} - - % Keep legacy sphinxsetup <type>BorderColor for <type>=note, hint, ... - % which will not trigger sphinxheavybox - % Add "legacy" hintTextColor etc... that will not trigger sphinxheavybox - \def\spx@tempa#1#2{% #1 = CSS like option prefix, #2 = legacy option prefix - \expandafter\let\csname KV@sphinx@#2BorderColor\expandafter\endcsname - \csname KV@sphinx@#1border-TeXcolor\endcsname - \expandafter\let\csname KV@sphinx@#2TextColor\expandafter\endcsname - \csname KV@sphinx@#1TeXcolor\endcsname - } - \spx@tempa{div.note_} {note} - \spx@tempa{div.hint_} {hint} - \spx@tempa{div.important_} {important} - \spx@tempa{div.tip_} {tip} - -% The TeXextras key -% -\def\spx@tempa#1{% #1 = macro prefix - \expandafter\spx@tempb\csname #1TeXextras\endcsname -} -\def\spx@tempb#1#2{% #2 = option prefix - \define@key{sphinx}{#2TeXextras}{\def#1{##1}}% -} -% macro prefix option prefix -\spx@tempa{spx@pre@} {pre_} -\spx@tempa{spx@topic@} {div.topic_} -\spx@tempa{spx@note@} {div.note_} -\spx@tempa{spx@hint@} {div.hint_} -\spx@tempa{spx@important@}{div.important_} -\spx@tempa{spx@tip@} {div.tip_} -\spx@tempa{spx@warning@} {div.warning_} -\spx@tempa{spx@caution@} {div.caution_} -\spx@tempa{spx@attention@}{div.attention_} -\spx@tempa{spx@danger@} {div.danger_} -\spx@tempa{spx@error@} {div.error_} -\spx@tempa{spx@box@} {box_} - % Add "legacy" hintTeXextras etc... that will not trigger sphinxheavybox - \def\spx@tempa#1#2{% #1 = CSS like option prefix, #2 = legacy option prefix - \expandafter\let\csname KV@sphinx@#2TeXextras\expandafter\endcsname - \csname KV@sphinx@#1TeXextras\endcsname - } - \spx@tempa{div.note_} {note} - \spx@tempa{div.hint_} {hint} - \spx@tempa{div.important_} {important} - \spx@tempa{div.tip_} {tip} - -% For note type admonitions, redefine all CSS-like named options to trigger -% the "heavybox" path. -% -% MEMO: the noteBorderColor and noteborder legacy options have already been -% re-created and they do not trigger the "heavybox" as their meaning will not -% be modified in the loop below contrarily to their CSS counterparts -% div.note_border-TeXcolor and div.note_border-width, and to the noteBgColor -% etc... which are handled below. -% -% This goes via rather hardcore TeX here. -\def\spx@tempa#1{\if\relax#1\expandafter\@gobble - \else - \toks@{##1}% - \expandafter\def\csname KV@sphinx@div.note_#1\expandafter\endcsname - \the\toks0\expandafter{% - \csname spx@opt@heavynotetrue\expandafter\expandafter\expandafter\endcsname - \csname KV@sphinx@div.note_#1\endcsname{##1}}% - \expandafter\def\csname KV@sphinx@div.hint_#1\expandafter\endcsname - \the\toks0\expandafter{% - \csname spx@opt@heavyhinttrue\expandafter\expandafter\expandafter\endcsname - \csname KV@sphinx@div.hint_#1\endcsname{##1}}% - \expandafter\def\csname KV@sphinx@div.important_#1\expandafter\endcsname - \the\toks0\expandafter{% - \csname spx@opt@heavyimportanttrue\expandafter\expandafter\expandafter\endcsname - \csname KV@sphinx@div.important_#1\endcsname{##1}}% - \expandafter\def\csname KV@sphinx@div.tip_#1\expandafter\endcsname - \the\toks0\expandafter{% - \csname spx@opt@heavytiptrue\expandafter\expandafter\expandafter\endcsname - \csname KV@sphinx@div.tip_#1\endcsname{##1}}% - \fi - \spx@tempa -} -\spx@tempa{border-width}% - {border-top-width}{border-right-width}{border-bottom-width}{border-left-width}% - {box-decoration-break}% - {padding}% - {padding-top}{padding-right}{padding-bottom}{padding-left}% - {border-radius}% - {border-top-left-radius}{border-top-right-radius}% - {border-bottom-right-radius}{border-bottom-left-radius}% - {box-shadow}% - {border-TeXcolor}{background-TeXcolor}{box-shadow-TeXcolor}{TeXcolor}% - {TeXextras}% -\relax - -% Now we add at 6.2.0 <type>BgColor et al. options which will trigger the -% "heavybox" as they are \let to the div.<type>_background-TeXColor option -% which has already been enhanced to set the boolean for rendering via -% "heavybox". This is in contrast with legacy <type>BorderColor, -% and with the new <type>TeXcolor and <type>TeXextras. - \def\spx@tempa#1#2{% #1 = CSS like option prefix, #2 = legacy style option prefix - \expandafter\let\csname KV@sphinx@#2BgColor\expandafter\endcsname - \csname KV@sphinx@#1background-TeXcolor\endcsname - } - \spx@tempa{div.note_} {note} - \spx@tempa{div.hint_} {hint} - \spx@tempa{div.important_} {important} - \spx@tempa{div.tip_} {tip} - -\newif\ifspx@opt@box@addstrut -\expandafter\def\csname KV@sphinx@box_addstrut\endcsname#1{% - \csname spx@opt@box@addstrut#1\endcsname -} -\expandafter\def\csname KV@sphinx@box_addstrut@default\endcsname{% - \spx@opt@box@addstruttrue -} - -\DeclareDefaultOption{\@unknownoptionerror} -\ProcessKeyvalOptions* -% don't allow use of maxlistdepth via \sphinxsetup. -\DisableKeyvalOption{sphinx}{maxlistdepth} -\DisableKeyvalOption{sphinx}{numfigreset} -\DisableKeyvalOption{sphinx}{nonumfigreset} -\DisableKeyvalOption{sphinx}{mathnumfig} -\DisableKeyvalOption{sphinx}{booktabs} -\DisableKeyvalOption{sphinx}{borderless} -\DisableKeyvalOption{sphinx}{rowcolors} -% FIXME: this is unrelated to an option, move this elsewhere -% To allow hyphenation of first word in narrow contexts; no option, -% customization to be done via 'preamble' key -\newcommand*\sphinxAtStartPar{\leavevmode\nobreak\hskip\z@skip} -% No need for the \hspace{0pt} trick (\hskip\z@skip) with luatex -\ifdefined\directlua\let\sphinxAtStartPar\@empty\fi -% user interface: options can be changed midway in a document! -\newcommand\sphinxsetup{\setkeys{sphinx}} - - -%% MISCELLANEOUS CONTEXT -% -% flag to be set in a framed environment -% (defined here as currently needed by three sphinxlatex....sty files and -% even if not needed if such files are replaced, the definition does no harm) -\newif\ifspx@inframed -% -% \spx@ifcaptionpackage (defined at begin document) -% is needed currently in macros from: -% sphinxlatexliterals.sty (sphinxVerbatim) -% sphinxlatextables.sty (for some macros used in the table templates) -% -% \sphinxcaption is mark-up injected by the tabular and tabulary templates -% it is defined in sphinxlatextables.sty -% -% store the original \caption macro for usage with figures inside longtable -% and tabulary cells. Make sure we get the final \caption in presence of -% caption package, whether the latter was loaded before or after sphinx. -\AtBeginDocument{% - \let\spx@originalcaption\caption - \@ifpackageloaded{caption} - {\let\spx@ifcaptionpackage\@firstoftwo - \caption@AtBeginDocument*{\let\spx@originalcaption\caption}% -% in presence of caption package, drop our own \sphinxcaption whose aim was to -% ensure same width of caption to all kinds of tables (tabular(y), longtable), -% because caption package has its own width (or margin) option - \def\sphinxcaption{\caption}% - }% - {\let\spx@ifcaptionpackage\@secondoftwo}% -} - -%% PASS OPTIONS -% -% pass options to hyperref; it must not have been loaded already -\input{sphinxoptionshyperref.sty} -% pass options to geometry; it must not have been loaded already -\input{sphinxoptionsgeometry.sty} - - -%% COLOR (general) -% -% FIXME: these two should be deprecated -% -% FIXME: \normalcolor should be used and \py@NormalColor never defined -\def\py@NormalColor{\color{black}} -% FIXME: \color{TitleColor} should be used directly and \py@TitleColor -% should never get defined. -\def\py@TitleColor{\color{TitleColor}} - - -%% PACKAGES -% -% as will be indicated below, secondary style files load some more packages -% -% For \text macro (sphinx.util.texescape) -% also for usage of \firstchoice@true(false) in sphinxlatexgraphics.sty -\RequirePackage{amstext} -% It was passed "warn" option from latex template in case it is already loaded -% via some other package before \usepackage{sphinx} in preamble -\RequirePackage{textcomp} -% For the H specifier. Do not \restylefloat{figure}, it breaks Sphinx code -% for allowing figures in tables. -\RequirePackage{float} -% For floating figures in the text. Better to load after float. -\RequirePackage{wrapfig} -% Provides \captionof, used once by latex writer (\captionof{figure}) -\RequirePackage{capt-of} -% Support hlist directive -\RequirePackage{multicol} - - -%% GRAPHICS -% -% It will always be needed, so let's load it here -\RequirePackage{graphicx} -\input{sphinxlatexgraphics.sty} - - -%% FRAMED ENVIRONMENTS -% -% \sphinxbox added at 6.2.0, its definition is in sphinxpackageboxes. -% -% Alias all \sphinxsetup "box_" keys to become \sphinxboxsetup no-prefix keys -\@tfor\x:={border-width}% - {border-top-width}{border-right-width}{border-bottom-width}{border-left-width}% - {box-decoration-break}% This one is actually useless, as \sphinxbox - % creates an unbreakable horizontal box, not a breakable vertical - % box. And as is well-known it is very complicated (not to say - % impossible) to create in LaTeX breakable horizontal boxes. No - % package offers them. See the complications for the support of - % verbatimforcewraps in sphinxlatexliterals.sty or see the source - % code of the soul or soulutf8 packages. - {padding}% - {padding-top}{padding-right}{padding-bottom}{padding-left}% - {border-radius}% - {border-top-left-radius}{border-top-right-radius}% - {border-bottom-right-radius}{border-bottom-left-radius}% - {box-shadow}% - {border-TeXcolor}{background-TeXcolor}{box-shadow-TeXcolor}{TeXcolor}% - {TeXextras}{addstrut}{addstrut@default}% -\do{\expandafter\let\csname KV@sphinxbox@\x\expandafter\endcsname - \csname KV@sphinx@box_\x\endcsname} -% Let \sphinxboxsetup also prepare a "reset", which will be used by nested -% boxes; currently and by laziness this is implemented simply by accumulating -% all passed options inside some storage, in the order they were given, rather -% than saving the box would-be parameters. Advantage is that this will not -% have to be modified if additional keys are added in future (e.g. for -% elliptic corners). Storing obeys TeX groups. (these details would be -% relevant only for some genuine independent LaTeX package and manual user -% authored mark-up, not Sphinx auto mark-up). -\newcommand\sphinxboxsetup[1]{% - \setkeys{sphinxbox}{#1}% - \expandafter\def\expandafter\spx@boxes@sphinxbox@defaults\expandafter - {\spx@boxes@sphinxbox@defaults,#1}% -} -\def\spx@boxes@sphinxbox@reset{% - \begingroup\def\x{\endgroup\setkeys{sphinxbox}}% - \expandafter\x\expandafter{\spx@boxes@sphinxbox@defaults}% -} -% Some of these defaults got already set. But we now list them all explicitly -% for a complete initial configuration of reset storage. -% -\let\spx@boxes@sphinxbox@defaults\@gobble -\sphinxboxsetup{% - border-width=\fboxrule,% <-not really needed to avoid EOL space - padding=\fboxsep,% but done here out of habit - border-radius=\fboxsep,% - box-shadow=none,% -% As xcolor is perhaps not loaded we can not use background-TeXcolor=VerbatimColor -% which would not be compatible with \definecolor syntax. - border-TeXcolor={RGB}{32,32,32},% the default VerbatimBorderColor - background-TeXcolor={gray}{0.95},% the default VerbatimColor - box-shadow-TeXcolor={rgb}{0,0,0},% - TeXextras={},% - addstrut=false% (a final comma here would not hurt) - }% -\RequirePackage{sphinxpackageboxes} -\input{sphinxlatexadmonitions.sty} -\input{sphinxlatexliterals.sty} -\input{sphinxlatexshadowbox.sty} - - -%% CONTAINERS -% -\input{sphinxlatexcontainers.sty} - - -%% PYGMENTS -% stylesheet for highlighting with pygments -\RequirePackage{sphinxhighlight} - - -%% TABLES -% -\input{sphinxlatextables.sty} - - -%% NUMBERING OF FIGURES, TABLES, AND LITERAL BLOCKS -% -\input{sphinxlatexnumfig.sty} - - -%% LISTS -% -\input{sphinxlatexlists.sty} - - -%% FOOTNOTES -% -% Support scopes for footnote numbering -% This is currently stepped at each input file -\newcounter{sphinxscope} -\newcommand{\sphinxstepscope}{\stepcounter{sphinxscope}} -% We ensure \thesphinxscope expands to digits tokens, independently of language -\renewcommand{\thesphinxscope}{\number\value{sphinxscope}} -\newcommand\sphinxthefootnotemark[2]{% - % this is used to make reference to an explicitly numbered footnote not on same page - % #1=label of footnote text, #2=page number where footnote text was printed - \ifdefined\pagename - \pagename\space#2, % <- space - \else - p. #2, % <- space - \fi #1% no space -} -% support large numbered footnotes in minipage; but this is now obsolete -% from systematic use of savenotes environment around minipages -\def\thempfootnote{\arabic{mpfootnote}} -% This package is needed to support hyperlinked footnotes in tables and -% framed contents, and to allow code-blocks in footnotes. -\RequirePackage{sphinxpackagefootnote} - - -%% INDEX, BIBLIOGRAPHY, APPENDIX, TABLE OF CONTENTS -% -\input{sphinxlatexindbibtoc.sty} - - -%% STYLING -% -\input{sphinxlatexstylepage.sty} -\input{sphinxlatexstyleheadings.sty} -\input{sphinxlatexstyletext.sty} - - -%% MODULE RELEASE DATA AND OBJECT DESCRIPTIONS -% -\input{sphinxlatexobjects.sty} - - -% FIXME: this line should be dropped, as "9" is default anyhow. -\ifdefined\pdfcompresslevel\pdfcompresslevel = 9 \fi - - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinx.xdy b/crypto/krb5/doc/pdf/sphinx.xdy deleted file mode 100644 index 0dcf1133cd7b..000000000000 --- a/crypto/krb5/doc/pdf/sphinx.xdy +++ /dev/null @@ -1,230 +0,0 @@ -;;; -*- mode: lisp; coding: utf-8; -*- - -;; Unfortunately xindy is out-of-the-box hyperref-incompatible. This -;; configuration is a workaround, which requires to pass option -;; hyperindex=false to hyperref. -;; textit and emph not currently used, spxpagem replaces former textbf -(define-attributes (("textbf" "textit" "emph" "spxpagem" "default"))) -(markup-locref :open "\textbf{\hyperpage{" :close "}}" :attr "textbf") -(markup-locref :open "\textit{\hyperpage{" :close "}}" :attr "textit") -(markup-locref :open "\emph{\hyperpage{" :close "}}" :attr "emph") -(markup-locref :open "\spxpagem{\hyperpage{" :close "}}" :attr "spxpagem") -(markup-locref :open "\hyperpage{" :close "}" :attr "default") - -(require "numeric-sort.xdy") - -;; xindy base module latex.xdy loads tex.xdy and the latter instructs -;; xindy to ignore **all** TeX macros in .idx entries, except those -;; explicitly described in merge rule. But when after applying all -;; merge rules an empty string results, xindy raises an error: - -;; ERROR: CHAR: index 0 should be less than the length of the string - -;; For example when using pdflatex with utf-8 characters the index -;; file will contain \IeC macros and they will get ignored except if -;; suitable merge rules are loaded early. The texindy script coming -;; with xindy provides this, but only for Latin scripts. The texindy -;; man page says to use rather xelatex or lualatex in case of Cyrillic -;; scripts. - -;; Sphinx contributes LICRcyr2utf8.xdy to provide support for Cyrillic -;; scripts for the pdflatex engine. - -;; Another issue caused by xindy ignoring all TeX macros except those -;; explicitly declared reveals itself when attempting to index ">>>", -;; as the ">" is converted to "\textgreater{}" by Sphinx's LaTeX -;; escaping. - -;; To fix this, Sphinx does **not** use texindy, and does not even -;; load the xindy latex.xdy base module. - -;(require "latex.xdy") - -;; Rather it incorporates some suitable extracts from latex.xdy and -;; tex.xdy with additional Sphinx contributed rules. - -;; But, this means for pdflatex and Latin scripts that the xindy file -;; tex/inputenc/uf8.xdy is not usable because it refers to the macro -;; \IeC only sporadically, and as tex.xdy is not loaded, a rule such as -;; (merge-rule "\'e" "é" :string) -;; does not work, it must be -;; (merge-rule "\IeC {\'e}" "é" :string) -;; So Sphinx contributes LICRlatin2utf8.xdy to mitigate that problem. - -;;;;;;;; extracts from tex.xdy (discarding most original comments): - -;;; -;;; TeX conventions -;;; - -;; Discard leading and trailing white space. Collapse multiple white -;; space characters to blank. - -(merge-rule "^ +" "" :eregexp) -(merge-rule " +$" "" :eregexp) -(merge-rule " +" " " :eregexp) - -;; Handle TeX markup - -(merge-rule "\\([{}$%&#])" "\1" :eregexp) - -;;;;;;;; end of extracts from xindy's tex.xdy - -;;;;;;;; extracts from latex.xdy: - -;; Standard location classes: arabic and roman numbers, and alphabets. - -(define-location-class "arabic-page-numbers" ("arabic-numbers")) -(define-location-class "roman-page-numbers" ("roman-numbers-lowercase")) -(define-location-class "Roman-page-numbers" ("roman-numbers-uppercase")) -(define-location-class "alpha-page-numbers" ("alpha")) -(define-location-class "Alpha-page-numbers" ("ALPHA")) - -;; Output Markup - -(markup-letter-group-list :sep "~n~n \indexspace~n") - -(markup-indexentry :open "~n \item " :depth 0) -(markup-indexentry :open "~n \subitem " :depth 1) -(markup-indexentry :open "~n \subsubitem " :depth 2) - -(markup-locclass-list :open ", " :sep ", ") -(markup-locref-list :sep ", ") - -;;;;;;;; end of extracts from latex.xdy - -;; The LaTeX \index command turns \ into normal character so the TeX macros -;; written to .idx files are not followed by a blank. This is different -;; from non-ascii letters which end up (with pdflatex) as \IeC macros in .idx -;; file, with a blank space after \IeC - -;; Details of the syntax are explained at -;; http://xindy.sourceforge.net/doc/manual-3.html -;; In absence of :string, "xindy uses an auto-detection mechanism to decide, -;; if the pattern is a regular expression or not". But it is not obvious to -;; guess, for example "\\_" is not detected as RE but "\\P\{\}" is, so for -;; being sure we apply the :string switch everywhere and do not use \\ etc... - -;; Go back from sphinx.util.texescape TeX macros to UTF-8 - -(merge-rule "\sphinxleftcurlybrace{}" "{" :string) -(merge-rule "\sphinxrightcurlybrace{}" "}" :string) -(merge-rule "\_" "_" :string) -(merge-rule "{[}" "[" :string) -(merge-rule "{]}" "]" :string) -(merge-rule "\textbackslash{}" "\" :string) ; " for Emacs syntax highlighting -(merge-rule "\textasciitilde{}" "~~" :string); the ~~ escape is needed here -(merge-rule "\textasciicircum{}" "^" :string) -(merge-rule "\sphinxhyphen{}" "-" :string) -(merge-rule "\textquotesingle{}" "'" :string) -(merge-rule "\textasciigrave{}" "`" :string) -(merge-rule "\textless{}" "<" :string) -(merge-rule "\textgreater{}" ">" :string) -(merge-rule "\P{}" "¶" :string) -(merge-rule "\S{}" "§" :string) -(merge-rule "\texteuro{}" "€" :string) -(merge-rule "\(\infty\)" "∞" :string) -(merge-rule "\(\pm\)" "±" :string) -(merge-rule "\(\rightarrow\)" "→" :string) -(merge-rule "\(\checkmark\)" "✓" :string) -(merge-rule "\textendash{}" "–" :string) -(merge-rule "\textbar{}" "|" :string) -(merge-rule "\(\sp{\text{0}}\)" "⁰" :string) -(merge-rule "\(\sp{\text{1}}\)" "¹" :string) -(merge-rule "\(\sp{\text{2}}\)" "²" :string) -(merge-rule "\(\sp{\text{3}}\)" "³" :string) -(merge-rule "\(\sp{\text{4}}\)" "⁴" :string) -(merge-rule "\(\sp{\text{5}}\)" "⁵" :string) -(merge-rule "\(\sp{\text{6}}\)" "⁶" :string) -(merge-rule "\(\sp{\text{7}}\)" "⁷" :string) -(merge-rule "\(\sp{\text{8}}\)" "⁸" :string) -(merge-rule "\(\sp{\text{9}}\)" "⁹" :string) -(merge-rule "\(\sb{\text{0}}\)" "₀" :string) -(merge-rule "\(\sb{\text{1}}\)" "₁" :string) -(merge-rule "\(\sb{\text{2}}\)" "₂" :string) -(merge-rule "\(\sb{\text{3}}\)" "₃" :string) -(merge-rule "\(\sb{\text{4}}\)" "₄" :string) -(merge-rule "\(\sb{\text{5}}\)" "₅" :string) -(merge-rule "\(\sb{\text{6}}\)" "₆" :string) -(merge-rule "\(\sb{\text{7}}\)" "₇" :string) -(merge-rule "\(\sb{\text{8}}\)" "₈" :string) -(merge-rule "\(\sb{\text{9}}\)" "₉" :string) -(merge-rule "\IeC {\textalpha }" "α" :string) -(merge-rule "\IeC {\textbeta }" "β" :string) -(merge-rule "\IeC {\textgamma }" "γ" :string) -(merge-rule "\IeC {\textdelta }" "δ" :string) -(merge-rule "\IeC {\textepsilon }" "ε" :string) -(merge-rule "\IeC {\textzeta }" "ζ" :string) -(merge-rule "\IeC {\texteta }" "η" :string) -(merge-rule "\IeC {\texttheta }" "θ" :string) -(merge-rule "\IeC {\textiota }" "ι" :string) -(merge-rule "\IeC {\textkappa }" "κ" :string) -(merge-rule "\IeC {\textlambda }" "λ" :string) -(merge-rule "\IeC {\textmu }" "μ" :string) -(merge-rule "\IeC {\textnu }" "ν" :string) -(merge-rule "\IeC {\textxi }" "ξ" :string) -(merge-rule "\IeC {\textomicron }" "ο" :string) -(merge-rule "\IeC {\textpi }" "π" :string) -(merge-rule "\IeC {\textrho }" "ρ" :string) -(merge-rule "\IeC {\textsigma }" "σ" :string) -(merge-rule "\IeC {\texttau }" "τ" :string) -(merge-rule "\IeC {\textupsilon }" "υ" :string) -(merge-rule "\IeC {\textphi }" "φ" :string) -(merge-rule "\IeC {\textchi }" "χ" :string) -(merge-rule "\IeC {\textpsi }" "ψ" :string) -(merge-rule "\IeC {\textomega }" "ω" :string) -(merge-rule "\IeC {\textAlpha }" "Α" :string) -(merge-rule "\IeC {\textBeta }" "Β" :string) -(merge-rule "\IeC {\textGamma }" "Γ" :string) -(merge-rule "\IeC {\textDelta }" "Δ" :string) -(merge-rule "\IeC {\textEpsilon }" "Ε" :string) -(merge-rule "\IeC {\textZeta }" "Ζ" :string) -(merge-rule "\IeC {\textEta }" "Η" :string) -(merge-rule "\IeC {\textTheta }" "Θ" :string) -(merge-rule "\IeC {\textIota }" "Ι" :string) -(merge-rule "\IeC {\textKappa }" "Κ" :string) -(merge-rule "\IeC {\textLambda }" "Λ" :string) -(merge-rule "\IeC {\textMu }" "Μ" :string) -(merge-rule "\IeC {\textNu }" "Ν" :string) -(merge-rule "\IeC {\textTheta }" "Θ" :string) -(merge-rule "\IeC {\textIota }" "Ι" :string) -(merge-rule "\IeC {\textKappa }" "Κ" :string) -(merge-rule "\IeC {\textLambda }" "Λ" :string) -(merge-rule "\IeC {\textMu }" "Μ" :string) -(merge-rule "\IeC {\textNu }" "Ν" :string) -(merge-rule "\IeC {\textXi }" "Ξ" :string) -(merge-rule "\IeC {\textOmicron }" "Ο" :string) -(merge-rule "\IeC {\textPi }" "Π" :string) -(merge-rule "\IeC {\textRho }" "Ρ" :string) -(merge-rule "\IeC {\textSigma }" "Σ" :string) -(merge-rule "\IeC {\textTau }" "Τ" :string) -(merge-rule "\IeC {\textUpsilon }" "Υ" :string) -(merge-rule "\IeC {\textPhi }" "Φ" :string) -(merge-rule "\IeC {\textChi }" "Χ" :string) -(merge-rule "\IeC {\textPsi }" "Ψ" :string) -(merge-rule "\IeC {\textOmega }" "Ω" :string) -(merge-rule "\IeC {\textohm }" "Ω" :string) - -;; This xindy module provides some basic support for "see" -(require "makeindex.xdy") - -;; This creates one-letter headings and works fine with utf-8 letters. -;; For Cyrillic with pdflatex works thanks to LICRcyr2utf8.xdy -(require "latin-lettergroups.xdy") - -;; currently we don't (know how to easily) separate "Numbers" from -;; "Symbols" with xindy as is the case with makeindex. -(markup-index :open "\begin{sphinxtheindex} -\let\lettergroup\sphinxstyleindexlettergroup -\let\lettergroupDefault\sphinxstyleindexlettergroupDefault -\let\spxpagem\sphinxstyleindexpagemain -\let\spxentry\sphinxstyleindexentry -\let\spxextra\sphinxstyleindexextra - -" - :close " - -\end{sphinxtheindex} -" - :tree) - diff --git a/crypto/krb5/doc/pdf/sphinxhighlight.sty b/crypto/krb5/doc/pdf/sphinxhighlight.sty deleted file mode 100644 index 170f55710ec5..000000000000 --- a/crypto/krb5/doc/pdf/sphinxhighlight.sty +++ /dev/null @@ -1,130 +0,0 @@ -\NeedsTeXFormat{LaTeX2e}[1995/12/01] -\ProvidesPackage{sphinxhighlight}[2022/06/30 stylesheet for highlighting with pygments] -% Its contents depend on pygments_style configuration variable. - - -\makeatletter -\def\PYG@reset{\let\PYG@it=\relax \let\PYG@bf=\relax% - \let\PYG@ul=\relax \let\PYG@tc=\relax% - \let\PYG@bc=\relax \let\PYG@ff=\relax} -\def\PYG@tok#1{\csname PYG@tok@#1\endcsname} -\def\PYG@toks#1+{\ifx\relax#1\empty\else% - \PYG@tok{#1}\expandafter\PYG@toks\fi} -\def\PYG@do#1{\PYG@bc{\PYG@tc{\PYG@ul{% - \PYG@it{\PYG@bf{\PYG@ff{#1}}}}}}} -\def\PYG#1#2{\PYG@reset\PYG@toks#1+\relax+\PYG@do{#2}} - -\@namedef{PYG@tok@w}{\def\PYG@tc##1{\textcolor[rgb]{0.73,0.73,0.73}{##1}}} -\@namedef{PYG@tok@c}{\let\PYG@it=\textit\def\PYG@tc##1{\textcolor[rgb]{0.25,0.50,0.56}{##1}}} -\@namedef{PYG@tok@cp}{\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@cs}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.50,0.56}{##1}}\def\PYG@bc##1{{\setlength{\fboxsep}{0pt}\colorbox[rgb]{1.00,0.94,0.94}{\strut ##1}}}} -\@namedef{PYG@tok@k}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@kp}{\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@kt}{\def\PYG@tc##1{\textcolor[rgb]{0.56,0.13,0.00}{##1}}} -\@namedef{PYG@tok@o}{\def\PYG@tc##1{\textcolor[rgb]{0.40,0.40,0.40}{##1}}} -\@namedef{PYG@tok@ow}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@nb}{\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@nf}{\def\PYG@tc##1{\textcolor[rgb]{0.02,0.16,0.49}{##1}}} -\@namedef{PYG@tok@nc}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.05,0.52,0.71}{##1}}} -\@namedef{PYG@tok@nn}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.05,0.52,0.71}{##1}}} -\@namedef{PYG@tok@ne}{\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@nv}{\def\PYG@tc##1{\textcolor[rgb]{0.73,0.38,0.84}{##1}}} -\@namedef{PYG@tok@no}{\def\PYG@tc##1{\textcolor[rgb]{0.38,0.68,0.84}{##1}}} -\@namedef{PYG@tok@nl}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.00,0.13,0.44}{##1}}} -\@namedef{PYG@tok@ni}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.84,0.33,0.22}{##1}}} -\@namedef{PYG@tok@na}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@nt}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.02,0.16,0.45}{##1}}} -\@namedef{PYG@tok@nd}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.33,0.33,0.33}{##1}}} -\@namedef{PYG@tok@s}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@sd}{\let\PYG@it=\textit\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@si}{\let\PYG@it=\textit\def\PYG@tc##1{\textcolor[rgb]{0.44,0.63,0.82}{##1}}} -\@namedef{PYG@tok@se}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@sr}{\def\PYG@tc##1{\textcolor[rgb]{0.14,0.33,0.53}{##1}}} -\@namedef{PYG@tok@ss}{\def\PYG@tc##1{\textcolor[rgb]{0.32,0.47,0.09}{##1}}} -\@namedef{PYG@tok@sx}{\def\PYG@tc##1{\textcolor[rgb]{0.78,0.36,0.04}{##1}}} -\@namedef{PYG@tok@m}{\def\PYG@tc##1{\textcolor[rgb]{0.13,0.50,0.31}{##1}}} -\@namedef{PYG@tok@gh}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.00,0.00,0.50}{##1}}} -\@namedef{PYG@tok@gu}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.50,0.00,0.50}{##1}}} -\@namedef{PYG@tok@gd}{\def\PYG@tc##1{\textcolor[rgb]{0.63,0.00,0.00}{##1}}} -\@namedef{PYG@tok@gi}{\def\PYG@tc##1{\textcolor[rgb]{0.00,0.63,0.00}{##1}}} -\@namedef{PYG@tok@gr}{\def\PYG@tc##1{\textcolor[rgb]{1.00,0.00,0.00}{##1}}} -\@namedef{PYG@tok@ge}{\let\PYG@it=\textit} -\@namedef{PYG@tok@gs}{\let\PYG@bf=\textbf} -\@namedef{PYG@tok@ges}{\let\PYG@bf=\textbf\let\PYG@it=\textit} -\@namedef{PYG@tok@gp}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.78,0.36,0.04}{##1}}} -\@namedef{PYG@tok@go}{\def\PYG@tc##1{\textcolor[rgb]{0.20,0.20,0.20}{##1}}} -\@namedef{PYG@tok@gt}{\def\PYG@tc##1{\textcolor[rgb]{0.00,0.27,0.87}{##1}}} -\@namedef{PYG@tok@err}{\def\PYG@bc##1{{\setlength{\fboxsep}{\string -\fboxrule}\fcolorbox[rgb]{1.00,0.00,0.00}{1,1,1}{\strut ##1}}}} -\@namedef{PYG@tok@kc}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@kd}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@kn}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@kr}{\let\PYG@bf=\textbf\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@bp}{\def\PYG@tc##1{\textcolor[rgb]{0.00,0.44,0.13}{##1}}} -\@namedef{PYG@tok@fm}{\def\PYG@tc##1{\textcolor[rgb]{0.02,0.16,0.49}{##1}}} -\@namedef{PYG@tok@vc}{\def\PYG@tc##1{\textcolor[rgb]{0.73,0.38,0.84}{##1}}} -\@namedef{PYG@tok@vg}{\def\PYG@tc##1{\textcolor[rgb]{0.73,0.38,0.84}{##1}}} -\@namedef{PYG@tok@vi}{\def\PYG@tc##1{\textcolor[rgb]{0.73,0.38,0.84}{##1}}} -\@namedef{PYG@tok@vm}{\def\PYG@tc##1{\textcolor[rgb]{0.73,0.38,0.84}{##1}}} -\@namedef{PYG@tok@sa}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@sb}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@sc}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@dl}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@s2}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@sh}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@s1}{\def\PYG@tc##1{\textcolor[rgb]{0.25,0.44,0.63}{##1}}} -\@namedef{PYG@tok@mb}{\def\PYG@tc##1{\textcolor[rgb]{0.13,0.50,0.31}{##1}}} -\@namedef{PYG@tok@mf}{\def\PYG@tc##1{\textcolor[rgb]{0.13,0.50,0.31}{##1}}} -\@namedef{PYG@tok@mh}{\def\PYG@tc##1{\textcolor[rgb]{0.13,0.50,0.31}{##1}}} -\@namedef{PYG@tok@mi}{\def\PYG@tc##1{\textcolor[rgb]{0.13,0.50,0.31}{##1}}} -\@namedef{PYG@tok@il}{\def\PYG@tc##1{\textcolor[rgb]{0.13,0.50,0.31}{##1}}} -\@namedef{PYG@tok@mo}{\def\PYG@tc##1{\textcolor[rgb]{0.13,0.50,0.31}{##1}}} -\@namedef{PYG@tok@ch}{\let\PYG@it=\textit\def\PYG@tc##1{\textcolor[rgb]{0.25,0.50,0.56}{##1}}} -\@namedef{PYG@tok@cm}{\let\PYG@it=\textit\def\PYG@tc##1{\textcolor[rgb]{0.25,0.50,0.56}{##1}}} -\@namedef{PYG@tok@cpf}{\let\PYG@it=\textit\def\PYG@tc##1{\textcolor[rgb]{0.25,0.50,0.56}{##1}}} -\@namedef{PYG@tok@c1}{\let\PYG@it=\textit\def\PYG@tc##1{\textcolor[rgb]{0.25,0.50,0.56}{##1}}} - -\def\PYGZbs{\char`\\} -\def\PYGZus{\char`\_} -\def\PYGZob{\char`\{} -\def\PYGZcb{\char`\}} -\def\PYGZca{\char`\^} -\def\PYGZam{\char`\&} -\def\PYGZlt{\char`\<} -\def\PYGZgt{\char`\>} -\def\PYGZsh{\char`\#} -\def\PYGZpc{\char`\%} -\def\PYGZdl{\char`\$} -\def\PYGZhy{\char`\-} -\def\PYGZsq{\char`\'} -\def\PYGZdq{\char`\"} -\def\PYGZti{\char`\~} -% for compatibility with earlier versions -\def\PYGZat{@} -\def\PYGZlb{[} -\def\PYGZrb{]} -\makeatother - -% Sphinx redefinitions -% Originally to obtain a straight single quote via package textcomp, then -% to fix problems for the 5.0.0 inline code highlighting (captions!). -% The \text is from amstext, a dependency of sphinx.sty. It is here only -% to avoid build errors if for some reason expansion is in math mode. -\def\PYGZbs{\text\textbackslash} -\def\PYGZus{\_} -\def\PYGZob{\{} -\def\PYGZcb{\}} -\def\PYGZca{\text\textasciicircum} -\def\PYGZam{\&} -\def\PYGZlt{\text\textless} -\def\PYGZgt{\text\textgreater} -\def\PYGZsh{\#} -\def\PYGZpc{\%} -\def\PYGZdl{\$} -\def\PYGZhy{\sphinxhyphen}% defined in sphinxlatexstyletext.sty -\def\PYGZsq{\text\textquotesingle} -\def\PYGZdq{"} -\def\PYGZti{\text\textasciitilde} -\makeatletter -% use \protected to allow syntax highlighting in captions -\protected\def\PYG#1#2{\PYG@reset\PYG@toks#1+\relax+{\PYG@do{#2}}} -\makeatother diff --git a/crypto/krb5/doc/pdf/sphinxhowto.cls b/crypto/krb5/doc/pdf/sphinxhowto.cls deleted file mode 100644 index 8d7dd0ee7185..000000000000 --- a/crypto/krb5/doc/pdf/sphinxhowto.cls +++ /dev/null @@ -1,102 +0,0 @@ -% -% sphinxhowto.cls for Sphinx (https://www.sphinx-doc.org/) -% - -\NeedsTeXFormat{LaTeX2e}[1995/12/01] -\ProvidesClass{sphinxhowto}[2019/12/01 v2.3.0 Document class (Sphinx howto)] - -% 'oneside' option overriding the 'twoside' default -\newif\if@oneside -\DeclareOption{oneside}{\@onesidetrue} -% Pass remaining document options to the parent class. -\DeclareOption*{\PassOptionsToClass{\CurrentOption}{\sphinxdocclass}} -\ProcessOptions\relax - -% Default to two-side document -\if@oneside -% nothing to do (oneside is the default) -\else -\PassOptionsToClass{twoside}{\sphinxdocclass} -\fi - -\LoadClass{\sphinxdocclass} - -% Set some sane defaults for section numbering depth and TOC depth. You can -% reset these counters in your preamble. -% -\setcounter{secnumdepth}{2} -\setcounter{tocdepth}{2}% i.e. section and subsection - -% Adapt \and command to the flushright context of \sphinxmaketitle, to -% avoid ragged line endings if author names do not fit all on one single line -\DeclareRobustCommand{\and}{% - \end{tabular}\kern-\tabcolsep - \allowbreak - \hskip\dimexpr1em+\tabcolsep\@plus.17fil\begin{tabular}[t]{c}% -}% -% If it is desired that each author name be on its own line, use in preamble: -%\DeclareRobustCommand{\and}{% -% \end{tabular}\kern-\tabcolsep\\\begin{tabular}[t]{c}% -%}% -% Change the title page to look a bit better, and fit in with the fncychap -% ``Bjarne'' style a bit better. -% -\newcommand{\sphinxmaketitle}{% - \noindent\rule{\linewidth}{1pt}\par - \begingroup % for PDF information dictionary - \def\endgraf{ }\def\and{\& }% - \pdfstringdefDisableCommands{\def\\{, }}% overwrite hyperref setup - \hypersetup{pdfauthor={\@author}, pdftitle={\@title}}% - \endgroup - \begin{flushright} - \sphinxlogo - \py@HeaderFamily - {\Huge \@title }\par - {\itshape\large \py@release \releaseinfo}\par - \vspace{25pt} - {\Large - \begin{tabular}[t]{c} - \@author - \end{tabular}\kern-\tabcolsep}\par - \vspace{25pt} - \@date \par - \py@authoraddress \par - \end{flushright} - \@thanks - \setcounter{footnote}{0} - \let\thanks\relax\let\maketitle\relax - %\gdef\@thanks{}\gdef\@author{}\gdef\@title{} -} - -\newcommand{\sphinxtableofcontents}{% - \begingroup - \parskip \z@skip - \sphinxtableofcontentshook - \tableofcontents - \endgroup - \noindent\rule{\linewidth}{1pt}\par - \vspace{12pt}% -} -\newcommand\sphinxtableofcontentshook{} -\pagenumbering{arabic} - -% Fix the bibliography environment to add an entry to the Table of -% Contents. -% For an article document class this environment is a section, -% so no page break before it. -% -\newenvironment{sphinxthebibliography}[1]{% - % \phantomsection % not needed here since TeXLive 2010's hyperref - \begin{thebibliography}{#1}% - \addcontentsline{toc}{section}{\ifdefined\refname\refname\else\ifdefined\bibname\bibname\fi\fi}}{\end{thebibliography}} - - -% Same for the indices. -% The memoir class already does this, so we don't duplicate it in that case. -% -\@ifclassloaded{memoir} - {\newenvironment{sphinxtheindex}{\begin{theindex}}{\end{theindex}}} - {\newenvironment{sphinxtheindex}{% - \phantomsection % needed because no chapter, section, ... is created by theindex - \begin{theindex}% - \addcontentsline{toc}{section}{\indexname}}{\end{theindex}}} diff --git a/crypto/krb5/doc/pdf/sphinxlatexadmonitions.sty b/crypto/krb5/doc/pdf/sphinxlatexadmonitions.sty deleted file mode 100644 index a31ae4ce3a2c..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexadmonitions.sty +++ /dev/null @@ -1,242 +0,0 @@ -%% NOTICES AND ADMONITIONS -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexadmonitions.sty}[2023/03/19 admonitions] - -% Provides support for this output mark-up from Sphinx latex writer: -% -% - sphinxseealso environment added at 6.1.0 -% -% - sphinxadmonition (environment) -% This is a dispatch supporting -% -% - note, hint, important, tip (via sphinxlightbox) -% (also optionally via sphinxheavybox since 6.2.0) -% - warning, caution, attention, danger, error (via sphinxheavybox) -% -% Each sphinx<notice name> environment can be redefined by user. -% The defaults are customizable via various colour and dimension -% settings, cf sphinx docs (latex customization). -% -% Requires: -\RequirePackage{sphinxpackageboxes} -\RequirePackage{framed}% used by sphinxheavybox -% -% Dependencies (they do not need to be defined at time of loading): -% -% - of course the various colour and dimension options handled via sphinx.sty -% -% - dimension register \spx@image@maxheight from sphinxlatexgraphics.sty -% -% - \savenotes/\spewnotes from sphinxpackagefootnote (for sphinxheavybox) -% -% - \sphinxstylenotetitle, ..., \sphinxstylewarningtitle, etc... which are used by -% default in the corresponding sphinx<notice> environments to replace at 6.2.0 -% formerly hard-coded \sphinxstrong{#1}<space> -% Their definitions are in sphinxlatexstyletext.sty. - - -% Provides: (also in sphinxlatexliterals.sty) -\providecommand*\sphinxvspacefixafterfrenchlists{% - \ifvmode\ifdim\lastskip<\z@ \vskip\parskip\fi\else\par\fi -} - -% Some are quite plain -\newenvironment{sphinxseealso}[1]{\sphinxstyleseealsotitle{#1}}{} - -% This \dimen register is a legacy relic from Sphinx 1.5 which is used now -% only for sphinxlightbox. It is set in the sphinxadmonition environment. -\newdimen\spx@notice@border - -\newenvironment{sphinxlightbox}{% - \par - \noindent{\color{spx@notice@bordercolor}% - \rule{\linewidth}{\spx@notice@border}}% - \par\nobreak - {\parskip\z@skip\noindent}% - } - {% - % counteract previous possible negative skip (French lists!): - % (we can't cancel that any earlier \vskip introduced a potential pagebreak) - \sphinxvspacefixafterfrenchlists - \nobreak\vbox{\noindent\kern\@totalleftmargin - {\color{spx@notice@bordercolor}% - \rule[\dimexpr.4\baselineskip-\spx@notice@border\relax] - {\linewidth}{\spx@notice@border}}\hss}\allowbreak - }% end of sphinxlightbox environment definition - -% note/hint/important/tip notices -% -% Since 1.5 these environments are named individually to allow user to -% redefine them entirely. -% -% The Sphinx definitions were done like this, prior to 6.2.0: -% -% \newenvironment{sphinxhint}[1] -% {\begin{sphinxlightbox}\sphinxstrong{#1} }{\end{sphinxlightbox}} -% -% The more complex definition below will branch to sphinxheavybox if a certain -% boolean associated to the notice type is true. This boolean is set to true -% whenever a CSS-named alike options for the notice type has been used in -% sphinxsetup. The old coding as above would still work, with the new options -% being then simply ignored. A user redefinition will probably either use -% directly sphinxlightbox or sphinxheavybox or something else, with no need to -% test the boolean. -% -% 6.2.0 also adds one layer of mark-up via \sphinxnotetitle etc..., because -% the former \sphinxstrong{#1}<space> used a too generic \sphinxstrong. But -% perhaps the #1 should be passed over to sphinx{light,heavy}box as parameter. -% Unfortunately replacing these environments with one-parameter environments -% would be potentially a breaking change. Anyway, sphinxpackageboxes.sty does not -% provide a "titled" box; the caption of code-blocks is handled by extra -% code in sphinxVerbatim. -\newenvironment{sphinxnote}[1] - {\edef\spx@env{sphinx\ifspx@opt@heavynote heavy\else light\fi box}% - \expandafter\begin\expandafter{\spx@env}\sphinxstylenotetitle{#1}} - {\expandafter\end\expandafter{\spx@env}} -\newenvironment{sphinxhint}[1] - {\edef\spx@env{sphinx\ifspx@opt@heavyhint heavy\else light\fi box}% - \expandafter\begin\expandafter{\spx@env}\sphinxstylehinttitle{#1}} - {\expandafter\end\expandafter{\spx@env}} -\newenvironment{sphinximportant}[1] - {\edef\spx@env{sphinx\ifspx@opt@heavyimportant heavy\else light\fi box}% - \expandafter\begin\expandafter{\spx@env}\sphinxstyleimportanttitle{#1}} - {\expandafter\end\expandafter{\spx@env}} -\newenvironment{sphinxtip}[1] - {\edef\spx@env{sphinx\ifspx@opt@heavytip heavy\else light\fi box}% - \expandafter\begin\expandafter{\spx@env}\sphinxstyletiptitle{#1}} - {\expandafter\end\expandafter{\spx@env}} - -% warning/caution/attention/danger/error get more distinction -% -% Code adapted from framed.sty's "snugshade" environment. -% Nesting works (inner frames do not allow page breaks). -\newenvironment{sphinxheavybox}{\par - % 6.2.0 allows to not have to distinguish here between warning type notices - % which always use sphinxheavybox or note type notices which might use it. - % (MEMO: it is not a problem here if there is no sphinx<type>ShadowColor, - % as it used only if set) - \spx@boxes@fcolorbox@setup{\spx@noticetype}% - % Those are used by sphinxVerbatim if the \ifspx@inframed boolean is true - \setlength{\FrameRule}{0.5\dimexpr\spx@boxes@border@top+\spx@boxes@border@bottom\relax}% - % MEMO: prior to 5.1.0 \FrameSep was determined as 0.6\baselineskip - - % \FrameRule, and there was no possibility for user to adjust padding. - % Then \fcolorbox was used with \fboxrule set to \FrameRule and \fboxsep - % set to \FrameSep. - % The 5.1.0 default calculation of padding parameters maintains PDF output - % identical to legacy behaviour, as long as padding is not set by user. - \setlength{\FrameSep}{0.5\dimexpr\spx@boxes@padding@top+\spx@boxes@padding@bottom\relax}% - % "setup" macro has prepared the \spx@boxes@... dimen registers - \advance\spx@image@maxheight - -\dimexpr\spx@boxes@border@top+\spx@boxes@border@bottom - +\spx@boxes@padding@top+\spx@boxes@padding@bottom - +\baselineskip\relax % will happen again if nested, needed indeed! - % MEMO: the next comment is before boxing was extended to allow padding and - % multiple border-widths, not to mention shadows... - % configure framed.sty's parameters to obtain same vertical spacing - % as for "light" boxes. We need for this to manually insert parskip glue and - % revert a skip done by framed before the frame. - \ltx@ifundefined{OuterFrameSep}{}{\OuterFrameSep\z@skip}% - \vspace{\FrameHeightAdjust} - % copied/adapted from framed.sty's snugshade - % but now using in place of \fcolorbox the Sphinx sophisticated own - \def\FrameCommand##1{% - \hskip\@totalleftmargin - % "setup" macro MUST have been called before - \spx@boxes@fcolorbox{##1}% - \hskip-\linewidth \hskip-\@totalleftmargin \hskip\columnwidth - }% - % 6.2.0 adds support for div.<notice type>_box-decoration-break=slice. - % (it is yet undecided if slice style should inhibit a bottom shadow) - \csname ifspx@\spx@noticetype @border@open\endcsname - \def\FirstFrameCommand - {\spx@boxes@fcolorbox@setup@openbottom\FrameCommand}% - \def\MidFrameCommand - {\spx@boxes@fcolorbox@setup@openboth \FrameCommand}% - \def\LastFrameCommand - {\spx@boxes@fcolorbox@setup@opentop \FrameCommand}% - \fi - \savenotes - % use a minipage if we are already inside a framed environment - \ifspx@inframed - \noindent\begin{minipage}{\linewidth} - \else - % handle case where notice is first thing in a list item (or is quoted) - \if@inlabel - \noindent\par\vspace{-\baselineskip} - \else - \vspace{\parskip} - \fi - \fi - \MakeFramed {\spx@inframedtrue - \advance\hsize-\width \@totalleftmargin\z@ \linewidth\hsize - % minipage initialization copied from LaTeX source code. - \@pboxswfalse - \let\@listdepth\@mplistdepth \@mplistdepth\z@ - \@minipagerestore - \@setminipage }% - \color@begingroup % workaround to an upstream framed.sty bug - } - {% - \par\unskip - \color@endgroup % matches the \color@begingroup - \@minipagefalse - \endMakeFramed - \ifspx@inframed\end{minipage}\fi - % set footnotes at bottom of page - \spewnotes - % arrange for similar spacing below frame as for "light" boxes. - \vskip .4\baselineskip - }% end of sphinxheavybox environment definition - -% - Since 1.5 these environments are named individually to allow user to -% redefine them entirely. -% -% - Since 5.1.0, sphinxheavybox is more versatile and four border widths, four -% padding widths, four corner radii, optional shadow, and three colors can all -% be modified via CSS-named alike options. -% -% - Since 6.2.0, also note/hint/important/tip notices can use these options -% and then they go automatically via sphinxheavybox. If only the legacy options -% are used, they keep using sphinxlightbox. -% -% - Since 6.2.0, \sphinxwarningtitle etc... add one level of mark-up (they -% expand to \sphinxstrong{#1}<space> which was former hard-coded mark-up). -% Example: -% \renewcommand{\sphinxwarningtitle}[1]{\textbf{#1}\par\smallskip -% {\color{sphinxwarningBorderColor}\hrule height1pt}\smallskip} -\newenvironment{sphinxwarning}[1] - {\begin{sphinxheavybox}\sphinxstylewarningtitle{#1}}{\end{sphinxheavybox}} -\newenvironment{sphinxcaution}[1] - {\begin{sphinxheavybox}\sphinxstylecautiontitle{#1}}{\end{sphinxheavybox}} -\newenvironment{sphinxattention}[1] - {\begin{sphinxheavybox}\sphinxstyleattentiontitle{#1}}{\end{sphinxheavybox}} -\newenvironment{sphinxdanger}[1] - {\begin{sphinxheavybox}\sphinxstyledangertitle{#1}}{\end{sphinxheavybox}} -\newenvironment{sphinxerror}[1] - {\begin{sphinxheavybox}\sphinxstyleerrortitle{#1}}{\end{sphinxheavybox}} - -% the main dispatch for all types of notices -\newenvironment{sphinxadmonition}[2]{% #1=type, #2=heading - % can't use #1 directly in definition of end part - \def\spx@noticetype {#1}% - % those next three are a remnant of legacy code; they are not used at - % all by sphinxheavybox, and their usage could be disposed of by sphinxlightbox - % but we keep for backward compatibility and also because it may be simpler - % for user redefinitions to employ for example "spx@notice@bgcolor" and not - % the more bulky "sphinx\spx@noticetype BgColor". - \sphinxcolorlet{spx@notice@bordercolor}{sphinx#1BorderColor}% - \sphinxcolorlet{spx@notice@bgcolor}{sphinx#1BgColor}% - \spx@notice@border \dimexpr\csname spx@#1@border\endcsname\relax - % trigger the sphinx<type> environment, #2=heading is passed as argument - \begin{sphinx#1}{#2}% - % 6.2.0 support of div.<type>_TeX{color,extras} options - \csname ifspx@\spx@noticetype @withtextcolor\endcsname - \color{sphinx\spx@noticetype TextColor}% - \fi - \csname spx@\spx@noticetype @TeXextras\endcsname - } - % workaround some LaTeX "feature" of \end command (can't use "sphinx#1" here) - {\edef\spx@temp{\noexpand\end{sphinx\spx@noticetype}}\spx@temp} - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexcontainers.sty b/crypto/krb5/doc/pdf/sphinxlatexcontainers.sty deleted file mode 100644 index 93b2c8c086a5..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexcontainers.sty +++ /dev/null @@ -1,22 +0,0 @@ -%% CONTAINER DIRECTIVES -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexcontainers.sty}[2021/05/03 containers] - -% The purpose of this file is to provide a dummy environment sphinxclass which -% will be inserted for each class in each container directive. The class name -% will be passed as the argument to the environment. -% -% For a class foo, the user can define customised handling of that class by -% defining the sphinxclassfoo LaTeX environment. - -\newenvironment{sphinxuseclass}[1]{% - \def\sphinxClassFunctionName{sphinxclass#1}% - \ltx@ifundefined{\sphinxClassFunctionName}% - {}% undefined so do nothing - {\expandafter\begin\expandafter{\sphinxClassFunctionName}}% -}{% - \ltx@ifundefined{\sphinxClassFunctionName}% - {}% we did nothing so we keep doing nothing - {\expandafter\end\expandafter{\sphinxClassFunctionName}}% -}% diff --git a/crypto/krb5/doc/pdf/sphinxlatexgraphics.sty b/crypto/krb5/doc/pdf/sphinxlatexgraphics.sty deleted file mode 100644 index fd0aae6386ad..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexgraphics.sty +++ /dev/null @@ -1,122 +0,0 @@ -%% GRAPHICS -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexgraphics.sty}[2021/01/27 graphics] - -% Provides support for this output mark-up from Sphinx latex writer: -% -% - macros: -% -% - \sphinxfigcaption -% - \sphinxincludegraphics -% -% - environments: -% -% - sphinxfigure-in-table -% -% May change: -% -% - \sphinxcaption (at begin document) -% -% Also provides: -% -% - \sphinxsafeincludegraphics (default of \sphinxincludegraphics since 2.0) -% - \spx@image@maxheight dimension (used by sphinxlatexadmonitions.sty) -% - \spx@image@box scratch box register (also used by sphinxlatexliterals.sty) -% -% Requires: -% \RequirePackage{graphicx}% done in sphinx.sty -\RequirePackage{amstext}% needed for \firstchoice@true(false) - -% \sphinxincludegraphics resizes images larger than the TeX \linewidth (which -% is adjusted in indented environments), or taller than a certain maximal -% height (usually \textheight and this is reduced in the environments which use -% framed.sty to avoid infinite loop if image too tall). -% -% In case height or width options are present the rescaling is done -% (since 2.0), in a way keeping the width:height ratio either native from -% image or from the width and height options if both were present. -% -\newdimen\spx@image@maxheight -\AtBeginDocument{\spx@image@maxheight\textheight} - -% box scratch register -\newbox\spx@image@box -\newcommand*{\sphinxsafeincludegraphics}[2][]{% - % #1 contains possibly width=, height=, but no scale= since 1.8.4 - \setbox\spx@image@box\hbox{\includegraphics[#1,draft]{#2}}% - \in@false % use some handy boolean flag - \ifdim \wd\spx@image@box>\linewidth - \in@true % flag to remember to adjust options and set box dimensions - % compute height which results from rescaling width to \linewidth - % and keep current aspect ratio. multiply-divide in \numexpr uses - % temporarily doubled precision, hence no overflow. (of course we - % assume \ht is not a few sp's below \maxdimen...(about 16384pt). - \edef\spx@image@rescaledheight % with sp units - {\the\numexpr\ht\spx@image@box - *\linewidth/\wd\spx@image@box sp}% - \ifdim\spx@image@rescaledheight>\spx@image@maxheight - % the rescaled height will be too big, so it is height which decides - % the rescaling factor - \def\spx@image@requiredheight{\spx@image@maxheight}% dimen register - \edef\spx@image@requiredwidth % with sp units - {\the\numexpr\wd\spx@image@box - *\spx@image@maxheight/\ht\spx@image@box sp}% - % TODO: decide if this commented-out block could be needed due to - % rounding in numexpr operations going up - % \ifdim\spx@image@requiredwidth>\linewidth - % \def\spx@image@requiredwidth{\linewidth}% dimen register - % \fi - \else - \def\spx@image@requiredwidth{\linewidth}% dimen register - \let\spx@image@requiredheight\spx@image@rescaledheight% sp units - \fi - \else - % width is ok, let's check height - \ifdim\ht\spx@image@box>\spx@image@maxheight - \in@true - \edef\spx@image@requiredwidth % with sp units - {\the\numexpr\wd\spx@image@box - *\spx@image@maxheight/\ht\spx@image@box sp}% - \def\spx@image@requiredheight{\spx@image@maxheight}% dimen register - \fi - \fi % end of check of width and height - \ifin@ - \setbox\spx@image@box - \hbox{\includegraphics - [%#1,% contained only width and/or height and overruled anyhow - width=\spx@image@requiredwidth,height=\spx@image@requiredheight]% - {#2}}% - % \includegraphics does not set box dimensions to the exactly - % requested ones, see https://github.com/latex3/latex2e/issues/112 - \wd\spx@image@box\spx@image@requiredwidth - \ht\spx@image@box\spx@image@requiredheight - \leavevmode\box\spx@image@box - \else - % here we do not modify the options, no need to adjust width and height - % on output, they will be computed exactly as with "draft" option - \setbox\spx@image@box\box\voidb@x % clear memory - \includegraphics[#1]{#2}% - \fi -}% -% Use the "safe" one by default (2.0) -\def\sphinxincludegraphics{\sphinxsafeincludegraphics} - - -%% FIGURE IN TABLE -% -\newenvironment{sphinxfigure-in-table}[1][\linewidth]{% - \def\@captype{figure}% - \sphinxsetvskipsforfigintablecaption - \begin{minipage}{#1}% -}{\end{minipage}} -% tabulary expands twice contents, we need to prevent double counter stepping -\newcommand*\sphinxfigcaption - {\ifx\equation$%$% this is trick to identify tabulary first pass - \firstchoice@false\else\firstchoice@true\fi - \spx@originalcaption } -\newcommand*\sphinxsetvskipsforfigintablecaption - {\abovecaptionskip\smallskipamount - \belowcaptionskip\smallskipamount} - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexindbibtoc.sty b/crypto/krb5/doc/pdf/sphinxlatexindbibtoc.sty deleted file mode 100644 index 79e30a1f1999..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexindbibtoc.sty +++ /dev/null @@ -1,69 +0,0 @@ -%% INDEX, BIBLIOGRAPHY, APPENDIX, TABLE OF CONTENTS -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexindbibtoc.sty}[2021/01/27 index, bib., toc] - -% Provides support for this output mark-up from Sphinx latex writer: -% -% - environments: (backup defaults or get redefined) -% -% - sphinxtheindex (direct mark-up or via python.ist or sphinx.xdy) -% - sphinxthebibliography -% -% - macros: (defines defaults) -% -% - \sphinxmaketitle -% - \sphinxtableofcontents -% - \sphinxnonalphabeticalgroupname -% - \sphinxsymbolsname -% - \sphinxnumbersname -% - \sphinxcite -% -% Requires: -\RequirePackage{makeidx} - -% fix the double index and bibliography on the table of contents -% in jsclasses (Japanese standard document classes) -\ifx\@jsc@uplatextrue\@undefined\else - \renewenvironment{sphinxtheindex} - {\cleardoublepage\phantomsection - \begin{theindex}} - {\end{theindex}} - - \renewenvironment{sphinxthebibliography}[1] - {\cleardoublepage% \phantomsection % not needed here since TeXLive 2010's hyperref - \begin{thebibliography}{#1}} - {\end{thebibliography}} -\fi - -% disable \@chappos in Appendix in pTeX -\ifx\kanjiskip\@undefined\else - \let\py@OldAppendix=\appendix - \renewcommand{\appendix}{ - \py@OldAppendix - \gdef\@chappos{} - } -\fi - -% make commands known to non-Sphinx document classes -\providecommand*{\sphinxmaketitle}{\maketitle} -\providecommand*{\sphinxtableofcontents}{\tableofcontents} -\ltx@ifundefined{sphinxthebibliography} - {\newenvironment - {sphinxthebibliography}{\begin{thebibliography}}{\end{thebibliography}}% - } - {}% else clause of \ltx@ifundefined -\ltx@ifundefined{sphinxtheindex} - {\newenvironment{sphinxtheindex}{\begin{theindex}}{\end{theindex}}}% - {}% else clause of \ltx@ifundefined - -% for usage with xindy: this string gets internationalized in preamble -\newcommand*{\sphinxnonalphabeticalgroupname}{} -% redefined in preamble, headings for makeindex produced index -\newcommand*{\sphinxsymbolsname}{} -\newcommand*{\sphinxnumbersname}{} - -\protected\def\sphinxcite{\cite} - - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexlists.sty b/crypto/krb5/doc/pdf/sphinxlatexlists.sty deleted file mode 100644 index 8e793555684a..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexlists.sty +++ /dev/null @@ -1,131 +0,0 @@ -%% ALPHANUMERIC LIST ITEMS -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexlists.sty}[2021/12/20 lists] - -% Provides support for this output mark-up from Sphinx latex writer: -% - \sphinxsetlistlabels -% - \sphinxlineitem -% and for the maxlistdepth key of sphinxsetup -% Dependencies: the \spx@opt@maxlistdepth from sphinx.sty - -% We need some helpers macros -\newtoks\spx@lineitemlabel -\long\def\sphinx@gobto@sphinxlineitem#1\sphinxlineitem{} -% TeX/LaTeX has no (easy to use) built-in "peek-ahead" mechanism, but -% we would like to know if next token is another \sphinxlineitem (this -% can happen in glossary entries with multiple terms for same definition) -% so we simply grab next token (assuming it is not {tokens} originally) -\newcommand\sphinxlineitem[2]{% - % safe test of whether #2 is \sphinxlineitem - \sphinx@gobto@sphinxlineitem#2\@gobbletwo\sphinxlineitem\unless - \iftrue - % case with sphinxlineitem immediately followed by another \sphinxlineitem: - % accumulate successive terms until actual definition or sub-list is found - \spx@lineitemlabel\expandafter{\the\spx@lineitemlabel\strut#1\\}% - \else - % now issue the \item command with possibly multi-line contents - % these weird incantations with \kern are related to how LaTeX - % handles \item generally - \item[\kern\labelwidth\kern-\itemindent\kern-\leftmargin - {\parbox[t]{\dimexpr\linewidth+\leftmargin\relax}{% - \raggedright - \the\spx@lineitemlabel% accumulated terms before this one, CR separated - \strut#1}}% due to LaTeX internals no \par token allowed here, - % but the \parbox will insert one tacitly at end - \kern-\labelsep]% - \spx@lineitemlabel{}% - % this causes the label to be typeset (filling up the line), clearing up - % things in case a nested list follows. - \leavevmode - \fi #2% -}% - - -\newcommand\sphinxsetlistlabels[5] -{% #1 = style, #2 = enum, #3 = enumnext, #4 = prefix, #5 = suffix - % #2 and #3 are counters used by enumerate environment e.g. enumi, enumii. - % #1 is a macro such as \arabic or \alph - % prefix and suffix are strings (by default empty and a dot). - \@namedef{the#2}{#1{#2}}% - \@namedef{label#2}{#4\@nameuse{the#2}#5}% - \@namedef{p@#3}{\@nameuse{p@#2}#4\@nameuse{the#2}#5}% -}% - - -%% MAXLISTDEPTH -% -% remove LaTeX's cap on nesting depth if 'maxlistdepth' key used. -% This is a hack, which works with the standard classes: it assumes \@toodeep -% is always used in "true" branches: "\if ... \@toodeep \else .. \fi." - -% will force use the "false" branch (if there is one) -\def\spx@toodeep@hack{\fi\iffalse} - -% do nothing if 'maxlistdepth' key not used or if package enumitem loaded. -\ifnum\spx@opt@maxlistdepth=\z@\expandafter\@gobbletwo\fi -\AtBeginDocument{% -\@ifpackageloaded{enumitem}{\remove@to@nnil}{}% - \let\spx@toodeepORI\@toodeep - \def\@toodeep{% - \ifnum\@listdepth<\spx@opt@maxlistdepth\relax - \expandafter\spx@toodeep@hack - \else - \expandafter\spx@toodeepORI - \fi}% -% define all missing \@list... macros - \count@\@ne - \loop - \ltx@ifundefined{@list\romannumeral\the\count@} - {\iffalse}{\iftrue\advance\count@\@ne}% - \repeat - \loop - \ifnum\count@>\spx@opt@maxlistdepth\relax\else - \expandafter\let - \csname @list\romannumeral\the\count@\expandafter\endcsname - \csname @list\romannumeral\the\numexpr\count@-\@ne\endcsname - % workaround 2.6--3.2d babel-french issue (fixed in 3.2e; no change needed) - \ltx@ifundefined{leftmargin\romannumeral\the\count@} - {\expandafter\let - \csname leftmargin\romannumeral\the\count@\expandafter\endcsname - \csname leftmargin\romannumeral\the\numexpr\count@-\@ne\endcsname}{}% - \advance\count@\@ne - \repeat -% define all missing enum... counters and \labelenum... macros and \p@enum.. - \count@\@ne - \loop - \ltx@ifundefined{c@enum\romannumeral\the\count@} - {\iffalse}{\iftrue\advance\count@\@ne}% - \repeat - \loop - \ifnum\count@>\spx@opt@maxlistdepth\relax\else - \newcounter{enum\romannumeral\the\count@}% - \expandafter\def - \csname labelenum\romannumeral\the\count@\expandafter\endcsname - \expandafter - {\csname theenum\romannumeral\the\numexpr\count@\endcsname.}% - \expandafter\def - \csname p@enum\romannumeral\the\count@\expandafter\endcsname - \expandafter - {\csname p@enum\romannumeral\the\numexpr\count@-\@ne\expandafter - \endcsname\csname theenum\romannumeral\the\numexpr\count@-\@ne\endcsname.}% - \advance\count@\@ne - \repeat -% define all missing labelitem... macros - \count@\@ne - \loop - \ltx@ifundefined{labelitem\romannumeral\the\count@} - {\iffalse}{\iftrue\advance\count@\@ne}% - \repeat - \loop - \ifnum\count@>\spx@opt@maxlistdepth\relax\else - \expandafter\let - \csname labelitem\romannumeral\the\count@\expandafter\endcsname - \csname labelitem\romannumeral\the\numexpr\count@-\@ne\endcsname - \advance\count@\@ne - \repeat - \PackageInfo{sphinx}{maximal list depth extended to \spx@opt@maxlistdepth}% -\@gobble\@nnil -} - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexliterals.sty b/crypto/krb5/doc/pdf/sphinxlatexliterals.sty deleted file mode 100644 index 3a73a76619e3..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexliterals.sty +++ /dev/null @@ -1,1004 +0,0 @@ -%% LITERAL BLOCKS -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexliterals.sty}[2023/04/01 code-blocks and parsed literals] - -% Provides support for this output mark-up from Sphinx latex writer: -% -% - macros: -% - \sphinxLiteralBlockLabel -% - \sphinxSetupCaptionForVerbatim -% - \sphinxSetupCodeBlockInFootnote -% - \sphinxhref -% - \sphinxnolinkurl -% - \sphinxresetverbatimhllines -% - \sphinxunactivateextrasandspace -% - \sphinxupquote -% - \sphinxurl -% -% - environments: -% - sphinxVerbatim -% - sphinxVerbatimintable -% - sphinxalltt -% -% Dependency: -% -% - hyperref (for \phantomsection and \capstart) (loaded later) -% -% Executes \RequirePackage for: -% -% - framed -% - fancyvrb -% - alltt -% - upquote -% - needspace -% - sphinxpackageboxes -\RequirePackage{sphinxpackageboxes} - -% also in sphinxlatexadmonitions.sty: -% This is a workaround to a "feature" of French lists, when literal block -% follows immediately; usable generally (does only \par then), a priori... -\providecommand*\sphinxvspacefixafterfrenchlists{% - \ifvmode\ifdim\lastskip<\z@ \vskip\parskip\fi\else\par\fi -} - -% For framing allowing pagebreaks -\RequirePackage{framed} -% For source code -% MEMO: fancyvrb is used mainly to -% 1- control horizontal and vertical spacing -% 2- optional line numbering -% 3- optional line emphasizing -% 4- while still allowing expansion of Pygments latex mark-up -% Other aspects such as framing, caption handling, codeline wrapping are -% added on top of it. We should stop using fancyvrb and implement -% 1, 2, 3, 4 by own Sphinx fully native Verbatim. This would greatly simplify -% in particular wrapping long code lines in a way allowing page breaks. -\RequirePackage{fancyvrb} -% For parsed-literal blocks. -\RequirePackage{alltt} -% Display "real" single quotes in literal blocks. -\RequirePackage{upquote} -% Skip to next page if not enough space at bottom -\RequirePackage{needspace} - -% Based on use of "fancyvrb.sty"'s Verbatim. -% - with framing allowing page breaks ("framed.sty") -% - with breaking of long lines (exploits Pygments mark-up), -% - with possibly of a top caption, non-separable by pagebreak. -% - and usable inside tables or footnotes ("sphinxpackagefootnote.sty"). - -% for emphasizing lines -\define@key{FV}{hllines}{\def\sphinx@verbatim@checkifhl##1{\in@{, ##1,}{#1}}} -% sphinxVerbatim must be usable by third party without requiring hllines set-up -\def\sphinxresetverbatimhllines{\def\sphinx@verbatim@checkifhl##1{\in@false}} -\sphinxresetverbatimhllines - -% Prior to Sphinx 1.5, \Verbatim and \endVerbatim were modified by Sphinx. -% The aliases defined here are used in sphinxVerbatim environment and can -% serve as hook-points with no need to modify \Verbatim itself. -\let\OriginalVerbatim \Verbatim -\let\endOriginalVerbatim\endVerbatim - -% for captions of literal blocks -% at start of caption title -\newcommand*{\fnum@literalblock}{\literalblockname\nobreakspace\theliteralblock} -% this will be overwritten in document preamble by Babel translation -\newcommand*{\literalblockname}{Listing } -% file extension needed for \caption's good functioning, the file is created -% only if a \listof{literalblock}{foo} command is encountered, which is -% analogous to \listoffigures, but for the code listings (foo = chosen title.) -\newcommand*{\ext@literalblock}{lol} - -% if forced use of minipage encapsulation is needed (e.g. table cells) -\newif\ifsphinxverbatimwithminipage \sphinxverbatimwithminipagefalse - -% Framing macro for use with framed.sty's \FrameCommand -% MEMO: the sophisticated code in \spx@fcolorbox/\spx@CustomFBox -% is here for good reasons -% - be responsive to indented list environments in the manner of -% the "framed" (\fbox) and "shaded" (\colorbox) environments of -% framed.sty; indeed code here is an evolution related to \fcolorbox -% - attach non-detachable continuation hints above/below frame -% - draw the frame and fill the background color in a manner avoiding -% problems in some pdf viewers -% - do background coloring differently from color.sty/xcolor.sty macros -% (even core internal ones) to work around issues at page breaks -% as the framed contents are split into chunks with possibly unpaired -% "color push" or "color pop" -% About the produced output: -% - it obeys current indentation, -% - frame with 4 padding parameters and 4 border-width parameters -% - the contents use the full available text width, limited by indentation, -% - #1 = will be typeset above frame, in a non detachable way, -% - #2 = will be typeset below frame, in a non detachable way, -% - #3 = will be typeset within the frame. -% #1 and #2 are expected to be already typeset \hbox'es. -% #3 are the contents, and in the context of usage of fancyvrb+framed, -% it will arrive here already transformed into horizontal boxes, -% interline penalties and glues. -% -\long\def\spx@verb@FrameCommand #1#2#3{% - % The \spx@verb@boxes@fcolorbox@setup MUST have been executed beforehand. - % These \hskips are for fancyvrb.sty measuring and will make the - % framing "adapt" to an indented context. - \hskip\@totalleftmargin - \hskip-\spx@boxes@border@left\hskip-\spx@boxes@padding@left - \spx@verb@fcolorbox {#1}{#2}{#3}% - \hskip-\spx@boxes@padding@right\hskip-\spx@boxes@border@right - \hskip-\linewidth \hskip-\@totalleftmargin \hskip\columnwidth -}% -\long\def\spx@verb@fcolorbox #1#2#3{% - % The \spx@verb@boxes@fcolorbox@setup MUST have been executed beforehand. -% - % MEMO: in the context of framed.sty this will always expand inside some - % \hbox isolated from other code, so we can use \box\z@, \box\tw@,... - % with no need of extra group. -% - % MEMO: this code was originally using \color@b@x but the latter has - % problematic features regarding color in a context like here where #3 - % may contain an unbalanced "color push". -% - \setbox\z@\hbox{#3}% - \edef\spx@verb@fcolorbox@width@sp - {\number\dimexpr\wd\z@+\spx@boxes@border@left - +\spx@boxes@padding@left - +\spx@boxes@padding@right - +\spx@boxes@border@right\relax sp}% - \vbox{#1% continuation hint attached above frame, uses \spx@verb@fcolorbox@width@sp - % the boxes@fcolorbox constructs an \hbox with bbox containing the border - % \spx@verb@boxes@fcolorbox@setup MUST have been executed beforehand. - \spx@boxes@fcolorbox{\box\z@}% - % This \nointerlineskip to maintain legacy spacing when a \hrule was - % formerly last prior item in vertical list. TODO: remove this at 6.0.0 ? - \nointerlineskip - #2% continuation hint attached below frame, uses \spx@verb@fcolorbox@width@sp - }% end of \vbox -}% -\def\spx@verb@fcolorbox@put@c#1{% hide width from framed.sty measuring - \moveright.5\dimexpr\spx@verb@fcolorbox@width@sp\hb@xt@\z@{\hss#1\hss}% -}% -\def\spx@verb@fcolorbox@put@r#1{% right align with contents, width hidden - \moveright\dimexpr\spx@verb@fcolorbox@width@sp-% - \spx@boxes@padding@right-% - \spx@boxes@border@right\hb@xt@\z@{\hss#1}% -}% -\def\spx@verb@fcolorbox@put@l#1{% left align with contents, width hidden - \moveright\dimexpr\spx@boxes@border@left+% - \spx@boxes@padding@left\hb@xt@\z@{#1\hss}% -}% -% -\def\sphinxVerbatim@Continued{% - \csname spx@verb@fcolorbox@put@\spx@opt@verbatimcontinuedalign\endcsname - {{\normalcolor\sphinxstylecodecontinued\literalblockcontinuedname}}% -}% -\def\sphinxVerbatim@Continues{% - \csname spx@verb@fcolorbox@put@\spx@opt@verbatimcontinuesalign\endcsname - {{\normalcolor\sphinxstylecodecontinues\literalblockcontinuesname}}% -}% -\def\sphinxVerbatim@Title{% - \spx@verb@fcolorbox@put@c{\unhcopy\sphinxVerbatim@TitleBox}% -}% -\let\sphinxVerbatim@Before\@empty -\let\sphinxVerbatim@After\@empty -% Defaults are redefined in document preamble according to language -\newcommand*\literalblockcontinuedname{continued from previous page}% -\newcommand*\literalblockcontinuesname{continues on next page}% -% -\def\sphinxVerbatim@FrameCommand{% - \spx@verb@FrameCommand\sphinxVerbatim@Before\sphinxVerbatim@After -}% -\def\sphinxVerbatim@FirstFrameCommand{% - \ifspx@pre@border@open - \spx@boxes@fcolorbox@setup@openbottom - \fi - \spx@verb@FrameCommand\sphinxVerbatim@Before\sphinxVerbatim@Continues -}% -\def\sphinxVerbatim@MidFrameCommand{% - \ifspx@pre@border@open - \spx@boxes@fcolorbox@setup@openboth - \fi - \spx@verb@FrameCommand\sphinxVerbatim@Continued\sphinxVerbatim@Continues -}% -\def\sphinxVerbatim@LastFrameCommand{% - \ifspx@pre@border@open - \spx@boxes@fcolorbox@setup@opentop - \fi - \spx@verb@FrameCommand\sphinxVerbatim@Continued\sphinxVerbatim@After -}% -% -\def\spx@verb@boxes@fcolorbox@setup{% - % Prepares usage of \spx@boxes@fcolorbox - % Extras to remap legacy color names VerbatimBorderColor and VerbatimColor - % to a common naming scheme with admonitions (and topic directive), as - % expected by \spx@boxes@fcolorbox@setup from sphinxpackageboxes.sty. - \sphinxcolorlet{sphinxpreBorderColor}{VerbatimBorderColor}% - \sphinxcolorlet{sphinxpreBgColor}{VerbatimColor}% - % This VerbatimShadowColor is not a legacy name nor user documented but is - % an outcome of sphinx.sty batch definitions for CSS option support. - \sphinxcolorlet{sphinxpreShadowColor}{VerbatimShadowColor}% - \spx@boxes@fcolorbox@setup{pre}% - \ifspx@opt@verbatimwithframe - \else - \spx@boxes@border@top\z@ - \spx@boxes@border@right\z@ - \spx@boxes@border@bottom\z@ - \spx@boxes@border@left\z@ - \spx@boxes@border\z@ - % MEMO: rounded corners still make sense in presence of a background - % color, so we do not force the fcolorbox@rectangle here - \fi -}% - -% For linebreaks inside Verbatim environment from package fancyvrb. -\newbox\sphinxcontinuationbox -\newbox\sphinxvisiblespacebox -\newcommand*\sphinxafterbreak {\copy\sphinxcontinuationbox} - -% Take advantage of the already applied Pygments mark-up to insert -% potential linebreaks for TeX processing. -% {, <, #, %, $, ' and ": go to next line. -% _, }, ^, &, >, -, ~, and \: stay at end of broken line. -% Use of \textquotesingle for straight quote. -% FIXME: convert this to package options ? -\newcommand*\sphinxbreaksbeforelist {% - \do\PYGZob\{\do\PYGZlt\<\do\PYGZsh\#\do\PYGZpc\%% {, <, #, %, - \do\PYGZdl\$\do\PYGZdq\"% $, " - \def\PYGZsq - {\discretionary{}{\sphinxafterbreak\textquotesingle}{\textquotesingle}}% ' -} -\newcommand*\sphinxbreaksafterlist {% - \do\PYGZus\_\do\PYGZcb\}\do\PYGZca\^\do\PYGZam\&% _, }, ^, &, - \do\PYGZgt\>\do\PYGZhy\-\do\PYGZti\~% >, -, ~ - \do\PYGZbs\\% \ -} -\newcommand*\sphinxbreaksatspecials {% - \def\do##1##2% - {\def##1{\discretionary{}{\sphinxafterbreak\char`##2}{\char`##2}}}% - \sphinxbreaksbeforelist - \def\do##1##2% - {\def##1{\discretionary{\char`##2}{\sphinxafterbreak}{\char`##2}}}% - \sphinxbreaksafterlist -} - -\def\sphinx@verbatim@nolig@list {\do \`}% -% Some characters . , ; ? ! / are neither pygmentized nor "tex-escaped". -% This macro makes them "active" and they will insert potential linebreaks. -% Not compatible with math mode (cf \sphinxunactivateextras, which uses -% these lists to make sure activated characters get de-activated). -\newcommand*\sphinxbreaksbeforeactivelist {}% none -\newcommand*\sphinxbreaksafteractivelist {\do\.\do\,\do\;\do\?\do\!\do\/} -\newcommand*\sphinxbreaksviaactive {% - \def\do##1{\lccode`\~`##1% - \lowercase{\def~}{\discretionary{}{\sphinxafterbreak\char`##1}{\char`##1}}% - \catcode`##1\active}% - \sphinxbreaksbeforeactivelist - \def\do##1{\lccode`\~`##1% - \lowercase{\def~}{\discretionary{\char`##1}{\sphinxafterbreak}{\char`##1}}% - \catcode`##1\active}% - \sphinxbreaksafteractivelist - \lccode`\~`\~ -} - -% If the linebreak is at a space, the latter will be displayed as visible -% space at end of first line, and a continuation symbol starts next line. -\def\spx@verbatim@space {% - \nobreak\hskip\z@skip - \discretionary{\copy\sphinxvisiblespacebox}{\sphinxafterbreak} - {\kern\fontdimen2\font}% -}% - -% if the available space on page is less than \literalblockneedspace, insert pagebreak -\newcommand{\sphinxliteralblockneedspace}{5\baselineskip} -\newcommand{\sphinxliteralblockwithoutcaptionneedspace}{1.5\baselineskip} -% The title (caption) is specified from outside as macro \sphinxVerbatimTitle. -% \sphinxVerbatimTitle is reset to empty after each use of Verbatim. -\newcommand*\sphinxVerbatimTitle {} -% This box to typeset the caption before framed.sty multiple passes for framing. -\newbox\sphinxVerbatim@TitleBox -% This box to measure contents if nested as inner \MakeFramed requires then -% minipage encapsulation but too long contents then break outer \MakeFramed -\newbox\sphinxVerbatim@ContentsBox -% Holder macro for labels of literal blocks. Set-up by LaTeX writer. -\newcommand*\sphinxLiteralBlockLabel {} -\newcommand*\sphinxSetupCaptionForVerbatim [1] -{% - \sphinxvspacefixafterfrenchlists - \needspace{\sphinxliteralblockneedspace}% -% insert a \label via \sphinxLiteralBlockLabel -% reset to normal the color for the literal block caption - \def\sphinxVerbatimTitle - {\py@NormalColor\sphinxcaption{\sphinxLiteralBlockLabel #1}}% -} -\newcommand*\sphinxSetupCodeBlockInFootnote {% - \fvset{fontsize=\footnotesize}\let\caption\sphinxfigcaption - \sphinxverbatimwithminipagetrue % reduces vertical spaces - % we counteract (this is in a group) the \@normalsize from \caption - \let\normalsize\footnotesize\let\@parboxrestore\relax - \def\spx@abovecaptionskip{\sphinxverbatimsmallskipamount}% -} -\newcommand*{\sphinxverbatimsmallskipamount}{\smallskipamount} -% serves to implement line highlighting -\newcommand\sphinxFancyVerbFormatLine[1]{% - \expandafter\sphinx@verbatim@checkifhl\expandafter{\the\FV@CodeLineNo}% - \ifin@ - \sphinxVerbatimHighlightLine{#1}% - \else - \sphinxVerbatimFormatLine{#1}% - \fi -}% -\let\spx@original@set@color\set@color -\newcommand\sphinxVerbatimHighlightLine[1]{% -% This is morally a \colorbox (with a \fboxsep which would be 0pt) -% but some issues of potential colour disappearance at pagebreaks -% require workaround such as the one done here. - \leavevmode - % MEMO: usage of original \colorbox would insert a \set@color here - % and this then places a "color pop" at the end of the \box\z@. - % But this could pair erroneously with an unmatched "color push" - % as #1 is maybe only a part (already hboxed) of a codeline - % if (default) verbatimwrapslines=true - % (cf \spx@verb@@PreProcessLine; refs: #8686) - % MEMO: formerly we did something with \fboxsep in relation to the LaTeX - % bug graphics/4524 for \colorbox, but as we don't use \colorbox... - \setbox\z@\hb@xt@\linewidth{\strut#1\hss}% - % MEMO: \colorbox would lead to \color{sphinxVerbatimHighlightColor} - % plus \color@block, which results in doubled (a color.sty feature) - % color command send to device driver and more importantly has - % a "color pop" which will be after \box\z@. We avoid that for reasons - % mentioned above. - {% - \def\set@color{\let\set@color\spx@original@set@color}% - % will only set \current@color and delay the \set@color to \color@block - % as this all happens inside fancyvrb nested \hbox'es. - \color{sphinxVerbatimHighlightColor}% - % will use \current@color and pop it **before** \box\z@ - \color@block{\wd\z@}{\ht\z@}{\dp\z@}\box\z@ - }% - % we added a group only for \FV@RightListNumber not be influenced by the - % \current@color, if \fvset has been used to set numbers to the right. -}% -% MEMO: fancyvrb has options obeytabs and tabsize. Anyhow tab characters -% do not make it to the tex file, they have been converted to spaces earlier. -% But, if this was not the case, the support would be implemented here via -% \newcommand\sphinxVerbatimFormatLine[1]{\FV@ObeyTabs{\strut #1}}% -\newcommand\sphinxVerbatimFormatLine[1]{\strut#1}% -% MEMO: if verbatimwrapslines is set to true (default) the #1 above is -% simply \box\spx@tempboxb, from the next two macros. -% The next two macros are a deep hack of fancyvrb.sty core line processing in -% order to wrap too long lines, either at spaces and natural break-points, -% (soft wrap) or optionally at any character (hard wrap). This requires deep -% hack to work around the \hbox'es wrappers of fancyvrb.sty as they would -% prevent page breaks. Formerly Sphinx obtained wrapping by inserting the -% material into a vertical box (which was later again boxed -- twice -- by -% fancyvrb thinking it was a single line...) but this was incompatible with -% allowing page breaks (refs: #8686). -% We use core TeX techniques to pre-process a paragraph then recover its -% constituents lines (as boxes, not as tokens) and hand them over to original -% fancyvrb line process. It is mandatory to update \FV@ProcessLine and -% \@tempboxa globally to get fancyvrb internals into working to our -% satisfaction. -% This will get disrupted if anything adding vertical penalties or glues -% is activated via some \vadjust from inside the Pygmentized code lines. -\def\spx@verb@@ProcessLines{% - \unskip - \unpenalty - \setbox\spx@tempboxb\lastbox -\ifvoid\spx@tempboxb\else - {\spx@verb@@ProcessLines}% - \FV@ProcessLine{\box\spx@tempboxb}% - \global\let\FV@ProcessLine\FV@ProcessLine - \global\setbox\@tempboxa=\box\@tempboxa - \aftergroup\spx@verb@@InhibitLineNumber -\fi -}% -\def\spx@verb@@InhibitLineNumber{% - \let\FV@LeftListNumber\relax - \let\FV@RightListNumber\relax -}% -% This will replace fancyvrb's \FV@@PreProcessLine -% Instead of boxing \FV@Line (which contains the Pygmentized line tokens), we -% first typeset it in a vertical box of the suitable width (taking into -% account nested lists) to activate the TeX built-in paragraph builder, then -% we recover individual lines as horizontal boxes and feed them to fancyvrb -% native line processing (which may add line numbers). The interline -% penalties and vertical glue to maintain baseline distance will be added -% again by this process so in recursive \spx@verb@@ProcessLines which starts -% from bottom and makes its way up to first part of the wrapped line we do not -% need to worry about them. An additional initial measuring step is needed if -% user issued verbatimforcewraps=true, which elaborates on the same technique. -% If hard wraps get activated, they get implemented via hacked \PYG macros. -\def\spx@verb@@PreProcessLine{% - \FV@StepLineNo - \FV@Gobble - \def\spx@verb@FV@Line{\FV@Line}% - \ifspx@opt@verbatimforcewraps - \spx@verb@DecideIfWillDoForceWrap - \fi -% MEMO: \everypar{} was issued earlier (and due to \@setminipage -% would have been only \@minipagefalse\everypar{} otherwise). - \setbox\spx@tempboxa=\vtop{\hsize\linewidth - \raggedright\hyphenpenalty\z@\exhyphenpenalty\z@ - \doublehyphendemerits\z@\finalhyphendemerits\z@ -% MEMO: fancyvrb has options obeytabs and tabsize. Anyhow tab characters -% do not make it to the tex file, they have been converted to spaces earlier. -% But, if this was not the case, the support would be implemented here via -% \FV@ObeyTabs{\strut\spx@verb@FV@Line\strut}% -% And one would need a similar change in the measuring phase done by -% \spx@verb@DecideIfWillDoForceWrap - \strut\spx@verb@FV@Line\strut -% MEMO: since LaTeX 2021-06-01, there might be some hooks executed at -% start and end of paragraphs (in future: PDF tagging), but we need an -% explicit \par here for that. Else the kernel hooks at start of paragraph -% are executed but not the ones at its end. - \par - }% - \setbox\spx@tempboxa=\vtop{\unvbox\spx@tempboxa - \setbox\spx@tempboxb\lastbox - {\spx@verb@@ProcessLines}% - \FV@ProcessLine{\box\spx@tempboxb}% - \global\let\FV@ProcessLine\FV@ProcessLine - \global\setbox\@tempboxa=\box\@tempboxa - }% - \unvbox\spx@tempboxa -}% -% -% The normal line wrapping allows breaks at spaces and ascii non -% letters, non digits. The \raggedright above means there will be -% an overfilled line only if some non-breakable "word" was -% encountered, which is longer than a line (it is moved always to -% be on its own on a new line). -% -% The "forced" line wrapping will parse the tokens to add potential -% breakpoints at each character. As some strings are highlighted, -% we have to apply the highlighting character per character, which -% requires to manipulate the output of the Pygments LaTeXFormatter. -% -% Doing this at latex level is complicated. The contents should -% be as expected: i.e. some active characters from -% \sphinxbreaksviaactive, some Pygments character escapes such as -% \PYGZdl{}, and the highlighting \PYG macro with always 2 -% arguments. No other macros should be there, except perhaps -% zero-parameter macros. In particular: -% - the texcomments Pygments option must be set to False -% -% With pdflatex, Unicode input gives multi-bytes characters -% where the first byte is active. We support the "utf8" macros -% only. "utf8x" is not supported. -% -% The highlighting macro \PYG will be applied character per -% character. Highlighting via a colored background gives thus a -% chain of small colored boxes which may cause some artefact in -% some pdf viewers. Can't do anything here if we do want the line -% break to be possible. -% -% First a measurement step is done of what would the standard line -% wrapping give (i.e line breaks only at spaces and non-letter, -% non-digit ascii characters), cf TeX by Topic for the basic -% dissecting technique: TeX unfortunately when building a vertical -% box does not store in an accessible way what was the maximal -% line-width during paragraph building. -% -% MEMO: in future use perhaps rather \RawNoindent/\RawParEnd, but -% ltpara (LaTeX 2021-06-01) is not yet in final form (June 2022). -% -% Avoid LaTeX 2021 alteration of \@@par which potentially could break our -% measurement step (typically if the para/after hook is configured to use -% \vspace). Of course, breakage could happen only from user or package -% adding things to basic Sphinx latex. And perhaps spring LaTeX 2021 will -% provide a non-hooked \@@par, but this should work anyway and can't be -% beaten for speed. -\ltx@ifundefined{tex_par:D} -% We could use \@ifl@t@r\fmtversion{2020/02/02}{use \tex_par:D}{use \@@par}. - {\let\spx@par\@@par}% \@@par is then expected to be TeX's original \par - {\expandafter\let\expandafter\spx@par\csname tex_par:D\endcsname} -% More hesitation for avoiding the at-start-of-par hooks for our -% measurement : 1. with old LaTeX, we can not avoid hooks from everyhook -% or similar packages, 2. and perhaps the hooks add stuff which we should -% actually measure. Ideally, hooks are for inserting things in margin -% which do not change spacing. Most everything else in fact should not be -% executed in our scratch box for measurement, such as counter stepping. -\ltx@ifundefined{tex_everypar:D} - {\let\spx@everypar\everypar} - {\expandafter\let\expandafter\spx@everypar\csname tex_everypar:D\endcsname} -% -% If the max width exceeds the linewidth by more than verbatimmaxoverfull -% character widths, or if the min width plus verbatimmaxunderfull character -% widths is inferior to linewidth, then we apply the "force wrapping" with -% potential line break at each character, else we don't. -\long\def\spx@verb@DecideIfWillDoForceWrap{% - \global\let\spx@verb@maxwidth\z@ - \global\let\spx@verb@minwidth\linewidth - \setbox\spx@tempboxa - \vtop{\raggedright\hyphenpenalty\z@\exhyphenpenalty\z@ - \doublehyphendemerits\z@\finalhyphendemerits\z@ - \spx@everypar{}\noindent\strut\FV@Line\strut\spx@par - \spx@verb@getwidths}% - \ifdim\spx@verb@maxwidth> - \dimexpr\linewidth+\spx@opt@verbatimmaxoverfull\fontcharwd\font`X \relax -% The \expandafter is due to \spx@verb@wrapPYG requiring to "see" the TeX tokens -% from the pygmentize output. - \def\spx@verb@FV@Line{\expandafter\spx@verb@wrapPYG\FV@Line\spx@verb@wrapPYG}% - \else - \ifdim\spx@verb@minwidth< - \dimexpr\linewidth-\spx@opt@verbatimmaxunderfull\fontcharwd\font`X \relax - \def\spx@verb@FV@Line{\expandafter\spx@verb@wrapPYG\FV@Line\spx@verb@wrapPYG}% - \fi - \fi -}% -% auxiliary paragraph dissector to get max and min widths -% but minwidth must not take into account the last line -\def\spx@verb@getwidths {% - \unskip\unpenalty - \setbox\spx@tempboxb\lastbox - \ifvoid\spx@tempboxb - \else - \setbox\spx@tempboxb\hbox{\unhbox\spx@tempboxb}% - \ifdim\spx@verb@maxwidth<\wd\spx@tempboxb - \xdef\spx@verb@maxwidth{\number\wd\spx@tempboxb sp}% - \fi - \expandafter\spx@verb@getwidths@loop - \fi -}% -\def\spx@verb@getwidths@loop {% - \unskip\unpenalty - \setbox\spx@tempboxb\lastbox - \ifvoid\spx@tempboxb - \else - \setbox\spx@tempboxb\hbox{\unhbox\spx@tempboxb}% - \ifdim\spx@verb@maxwidth<\wd\spx@tempboxb - \xdef\spx@verb@maxwidth{\number\wd\spx@tempboxb sp}% - \fi - \ifdim\spx@verb@minwidth>\wd\spx@tempboxb - \xdef\spx@verb@minwidth{\number\wd\spx@tempboxb sp}% - \fi - \expandafter\spx@verb@getwidths@loop - \fi -}% -% auxiliary macros to implement "cut long line even in middle of word" -\catcode`Z=3 % safe delimiter -\def\spx@verb@wrapPYG{% - \futurelet\spx@nexttoken\spx@verb@wrapPYG@i -}% -\def\spx@verb@wrapPYG@i{% - \ifx\spx@nexttoken\spx@verb@wrapPYG\let\next=\@gobble\else - \ifx\spx@nexttoken\PYG\let\next=\spx@verb@wrapPYG@PYG@onebyone\else - \discretionary{}{\sphinxafterbreak}{}% - \let\next\spx@verb@wrapPYG@ii - \fi\fi - \next -}% -% Let's recognize active characters. We don't support utf8x only utf8. -% And here #1 should not have picked up (non empty) braced contents -\long\def\spx@verb@wrapPYG@ii#1{% - \ifcat\noexpand~\noexpand#1\relax% active character - \expandafter\spx@verb@wrapPYG@active - \else % non-active character, control sequence such as \PYGZdl, or empty - \expandafter\spx@verb@wrapPYG@one - \fi {#1}% -}% -\long\def\spx@verb@wrapPYG@active#1{% -% Let's hope expansion of active character does not really require arguments, -% as we certainly don't want to go into expanding upfront token stream anyway. - \expandafter\spx@verb@wrapPYG@iii#1{}{}{}{}{}{}{}{}{}Z#1% -}% -\long\def\spx@verb@wrapPYG@iii#1#2Z{% - \ifx\UTFviii@four@octets#1\let\next=\spx@verb@wrapPYG@four\else - \ifx\UTFviii@three@octets#1\let\next=\spx@verb@wrapPYG@three\else - \ifx\UTFviii@two@octets#1\let\next=\spx@verb@wrapPYG@two\else - \let\next=\spx@verb@wrapPYG@one - \fi\fi\fi - \next -}% -\long\def\spx@verb@wrapPYG@one #1{#1\futurelet\spx@nexttoken\spx@verb@wrapPYG@i}% -\long\def\spx@verb@wrapPYG@two #1#2{#1#2\futurelet\spx@nexttoken\spx@verb@wrapPYG@i}% -\long\def\spx@verb@wrapPYG@three #1#2#3{#1#2#3\futurelet\spx@nexttoken\spx@verb@wrapPYG@i}% -\long\def\spx@verb@wrapPYG@four #1#2#3#4{#1#2#3#4\futurelet\spx@nexttoken\spx@verb@wrapPYG@i}% -% Replace \PYG by itself applied one character at a time! This way breakpoints -% can be inserted. -\def\spx@verb@wrapPYG@PYG@onebyone#1#2#3{% #1 = \PYG, #2 = highlight spec, #3 = tokens - \def\spx@verb@wrapPYG@PYG@spec{{#2}}% - \futurelet\spx@nexttoken\spx@verb@wrapPYG@PYG@i#3Z% -}% -\def\spx@verb@wrapPYG@PYG@i{% - \ifx\spx@nexttokenZ\let\next=\spx@verb@wrapPYG@PYG@done\else - \discretionary{}{\sphinxafterbreak}{}% - \let\next\spx@verb@wrapPYG@PYG@ii - \fi - \next -}% -\def\spx@verb@wrapPYG@PYG@doneZ{\futurelet\spx@nexttoken\spx@verb@wrapPYG@i}% -\long\def\spx@verb@wrapPYG@PYG@ii#1{% - \ifcat\noexpand~\noexpand#1\relax% active character - \expandafter\spx@verb@wrapPYG@PYG@active - \else % non-active character, control sequence such as \PYGZdl, or empty - \expandafter\spx@verb@wrapPYG@PYG@one - \fi {#1}% -}% -\long\def\spx@verb@wrapPYG@PYG@active#1{% -% Let's hope expansion of active character does not really require arguments, -% as we certainly don't want to go into expanding upfront token stream anyway. - \expandafter\spx@verb@wrapPYG@PYG@iii#1{}{}{}{}{}{}{}{}{}Z#1% -}% -\long\def\spx@verb@wrapPYG@PYG@iii#1#2Z{% - \ifx\UTFviii@four@octets#1\let\next=\spx@verb@wrapPYG@PYG@four\else - \ifx\UTFviii@three@octets#1\let\next=\spx@verb@wrapPYG@PYG@three\else - \ifx\UTFviii@two@octets#1\let\next=\spx@verb@wrapPYG@PYG@two\else - \let\next=\spx@verb@wrapPYG@PYG@one - \fi\fi\fi - \next -}% -\long\def\spx@verb@wrapPYG@PYG@one#1{% - \expandafter\PYG\spx@verb@wrapPYG@PYG@spec{#1}% - \futurelet\spx@nexttoken\spx@verb@wrapPYG@PYG@i -}% -\long\def\spx@verb@wrapPYG@PYG@two#1#2{% - \expandafter\PYG\spx@verb@wrapPYG@PYG@spec{#1#2}% - \futurelet\spx@nexttoken\spx@verb@wrapPYG@PYG@i -}% -\long\def\spx@verb@wrapPYG@PYG@three#1#2#3{% - \expandafter\PYG\spx@verb@wrapPYG@PYG@spec{#1#2#3}% - \futurelet\spx@nexttoken\spx@verb@wrapPYG@PYG@i -}% -\long\def\spx@verb@wrapPYG@PYG@four#1#2#3#4{% - \expandafter\PYG\spx@verb@wrapPYG@PYG@spec{#1#2#3#4}% - \futurelet\spx@nexttoken\spx@verb@wrapPYG@PYG@i -}% -\catcode`Z 11 % -% -\g@addto@macro\FV@SetupFont{% - \sbox\sphinxcontinuationbox {\spx@opt@verbatimcontinued}% - \sbox\sphinxvisiblespacebox {\spx@opt@verbatimvisiblespace}% -}% -\newenvironment{sphinxVerbatim}{% - % first, let's check if there is a caption - \ifx\sphinxVerbatimTitle\empty - \sphinxvspacefixafterfrenchlists - \parskip\z@skip - \vskip\sphinxverbatimsmallskipamount - % there was no caption. Check if nevertheless a label was set. - \ifx\sphinxLiteralBlockLabel\empty\else - % we require some space to be sure hyperlink target from \phantomsection - % will not be separated from upcoming verbatim by a page break - \needspace{\sphinxliteralblockwithoutcaptionneedspace}% - \phantomsection\sphinxLiteralBlockLabel - \fi - \else - \parskip\z@skip - \if t\spx@opt@literalblockcappos - \vskip\spx@abovecaptionskip - \def\sphinxVerbatim@Before - {\sphinxVerbatim@Title\nointerlineskip - \kern\dimexpr-\dp\strutbox+\sphinxbelowcaptionspace - % if no frame (code-blocks inside table cells), remove - % the top padding (better visually) - \ifspx@opt@verbatimwithframe\else - % but we must now check if there is a background color - % MEMO: "fcolorbox@setup" will have been done by time of use - \ifspx@boxes@withbackgroundcolor\else-\spx@boxes@padding@top\fi - \fi - % caption package adds \abovecaptionskip vspace, remove it - \spx@ifcaptionpackage{-\abovecaptionskip}{}\relax}% - \else - \vskip\sphinxverbatimsmallskipamount - \def\sphinxVerbatim@After - {\nointerlineskip\kern\dimexpr\dp\strutbox - \ifspx@opt@verbatimwithframe\else - % but we must now check if there is a background color - % MEMO: "fcolorbox@setup" will have been done by time of use - \ifspx@boxes@withbackgroundcolor\else-\spx@boxes@padding@bottom\fi - \fi - \spx@ifcaptionpackage{-\abovecaptionskip}{}\relax - \sphinxVerbatim@Title}% - \fi - \def\@captype{literalblock}% - \capstart - % \sphinxVerbatimTitle must reset color - \setbox\sphinxVerbatim@TitleBox - \hbox{\begin{minipage}{\linewidth}% - % caption package may detect wrongly if top or bottom, so we help it - \spx@ifcaptionpackage - {\caption@setposition{\spx@opt@literalblockcappos}}{}% - \sphinxVerbatimTitle - \end{minipage}}% - \fi - \global\let\sphinxLiteralBlockLabel\empty - \global\let\sphinxVerbatimTitle\empty - % the "FrameCommand"'s are also responsible to attach the "Title". - \let\FrameCommand \sphinxVerbatim@FrameCommand - % those will also check status of the pre_box-decoration-break option - \let\FirstFrameCommand\sphinxVerbatim@FirstFrameCommand - \let\MidFrameCommand \sphinxVerbatim@MidFrameCommand - \let\LastFrameCommand \sphinxVerbatim@LastFrameCommand - % - \ifspx@opt@verbatimhintsturnover\else - \let\sphinxVerbatim@Continued\@empty - \let\sphinxVerbatim@Continues\@empty - \fi - % initialization for \spx@boxes@fcolorbox from sphinxpackageboxes.sty - % it will take into account status of verbatimwithframe Boolean - \spx@verb@boxes@fcolorbox@setup - \ifspx@opt@verbatimwrapslines - % deep hack into fancyvrb's internal processing of input lines - \let\FV@@PreProcessLine\spx@verb@@PreProcessLine - % space character will allow line breaks - \let\FV@Space\spx@verbatim@space - % allow breaks at special characters using \PYG... macros. - \sphinxbreaksatspecials - % breaks at punctuation characters . , ; ? ! and / (needs catcode activation) - \fvset{codes*=\sphinxbreaksviaactive}% - \fi - \let\FancyVerbFormatLine\sphinxFancyVerbFormatLine - \VerbatimEnvironment - % workaround to fancyvrb's check of current list depth - \def\@toodeep {\advance\@listdepth\@ne}% - % The list environment is needed to control perfectly the vertical space. - % Note: \OuterFrameSep used by framed.sty is later set to \topsep hence 0pt. - % - if caption: distance from last text baseline to caption baseline is - % A+(B-F)+\ht\strutbox, A = \abovecaptionskip (default 10pt), B = - % \baselineskip, F is the framed.sty \FrameHeightAdjust macro, default 6pt. - % Formula valid for F < 10pt. - % - distance of baseline of caption to top of frame is like for tables: - % \sphinxbelowcaptionspace (=0.5\baselineskip) - % - if no caption: distance of last text baseline to code frame is S+(B-F), - % with S = \sphinxverbatimtopskip (=\smallskip) - % - and distance from bottom of frame to next text baseline is - % \baselineskip+\parskip. - % The \trivlist is used to avoid possible "too deeply nested" error. - \itemsep \z@skip - \topsep \z@skip - \partopsep \z@skip - % trivlist will set \parsep to \parskip (which itself is set to zero above) - % \leftmargin will be set to zero by trivlist - \rightmargin\z@ - \parindent \z@% becomes \itemindent. Default zero, but perhaps overwritten. - \trivlist\item\relax - \ifspx@inframed\setbox\sphinxVerbatim@ContentsBox\vbox\bgroup - \@setminipage\hsize\linewidth - % use bulk of minipage paragraph shape restores (this is needed - % in indented contexts, at least for some) - \textwidth\hsize \columnwidth\hsize \@totalleftmargin\z@ - \leftskip\z@skip \rightskip\z@skip \@rightskip\z@skip - \else - \ifsphinxverbatimwithminipage\noindent\begin{minipage}{\linewidth}\fi - \MakeFramed {% adapted over from framed.sty's snugshade environment - \advance\hsize-\width\@totalleftmargin\z@\linewidth\hsize\@setminipage - }% - \fi - % For grid placement from \strut's in \FancyVerbFormatLine - \lineskip\z@skip - % active comma should not be overwritten by \@noligs - \ifspx@opt@verbatimwrapslines - \let\verbatim@nolig@list \sphinx@verbatim@nolig@list - \fi - % optimization: as codelines will be handled inside boxes, \everypar is - % never reset, and it issues \@minipagefalse repeatedly (from \@setminipage). - % As fancyvrb Verbatim will do \@minipagefalse itself, let's simplify things. - \everypar{}% - \color@begingroup % protect against color leaks (upstream framed.sty bug) - \ifspx@pre@withtextcolor\color{VerbatimTextColor}\fi % mostly shadowed by - % Pygments highlighting anyhow - \spx@pre@TeXextras - % will fetch its optional arguments if any - \OriginalVerbatim -}% -{% - \endOriginalVerbatim - \color@endgroup % matches the \color@begingroup - \ifspx@inframed - \egroup % finish \sphinxVerbatim@ContentsBox vbox - \nobreak % update page totals -%%%% -% MEMO (2022/07/09, while preparing 5.1.0 LaTeX CSS-style sphinxsetup options) -% This test will systematically cause to abandon framing if the code-block -% is near bottom of a warning-type notice which TeX has not yet decided whether -% it fits on current page and which is near bottom of page. Indeed the -% \pagetotal will already be very near \pagegoal. This is probably a not -% intended behaviour, and perhaps the whole thing should be removed? Indeed -% the result is surprising then because the notice will be split, code-block -% will be on page 2 and will have no background-color, no border. - \ifdim\dimexpr - \ht\sphinxVerbatim@ContentsBox+ - \dp\sphinxVerbatim@ContentsBox+ - \ht\sphinxVerbatim@TitleBox+ - \dp\sphinxVerbatim@TitleBox+ - % 6.2.0 uses here the dimen registers from sphinxpackageboxes.sty, - % they got setup by \spx@verb@boxes@fcolorbox@setup - \spx@boxes@padding@top+ - \spx@boxes@padding@bottom+ - \ifspx@opt@verbatimwithframe \spx@boxes@border@top+ - \spx@boxes@border@bottom+\fi - % try to account for external frame parameters - % MEMO: this is because the sphinxheavybox (for warning admonitions) - % environment sets \FrameSep and \FrameRule - % TODO: fix this bad implicit dependency - \FrameSep+\FrameRule+ - % Usage here of 2 baseline distances is empirical. - % In border case where code-block fits barely in remaining space, - % it gets framed and looks good but the outer frame may continue - % on top of next page and give (if no contents after code-block) - % an empty framed line, as testing showed. - 2\baselineskip+ - % now add all to accumulated page totals and compare to \pagegoal - \pagetotal+\pagedepth>\pagegoal - % long contents: do not \MakeFramed. Do make a caption (either before or - % after) if title exists. Continuation hints across pagebreaks dropped. - % FIXME? a bottom caption may end up isolated at top of next page - % (no problem with a top caption, which is default) - \spx@opt@verbatimwithframefalse - \def\sphinxVerbatim@Title{\noindent\box\sphinxVerbatim@TitleBox\par}% - \sphinxVerbatim@Before - \noindent\unvbox\sphinxVerbatim@ContentsBox\par - \sphinxVerbatim@After - \else - % short enough contents: use \MakeFramed. As it is nested, this requires - % minipage encapsulation. - \noindent\begin{minipage}{\linewidth}% - \MakeFramed {% Use it now with the fetched contents - \advance\hsize-\width\@totalleftmargin\z@\linewidth\hsize\@setminipage - }% - \unvbox\sphinxVerbatim@ContentsBox - % the \@minipagefalse is superfluous, actually. - \par\unskip\@minipagefalse\endMakeFramed - \end{minipage}% - \fi - \else % non-nested \MakeFramed - \par\unskip\@minipagefalse\endMakeFramed % from framed.sty snugshade - \ifsphinxverbatimwithminipage\end{minipage}\fi - \fi - \endtrivlist -} -\newenvironment {sphinxVerbatimNoFrame} - {\spx@opt@verbatimwithframefalse - \VerbatimEnvironment - \begin{sphinxVerbatim}} - {\end{sphinxVerbatim}} -\newenvironment {sphinxVerbatimintable} - {% don't use a frame if in a table cell - \spx@opt@verbatimwithframefalse - \sphinxverbatimwithminipagetrue - % the literal block caption uses \sphinxcaption which is wrapper of \caption, - % but \caption must be modified because longtable redefines it to work only - % for the own table caption, and tabulary has multiple passes - \let\caption\sphinxfigcaption - % reduce above caption skip - \def\spx@abovecaptionskip{\sphinxverbatimsmallskipamount}% - \VerbatimEnvironment - \begin{sphinxVerbatim}} - {\end{sphinxVerbatim}} - - -%% PARSED LITERALS -% allow long lines to wrap like they do in code-blocks - -% this should be kept in sync with definitions in sphinx.util.texescape -\newcommand*\sphinxbreaksattexescapedchars{% - \def\do##1##2% put potential break point before character - {\def##1{\discretionary{}{\sphinxafterbreak\char`##2}{\char`##2}}}% - \do\{\{\do\textless\<\do\#\#\do\%\%\do\$\$% {, <, #, %, $ - \def\do##1##2% put potential break point after character - {\def##1{\discretionary{\char`##2}{\sphinxafterbreak}{\char`##2}}}% - \do\_\_\do\}\}\do\textasciicircum\^\do\&\&% _, }, ^, &, - \do\textgreater\>\do\textasciitilde\~% >, ~ - \do\textbackslash\\% \ -} -\newcommand*\sphinxbreaksviaactiveinparsedliteral{% - \sphinxbreaksviaactive % by default handles . , ; ? ! / - \lccode`\~`\~ % - % update \dospecials as it is used by \url - % but deactivation will already have been done hence this is unneeded: - % \expandafter\def\expandafter\dospecials\expandafter{\dospecials - % \sphinxbreaksbeforeactivelist\sphinxbreaksafteractivelist\do\-}% -} -\newcommand*\sphinxbreaksatspaceinparsedliteral{% - \lccode`~32 \lowercase{\let~}\spx@verbatim@space\lccode`\~`\~ -} -\newcommand*{\sphinxunactivateextras}{\let\do\@makeother - \sphinxbreaksbeforeactivelist\sphinxbreaksafteractivelist}% -% the \catcode13=5\relax (deactivate end of input lines) is left to callers -\newcommand*{\sphinxunactivateextrasandspace}{\catcode32=10\relax - \sphinxunactivateextras}% -% alltt uses a monospace font and linebreaks at dashes (which are escaped -% to \sphinxhyphen{} which expands to -\kern\z@) are inhibited with pdflatex. -% Not with xelatex (cf \defaultfontfeatures in latex writer), so: -\newcommand*{\sphinxhypheninparsedliteral}{\sphinxhyphennobreak} -% now for the modified alltt environment -\newenvironment{sphinxalltt} -{% at start of next line to workaround Emacs/AUCTeX issue with this file -\begin{alltt}% - \ifspx@opt@parsedliteralwraps - \sbox\sphinxcontinuationbox {\spx@opt@verbatimcontinued}% - \sbox\sphinxvisiblespacebox {\spx@opt@verbatimvisiblespace}% - \let\sphinxhyphen\sphinxhypheninparsedliteral - \sphinxbreaksattexescapedchars - \sphinxbreaksviaactiveinparsedliteral - \sphinxbreaksatspaceinparsedliteral -% alltt takes care of the ' as derivative ("prime") in math mode - \everymath\expandafter{\the\everymath\sphinxunactivateextrasandspace - \catcode`\<=12\catcode`\>=12\catcode`\^=7\catcode`\_=8 }% -% not sure if displayed math (align,...) can end up in parsed-literal, anyway - \everydisplay\expandafter{\the\everydisplay - \catcode13=5 \sphinxunactivateextrasandspace - \catcode`\<=12\catcode`\>=12\catcode`\^=7\catcode`\_=8 }% - \fi } -{\end{alltt}} - - -%% INLINE MARK-UP -% - -% Protect \href's first argument in contexts such as sphinxalltt (or -% \sphinxcode). Sphinx uses \#, \%, \& ... always inside \sphinxhref. -\protected\def\sphinxhref#1#2{{% - \sphinxunactivateextrasandspace % never do \scantokens with active space! -% for the \endlinechar business, https://github.com/latex3/latex2e/issues/286 - \endlinechar\m@ne\everyeof{{\endlinechar13 #2}}% keep catcode regime for #2 - \scantokens{\href{#1}}% normalise it for #1 during \href expansion -}} -% Same for \url. And also \nolinkurl for coherence. -\protected\def\sphinxurl#1{{% - \sphinxunactivateextrasandspace\everyeof{}% (<- precaution for \scantokens) - \endlinechar\m@ne\scantokens{\url{#1}}% -}} -\protected\def\sphinxnolinkurl#1{{% - \sphinxunactivateextrasandspace\everyeof{}% - \endlinechar\m@ne\scantokens{\nolinkurl{#1}}% -}} - -% \sphinxupquote -% to obtain straight quotes we execute \@noligs as patched by upquote, and -% \scantokens is needed in cases where it would be too late for the macro to -% first set catcodes and then fetch its argument. We also make the contents -% breakable at non-escaped . , ; ? ! / using \sphinxbreaksviaactive, -% and also at \ character (which is escaped to \textbackslash{}). -\protected\def\sphinxtextbackslashbreakbefore - {\discretionary{}{\sphinxafterbreak\sphinx@textbackslash}{\sphinx@textbackslash}} -\protected\def\sphinxtextbackslashbreakafter - {\discretionary{\sphinx@textbackslash}{\sphinxafterbreak}{\sphinx@textbackslash}} -\let\sphinxtextbackslash\sphinxtextbackslashbreakafter -% - is escaped to \sphinxhyphen{} and this default ensures no linebreak -% behaviour (also with a non monospace font, or with xelatex) -\newcommand*{\sphinxhyphenininlineliteral}{\sphinxhyphennobreak} -% the macro must be protected if it ends up used in moving arguments, -% in 'alltt' \@noligs is done already, and the \scantokens must be avoided. -\protected\def\sphinxupquote#1{{\def\@tempa{alltt}% - \ifx\@tempa\@currenvir\else - \let\sphinxhyphen\sphinxhyphenininlineliteral - \ifspx@opt@inlineliteralwraps - % break at . , ; ? ! / - \sphinxbreaksviaactive - % break also at \ - \setbox8=\hbox{\textbackslash}% - \def\sphinx@textbackslash{\copy8}% - \let\textbackslash\sphinxtextbackslash - % by default, no continuation symbol on next line but may be added - \let\sphinxafterbreak\sphinxafterbreakofinlineliteral - % do not overwrite the comma set-up - \let\verbatim@nolig@list\sphinx@literal@nolig@list - \fi - % fix a space-gobbling issue due to LaTeX's original \do@noligs -% TODO: using \@noligs as patched by upquote.sty is now unneeded because -% either ` and ' are escaped (non-unicode engines) or they don't build -% ligatures (unicode engines). Thus remove this and unify handling of `, <, >, -% ' and - with the characters . , ; ? ! / as handled via -% \sphinxbreaksviaactive. -% Hence \sphinx@do@noligs will be removed, or rather replaced with code -% inserting discretionaries, as they allow a continuation symbol on start of -% next line to achieve common design with code-blocks. -% TODO: do the above TODO! -% Extend \sphinxunactivateextras for \sphinxhref as the latter may -% actually be in the scope of \sphinxupquote and does a \scantokens -% of its own. - \expandafter\def\expandafter\sphinxunactivateextras\expandafter - {\sphinxunactivateextras\verbatim@nolig@list}% - \let\do@noligs\sphinx@do@noligs - \@noligs\endlinechar\m@ne\everyeof{}% (<- in case inside \sphinxhref) - \expandafter\scantokens - \fi {{#1}}}}% extra brace pair to fix end-space gobbling issue... -\def\sphinx@do@noligs #1{\catcode`#1\active\begingroup\lccode`\~`#1\relax - \lowercase{\endgroup\def~{\leavevmode\kern\z@\char`#1 }}} -\def\sphinx@literal@nolig@list {\do\`\do\<\do\>\do\'\do\-}% -\let\sphinxafterbreakofinlineliteral\empty - - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexnumfig.sty b/crypto/krb5/doc/pdf/sphinxlatexnumfig.sty deleted file mode 100644 index 6d72961051eb..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexnumfig.sty +++ /dev/null @@ -1,122 +0,0 @@ -%% NUMBERING OF FIGURES, TABLES, AND LITERAL BLOCKS -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexnumfig.sty}[2021/01/27 numbering] - -% Requires: remreset (old LaTeX only) -% relates to numfig and numfig_secnum_depth configuration variables - -% LaTeX 2018-04-01 and later provides \@removefromreset -\ltx@ifundefined{@removefromreset} - {\RequirePackage{remreset}} - {}% avoid warning -% Everything is delayed to \begin{document} to allow hyperref patches into -% \newcounter to solve duplicate label problems for internal hyperlinks to -% code listings (literalblock counter). User or extension re-definitions of -% \theliteralblock, et al., thus have also to be delayed. (changed at 3.5.0) -\AtBeginDocument{% -\ltx@ifundefined{c@chapter} - {\newcounter{literalblock}}% - {\newcounter{literalblock}[chapter]% - \def\theliteralblock{\ifnum\c@chapter>\z@\arabic{chapter}.\fi - \arabic{literalblock}}% - }% -\ifspx@opt@nonumfigreset - \ltx@ifundefined{c@chapter}{}{% - \@removefromreset{figure}{chapter}% - \@removefromreset{table}{chapter}% - \@removefromreset{literalblock}{chapter}% - \ifspx@opt@mathnumfig - \@removefromreset{equation}{chapter}% - \fi - }% - \def\thefigure{\arabic{figure}}% - \def\thetable {\arabic{table}}% - \def\theliteralblock{\arabic{literalblock}}% - \ifspx@opt@mathnumfig - \def\theequation{\arabic{equation}}% - \fi -\else -\let\spx@preAthefigure\@empty -\let\spx@preBthefigure\@empty -% \ifspx@opt@usespart % <-- LaTeX writer could pass such a 'usespart' boolean -% % as sphinx.sty package option -% If document uses \part, (triggered in Sphinx by latex_toplevel_sectioning) -% LaTeX core per default does not reset chapter or section -% counters at each part. -% But if we modify this, we need to redefine \thechapter, \thesection to -% include the part number and this will cause problems in table of contents -% because of too wide numbering. Simplest is to do nothing. -% \fi -\ifnum\spx@opt@numfigreset>0 - \ltx@ifundefined{c@chapter} - {} - {\g@addto@macro\spx@preAthefigure{\ifnum\c@chapter>\z@\arabic{chapter}.}% - \g@addto@macro\spx@preBthefigure{\fi}}% -\fi -\ifnum\spx@opt@numfigreset>1 - \@addtoreset{figure}{section}% - \@addtoreset{table}{section}% - \@addtoreset{literalblock}{section}% - \ifspx@opt@mathnumfig - \@addtoreset{equation}{section}% - \fi% - \g@addto@macro\spx@preAthefigure{\ifnum\c@section>\z@\arabic{section}.}% - \g@addto@macro\spx@preBthefigure{\fi}% -\fi -\ifnum\spx@opt@numfigreset>2 - \@addtoreset{figure}{subsection}% - \@addtoreset{table}{subsection}% - \@addtoreset{literalblock}{subsection}% - \ifspx@opt@mathnumfig - \@addtoreset{equation}{subsection}% - \fi% - \g@addto@macro\spx@preAthefigure{\ifnum\c@subsection>\z@\arabic{subsection}.}% - \g@addto@macro\spx@preBthefigure{\fi}% -\fi -\ifnum\spx@opt@numfigreset>3 - \@addtoreset{figure}{subsubsection}% - \@addtoreset{table}{subsubsection}% - \@addtoreset{literalblock}{subsubsection}% - \ifspx@opt@mathnumfig - \@addtoreset{equation}{subsubsection}% - \fi% - \g@addto@macro\spx@preAthefigure{\ifnum\c@subsubsection>\z@\arabic{subsubsection}.}% - \g@addto@macro\spx@preBthefigure{\fi}% -\fi -\ifnum\spx@opt@numfigreset>4 - \@addtoreset{figure}{paragraph}% - \@addtoreset{table}{paragraph}% - \@addtoreset{literalblock}{paragraph}% - \ifspx@opt@mathnumfig - \@addtoreset{equation}{paragraph}% - \fi% - \g@addto@macro\spx@preAthefigure{\ifnum\c@subparagraph>\z@\arabic{subparagraph}.}% - \g@addto@macro\spx@preBthefigure{\fi}% -\fi -\ifnum\spx@opt@numfigreset>5 - \@addtoreset{figure}{subparagraph}% - \@addtoreset{table}{subparagraph}% - \@addtoreset{literalblock}{subparagraph}% - \ifspx@opt@mathnumfig - \@addtoreset{equation}{subparagraph}% - \fi% - \g@addto@macro\spx@preAthefigure{\ifnum\c@subsubparagraph>\z@\arabic{subsubparagraph}.}% - \g@addto@macro\spx@preBthefigure{\fi}% -\fi -\expandafter\g@addto@macro -\expandafter\spx@preAthefigure\expandafter{\spx@preBthefigure}% -\let\thefigure\spx@preAthefigure -\let\thetable\spx@preAthefigure -\let\theliteralblock\spx@preAthefigure -\g@addto@macro\thefigure{\arabic{figure}}% -\g@addto@macro\thetable{\arabic{table}}% -\g@addto@macro\theliteralblock{\arabic{literalblock}}% - \ifspx@opt@mathnumfig - \let\theequation\spx@preAthefigure - \g@addto@macro\theequation{\arabic{equation}}% - \fi -\fi -}% end of big \AtBeginDocument - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexobjects.sty b/crypto/krb5/doc/pdf/sphinxlatexobjects.sty deleted file mode 100644 index 5d9b69b77ae8..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexobjects.sty +++ /dev/null @@ -1,365 +0,0 @@ -%% MODULE RELEASE DATA AND OBJECT DESCRIPTIONS -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexobjects.sty}[2023/07/23 documentation environments] - -% Provides support for this output mark-up from Sphinx latex writer: -% -% - environments -% -% - fulllineitems -% - productionlist -% - optionlist -% - DUlineblock (also "lineblock") -% -% - macros -% -% - \DUrole -% - various legacy support macros related to author and release -% data of documented objects and modules. - -% \moduleauthor{name}{email} -\newcommand{\moduleauthor}[2]{} - -% \sectionauthor{name}{email} -\newcommand{\sectionauthor}[2]{} - -% Allow the release number to be specified independently of the -% \date{}. This allows the date to reflect the document's date and -% release to specify the release that is documented. -% -\newcommand{\py@release}{\releasename\space\version} -\newcommand{\version}{}% part of \py@release, used by title page and headers -% \releaseinfo is used on titlepage (sphinxmanual.cls, sphinxhowto.cls) -\newcommand{\releaseinfo}{} -\newcommand{\setreleaseinfo}[1]{\renewcommand{\releaseinfo}{#1}} -% this is inserted via template and #1=release config variable -\newcommand{\release}[1]{\renewcommand{\version}{#1}} -% this is defined by template to 'releasename' latex_elements key -\newcommand{\releasename}{} -% Fix issue in case release and releasename deliberately left blank -\newcommand{\sphinxheadercomma}{, }% used in fancyhdr header definition -\newcommand{\sphinxifemptyorblank}[1]{% -% test after one expansion of macro #1 if contents is empty or spaces - \if&\expandafter\@firstofone\detokenize\expandafter{#1}&% - \expandafter\@firstoftwo\else\expandafter\@secondoftwo\fi}% -\AtBeginDocument {% - \sphinxifemptyorblank{\releasename} - {\sphinxifemptyorblank{\version}{\let\sphinxheadercomma\empty}{}} - {}% -}% - -% Allow specification of the author's address separately from the -% author's name. This can be used to format them differently, which -% is a good thing. -% -\newcommand{\py@authoraddress}{} -\newcommand{\authoraddress}[1]{\renewcommand{\py@authoraddress}{#1}} - -% {fulllineitems} is the main environment for object descriptions. -% -% With 4.0.0 \pysigline (and \pysiglinewithargsret), used in a fulllineitems -% environment the #1 will already be of the width which is computed here, i.e. -% the available width on line, so the \makebox becomes a bit superfluous -\newcommand{\py@itemnewline}[1]{% macro used as \makelabel in fulllineitems -% Memo: this presupposes \itemindent is 0pt - \kern\labelsep % because \@labels core latex box does \hskip-\labelsep - \makebox[\dimexpr\linewidth+\labelwidth\relax][l]{#1}% - \kern-\labelsep % because at end of \@labels box there is \hskip\labelsep -} - -\newenvironment{fulllineitems}{% - \begin{list}{}{\labelwidth \leftmargin - \rightmargin \z@ \topsep -\parskip \partopsep \parskip - \itemsep -\parsep - \let\makelabel=\py@itemnewline}% -}{\end{list}} - -% Signatures, possibly multi-line -% -% For legacy reasons Sphinx uses LaTeX \list and \item's for signatures -% This is delicate: -% - the actual item label is not typeset immediately by \item but later as part -% of the \everypar which will be triggered by either next paragraph or a manual -% \leavevmode, or if nothing in-between by the next \item, -% - \begingroup <set-up>\item[foo] <setup>\endgroup leads to errors, -% - vertical space depends on \parskip and \itemsep values in somewhat -% subtle manners. -% -% Since the 2022/01/13 version things are simpler as \parskip is simply set -% to zero during execution of \pysigline/\pysiglinewithargsret -% -% Parameter for separation via \itemsep of multiple signatures with common desc -\newlength\sphinxsignaturesep -\setlength\sphinxsignaturesep{\smallskipamount} -% latex.py outputs mark-up like this: -% \pysigstartsignatures <signatures> \pysigstopsignatures <actual desc> -\newcommand{\pysigstartsignatures}{% - % store current \parskip and \itemsep - \edef\pysig@restore@itemsep@and@parskip{% - \itemsep\the\itemsep\relax - \parskip\the\parskip\relax - }% - % set them to control the spacing between signatures sharing common desc - \parskip\z@skip - \itemsep\sphinxsignaturesep -} -\newcommand{\pysigstopsignatures}{% -% 1) encourage a pagebreak in an attempt to try to avoid last -% signature ending up separated from description (due to voodoo next) -\penalty-100 -% 2) some voodoo to separate last signature from description in a manner -% robust with respect to the latter being itself a LaTeX list object -\leavevmode\par\kern-\baselineskip\item[\strut] -% - \leavevmode - % it is important \leavevmode was issued before the \parskip reset, and - % it is also needed for the case of an object desc itself a LaTeX \list - % now restore \itemsep and \parskip - \pysig@restore@itemsep@and@parskip -} -% Each signature is rendered as NAME<SPACE>[TPLIST]<SPACE>(ARGLIST) where the -% size of <SPACE> is parametrized by \sphinxsignaturelistskip (0pt by default). -\newlength\sphinxsignaturelistskip -\setlength\sphinxsignaturelistskip{0pt} -\newcommand{\pysigtypelistopen}{\hskip\sphinxsignaturelistskip\sphinxcode{[}} -\newcommand{\pysigtypelistclose}{\sphinxcode{]}} -\newcommand{\pysigarglistopen}{\hskip\sphinxsignaturelistskip\sphinxcode{(}} -\newcommand{\pysigarglistclose}{\sphinxcode{)}} -% -% Use a \parbox to accommodate long argument list in signatures -% LaTeX did not imagine that an \item label could need multi-line rendering -\newlength{\py@argswidth} -\newcommand{\py@sigparams}[2]{% - % The \py@argswidth has been computed in \pysiglinewithargsret to make the - % argument list use full available width - \parbox[t]{\py@argswidth}{\raggedright #1\pysigarglistclose#2\strut}% - % final strut is to help get correct vertical separation -} -\newcommand{\py@sigparamswithtypelist}[3]{% - % similar to \py@sigparams but with different delimiters and an additional - % type parameters list given as #1, the argument list as #2 and the return - % annotation as #3 - \parbox[t]{\py@argswidth}{% - \raggedright #1\pysigtypelistclose% - \pysigarglistopen#2\pysigarglistclose% - #3\strut}% -} - -\newcommand{\pysigline}[1]{% - % as \py@argswidth is available, we use it but no "args" here - % the \relax\relax is because \py@argswidth is a "skip" variable - % this will make the label occupy the full available linewidth - \py@argswidth=\dimexpr\linewidth+\labelwidth\relax\relax - \item[{\parbox[t]{\py@argswidth}{\raggedright #1\strut}}] - \pysigadjustitemsep -} -\newcommand{\pysiglinewithargsret}[3]{% - % as #1 may contain a footnote using \label we need to make \label - % a no-op here to avoid LaTeX complaining about duplicates -\let\spx@label\label\let\label\@gobble - \settowidth{\py@argswidth}{#1\pysigarglistopen}% -\let\label\spx@label - \py@argswidth=\dimexpr\linewidth+\labelwidth-\py@argswidth\relax\relax - \item[{#1\pysigarglistopen\py@sigparams{#2}{#3}\strut}] - \pysigadjustitemsep -} -\newcommand{\pysiglinewithargsretwithtypelist}[4]{ -% #1 = name, #2 = typelist, #3 = arglist, #4 = retann -\let\spx@label\label\let\label\@gobble - \settowidth{\py@argswidth}{#1\pysigtypelistopen}% -\let\label\spx@label - \py@argswidth=\dimexpr\linewidth+\labelwidth-\py@argswidth\relax\relax - \item[{#1\pysigtypelistopen\py@sigparamswithtypelist{#2}{#3}{#4}\strut}] - \pysigadjustitemsep -} - -\def\sphinxoptionalextraspace{0.5mm} -\newcommand{\pysigwithonelineperarg}[3]{% - % render each argument on its own line - \item[#1\pysigarglistopen\strut] - \leavevmode\par\nopagebreak - % this relies on \pysigstartsignatures having set \parskip to zero - \begingroup - \let\sphinxparamcomma\sphinxparamcommaoneperline - \def\sphinxoptionalhook{\ifvmode\else\kern\sphinxoptionalextraspace\relax\fi}% - % The very first \sphinxparam should not emit a \par hence a complication - % with a group and global definition here as it may occur in a \sphinxoptional - \global\let\spx@sphinxparam\sphinxparam - \gdef\sphinxparam{\gdef\sphinxparam{\par\spx@sphinxparam}\spx@sphinxparam}% - #2\par - \endgroup - \global\let\sphinxparam\spx@sphinxparam - % fulllineitems sets \labelwidth to be like \leftmargin - \nopagebreak\noindent\kern-\labelwidth\pysigarglistclose{#3} - \pysigadjustitemsep -} -\newcommand{\pysigwithonelineperargwithonelinepertparg}[4]{ - % #1 = name, #2 = typelist, #3 = arglist, #4 = retann - % render each type parameter and argument on its own line - \item[#1\pysigtypelistopen\strut] - \leavevmode\par\nopagebreak - \begingroup - \let\sphinxparamcomma\sphinxparamcommaoneperline - % \sphinxtypeparam is treated similarly to \sphinxparam but since - % \sphinxoptional is not accepted in a type parameters list, we do - % not need the hook or the global definition - \let\spx@sphinxtypeparam\sphinxtypeparam - \def\sphinxtypeparam{\def\sphinxtypeparam{\par\spx@sphinxtypeparam}\spx@sphinxtypeparam}% - #2\par - \endgroup - \nopagebreak\noindent\kern-\labelwidth\pysigtypelistclose% - % render the rest of the signature like in \pysigwithonelineperarg - \pysigarglistopen\strut\par\nopagebreak - \begingroup - \let\sphinxparamcomma\sphinxparamcommaoneperline - \def\sphinxoptionalhook{\ifvmode\else\kern\sphinxoptionalextraspace\relax\fi}% - \global\let\spx@sphinxparam\sphinxparam - \gdef\sphinxparam{\gdef\sphinxparam{\par\spx@sphinxparam}\spx@sphinxparam}% - #3\par - \endgroup - \global\let\sphinxparam\spx@sphinxparam - \nopagebreak\noindent\kern-\labelwidth\pysigarglistclose{#4} - \pysigadjustitemsep -} -\newcommand{\pysiglinewithargsretwithonelinepertparg}[4]{ - % #1 = name, #2 = typelist, #3 = arglist, #4 = retann - % render each type parameter on its own line but the arguments list inline - \item[#1\pysigtypelistopen\strut] - \leavevmode\par\nopagebreak - \begingroup - \let\sphinxparamcomma\sphinxparamcommaoneperline - % \sphinxtypeparam is treated similarly to \sphinxparam but since - % \sphinxoptional is not accepted in a type parameters list, we do - % not need the hook or the global definition - \let\spx@sphinxtypeparam\sphinxtypeparam - \def\sphinxtypeparam{\def\sphinxtypeparam{\par\spx@sphinxtypeparam}\spx@sphinxtypeparam}% - #2\par - \endgroup - \nopagebreak\noindent\kern-\labelwidth\pysigtypelistclose% - % render the arguments list on one line - \pysigarglistopen#3\pysigarglistclose#4\strut - \pysigadjustitemsep -} -\newcommand{\pysigwithonelineperargwithtypelist}[4]{ - % #1 = name, #2 = typelist, #3 = arglist, #4 = retann - % render the type parameters list on one line, but each argument is rendered on its own line -\let\spx@label\label\let\label\@gobble - \settowidth{\py@argswidth}{#1\pysigtypelistopen}% -\let\label\spx@label - \py@argswidth=\dimexpr\linewidth+\labelwidth-\py@argswidth\relax\relax - \item[{#1\pysigtypelistopen\parbox[t]{\py@argswidth}{% - \raggedright #2\pysigtypelistclose\pysigarglistopen\strut}\strut}] - % render the rest of the signature like in \pysigwithonelineperarg - \begingroup - \let\sphinxparamcomma\sphinxparamcommaoneperline - \def\sphinxoptionalhook{\ifvmode\else\kern\sphinxoptionalextraspace\relax\fi}% - \global\let\spx@sphinxparam\sphinxparam - \gdef\sphinxparam{\gdef\sphinxparam{\par\spx@sphinxparam}\spx@sphinxparam}% - #3\par - \endgroup - \global\let\sphinxparam\spx@sphinxparam - \nopagebreak\noindent\kern-\labelwidth\pysigarglistclose{#4} - \pysigadjustitemsep -} -\newcommand{\pysigadjustitemsep}{% - % adjust \itemsep to control the separation with the next signature - % sharing common description - \ifsphinxsigismultiline - % inside a multiline signature, no extra vertical spacing - % ("multiline" here does not refer to possibly long - % list of arguments, but to a cpp domain feature) - \itemsep\z@skip - \else - \itemsep\sphinxsignaturesep - \fi -} -\newif\ifsphinxsigismultiline -\newcommand{\pysigstartmultiline}{\sphinxsigismultilinetrue}% -\newcommand{\pysigstopmultiline}{\sphinxsigismultilinefalse\itemsep\sphinxsignaturesep}% - -% Production lists -% -\newenvironment{productionlist}{% -% \def\sphinxoptional##1{{\Large[}##1{\Large]}} - \def\production##1##2{\\\sphinxcode{\sphinxupquote{##1}}&::=&\sphinxcode{\sphinxupquote{##2}}}% - \def\productioncont##1{\\& &\sphinxcode{\sphinxupquote{##1}}}% - \parindent=2em - \indent - \setlength{\LTpre}{0pt}% - \setlength{\LTpost}{0pt}% - \begin{longtable}[l]{lcl} -}{% - \end{longtable} -} - -% Definition lists; requested by AMK for HOWTO documents. Probably useful -% elsewhere as well, so keep in in the general style support. -% -\newenvironment{definitions}{% - \begin{description}% - \def\term##1{\item[{##1}]\mbox{}\\*[0mm]}% -}{% - \end{description}% -} - -%% FROM DOCTUTILS LATEX WRITER -% -% The following is stuff copied from docutils' latex writer. -% -\newcommand{\optionlistlabel}[1]{\normalfont\bfseries #1 \hfill}% \bf deprecated -\newenvironment{optionlist}[1] -{\begin{list}{} - {\setlength{\labelwidth}{#1}% - \setlength{\rightmargin}{1cm}% - \setlength{\leftmargin}{\rightmargin}% - \addtolength{\leftmargin}{\labelwidth}% - \addtolength{\leftmargin}{\labelsep}% - \renewcommand{\makelabel}{\optionlistlabel}}% -}{\end{list}} - -\newlength{\lineblockindentation} -\setlength{\lineblockindentation}{2.5em} -\newenvironment{lineblock}[1] -{\begin{list}{} - {\setlength{\partopsep}{\parskip}% - \addtolength{\partopsep}{\baselineskip}% - \topsep0pt\itemsep0.15\baselineskip\parsep0pt - \leftmargin#1\relax}% - \raggedright} -{\end{list}} - -% From docutils.writers.latex2e -% inline markup (custom roles) -% \DUrole{#1}{#2} tries \DUrole#1{#2} -\providecommand*{\DUrole}[2]{% - \ifcsname DUrole\detokenize{#1}\endcsname - \csname DUrole\detokenize{#1}\endcsname{#2}% - \else% backwards compatibility: try \docutilsrole#1{#2} - \ifcsname docutilsrole\detokenize{#1}\endcsname - \csname docutilsrole\detokenize{#1}\endcsname{#2}% - \else - #2% - \fi - \fi -} - -\providecommand*{\DUprovidelength}[2]{% - \ifdefined#1\else\newlength{#1}\setlength{#1}{#2}\fi -} - -\DUprovidelength{\DUlineblockindent}{2.5em} -\ifdefined\DUlineblock\else - \newenvironment{DUlineblock}[1]{% - \list{}{\setlength{\partopsep}{\parskip}% - \addtolength{\partopsep}{\baselineskip}% - \setlength{\topsep}{0pt}% - \setlength{\itemsep}{0.15\baselineskip}% - \setlength{\parsep}{0pt}% - \setlength{\leftmargin}{#1}}% - \raggedright - } - {\endlist} -\fi - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexshadowbox.sty b/crypto/krb5/doc/pdf/sphinxlatexshadowbox.sty deleted file mode 100644 index a2a1a0e393e4..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexshadowbox.sty +++ /dev/null @@ -1,116 +0,0 @@ -%% TOPIC AND CONTENTS BOXES -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexshadowbox.sty}[2023/03/19 sphinxShadowBox] - -% Provides support for this output mark-up from Sphinx latex writer: -% -% - sphinxShadowBox (environment) -% -% Dependencies (they do not need to be defined at time of loading): -% -% - of course the various colour and dimension options handled via sphinx.sty -% - dimension register \spx@image@maxheight from sphinxlatexgraphics.sty -% - \savenotes/\spewnotes from sphinxpackagefootnote -% - \ifspx@inframed defined in sphinx.sty -% -% Requires: -\RequirePackage{framed} -\RequirePackage{sphinxpackageboxes} - -% At 5.1.0 the code formerly here in a definition of \spx@ShadowFBox has been -% refactored to hand over to a more powerful \spx@boxes@fcolorbox provided by -% file sphinxpackageboxes.sty, it can draw rounded corners and add a background -% color. - -% At 6.2.0, \spx@ShadowFBox is so much simplified that it is now not -% separately defined but directly incorporated into the \FrameCommand -% definition done by sphinxShadowBox environment below. - -% Use framed.sty \MakeFramed/\endMakeFramed to allow page breaks for topic -% boxes. Originally Sphinx used \shadowbox from fancybox.sty but it did not -% allow pagebreaks (which was problematic for "contents" directive if there -% are many subsections). -% -% Docutils does not allow topic to be nested within topics or other body -% elements. But the LaTeX code here does allow it: -% -% - a topic inside another topic would be rendered in a minipage (thus not -% allowing pagebreaks). Its external frame would adapt perfectly to -% the *current (smaller) width for text*. -% -% - a topic inside (nested) lists or quote environments would have its frame -% take the *full width* of the page, but its text contents on the other hand -% would obey exactly the current indentation plus inner separation. This is -% in contrast with the framing used for literal blocks, also based, but in a -% more sophisticated way on usage of \MakeFramed/\endMakeFramed, and -% adjusting to current text indentation. -\newenvironment{sphinxShadowBox} - {% - \spx@boxes@fcolorbox@setup{topic}% - % we will use the dimen registers from sphinxpackageboxes.sty which now hold - % the values from options related to topic/contents - % MEMO: \spx@boxes@fcolorbox creates an \hbox but does not quit vertical - % mode; but in context of framed.sty's \FrameCommand TeX is already - % in restricted horizontal mode, so no need for a \leavevmode here. - \def\FrameCommand {\spx@boxes@fcolorbox}% - % 6.2.0 adds support for div.topic_box-decoration-break=slice. - % (it is yet undecided if slice style should inhibit a bottom shadow) - \ifspx@topic@border@open - \def\FirstFrameCommand - {\spx@boxes@fcolorbox@setup@openbottom\FrameCommand}% - \def\MidFrameCommand - {\spx@boxes@fcolorbox@setup@openboth \FrameCommand}% - \def\LastFrameCommand - {\spx@boxes@fcolorbox@setup@opentop \FrameCommand}% - \fi - \advance\spx@image@maxheight - -\dimexpr\spx@boxes@border@top+\spx@boxes@border@bottom - +\spx@boxes@padding@top+\spx@boxes@padding@bottom - +\ifdim\spx@boxes@shadow@yoffset<\z@-\fi\spx@boxes@shadow@yoffset - +\baselineskip\relax - % configure framed.sty not to add extra vertical spacing - \ltx@ifundefined{OuterFrameSep}{}{\OuterFrameSep\z@skip}% - % the \trivlist will add the vertical spacing on top and bottom which is - % typical of center environment as used in Sphinx <= 1.4.1 - % the \noindent has the effet of an extra blank line on top, to - % imitate closely the layout from Sphinx <= 1.4.1; the \FrameHeightAdjust - % will put top part of frame on this baseline. - \def\FrameHeightAdjust {\baselineskip}% - % use package footnote to handle footnotes - \savenotes - \trivlist\item\noindent - % use a minipage if we are already inside a framed environment - \ifspx@inframed\begin{minipage}{\linewidth}\fi - \MakeFramed {\spx@inframedtrue - % framed.sty puts into "\width" the added width (padding+border widths) - % adjust \hsize to what the contents must use - \advance\hsize-\width - % adjust LaTeX parameters to behave properly in indented/quoted contexts - \FrameRestore - % typeset the contents as in a minipage (Sphinx <= 1.4.1 used a minipage and - % itemize/enumerate are therein typeset more tightly, we want to keep - % that). We copy-paste from LaTeX source code but don't do a real minipage. - \@pboxswfalse - \let\@listdepth\@mplistdepth \@mplistdepth\z@ - \@minipagerestore - \@setminipage - }% - \color@begingroup % workaround upstream framed.sty bug - \ifspx@topic@withtextcolor - \color{sphinxtopicTextColor}% - \fi - \spx@topic@TeXextras - }% - {% insert the "endminipage" code - \par\unskip - \color@endgroup % matches the \color@begingroup - \@minipagefalse - \endMakeFramed - \ifspx@inframed\end{minipage}\fi - \endtrivlist - % output the stored footnotes - \spewnotes - } - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexstyleheadings.sty b/crypto/krb5/doc/pdf/sphinxlatexstyleheadings.sty deleted file mode 100644 index b5e9c8543653..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexstyleheadings.sty +++ /dev/null @@ -1,86 +0,0 @@ -%% TITLES -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexstyleheadings.sty}[2023/02/11 headings] - -\RequirePackage[nobottomtitles*]{titlesec} -\@ifpackagelater{titlesec}{2016/03/15}% - {\@ifpackagelater{titlesec}{2016/03/21}% - {}% - {\newif\ifsphinx@ttlpatch@ok - \IfFileExists{etoolbox.sty}{% - \RequirePackage{etoolbox}% - \patchcmd{\ttlh@hang}{\parindent\z@}{\parindent\z@\leavevmode}% - {\sphinx@ttlpatch@oktrue}{}% - \ifsphinx@ttlpatch@ok - \patchcmd{\ttlh@hang}{\noindent}{}{}{\sphinx@ttlpatch@okfalse}% - \fi - }{}% - \ifsphinx@ttlpatch@ok - \typeout{^^J Package Sphinx Info: ^^J - **** titlesec 2.10.1 successfully patched for bugfix ****^^J}% - \else - \AtEndDocument{\PackageWarningNoLine{sphinx}{^^J% -******** titlesec 2.10.1 has a bug, (section numbers disappear) ......|^^J% -******** and Sphinx could not patch it, perhaps because your local ...|^^J% -******** copy is already fixed without a changed release date. .......|^^J% -******** If not, you must update titlesec! ...........................|}}% - \sphinxbuildwarning{badtitlesec}% - \fi - }% - }{} - -% Augment the sectioning commands used to get our own font family in place, -% and reset some internal data items (\titleformat from titlesec package) -\titleformat{\section}{\Large\py@HeaderFamily}% - {\py@TitleColor\thesection}{0.5em}{\py@TitleColor} -\titleformat{\subsection}{\large\py@HeaderFamily}% - {\py@TitleColor\thesubsection}{0.5em}{\py@TitleColor} -% \normalsize added as work-around to a lualatex-ja upstream problem -% https://osdn.net/projects/luatex-ja/ticket/47321 -\titleformat{\subsubsection}{\normalsize\py@HeaderFamily}% - {\py@TitleColor\thesubsubsection}{0.5em}{\py@TitleColor} -% By default paragraphs (and subsubsections) will not be numbered because -% sphinxmanual.cls and sphinxhowto.cls set secnumdepth to 2 -\titleformat{\paragraph}{\normalsize\py@HeaderFamily}% - {\py@TitleColor\theparagraph}{0.5em}{\py@TitleColor} -\titleformat{\subparagraph}{\normalsize\py@HeaderFamily}% - {\py@TitleColor\thesubparagraph}{0.5em}{\py@TitleColor} - - -% Since Sphinx 1.5, users should use HeaderFamily key to 'sphinxsetup' rather -% than defining their own \py@HeaderFamily command (which is still possible). -% Memo: \py@HeaderFamily is also used by \maketitle as defined in -% sphinxmanual.cls/sphinxhowto.cls -\newcommand{\py@HeaderFamily}{\spx@opt@HeaderFamily} - -% This sets up the fancy chapter headings that make the documents look -% at least a little better than the usual LaTeX output. -\@ifpackagewith{fncychap}{Bjarne}{ - \ChNameVar {\raggedleft\normalsize \py@HeaderFamily} - \ChNumVar {\raggedleft\Large \py@HeaderFamily} - \ChTitleVar{\raggedleft\Large \py@HeaderFamily} - % This creates (numbered) chapter heads without the leading \vspace*{}: - \def\@makechapterhead#1{% - {\parindent \z@ \raggedright \normalfont - \ifnum \c@secnumdepth >\m@ne - \if@mainmatter - \DOCH - \fi - \fi - \interlinepenalty\@M - \if@mainmatter - \DOTI{#1}% - \else% - \DOTIS{#1}% - \fi - }} -}{}% <-- "false" clause of \@ifpackagewith - -% fix fncychap's bug which uses prematurely the \textwidth value -\@ifpackagewith{fncychap}{Bjornstrup} - {\AtBeginDocument{\mylen\textwidth\advance\mylen-2\myhi}}% - {}% <-- "false" clause of \@ifpackagewith - - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexstylepage.sty b/crypto/krb5/doc/pdf/sphinxlatexstylepage.sty deleted file mode 100644 index 4066129bf24c..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexstylepage.sty +++ /dev/null @@ -1,79 +0,0 @@ -%% PAGE STYLING -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexstylepage.sty}[2021/01/27 page styling] - -% Separate paragraphs by space by default. -\IfFileExists{parskip-2001-04-09.sty}% since September 2018 TeXLive update -% new parskip.sty, but let it rollback to old one. -% hopefully TeX installation not broken and LaTeX kernel not too old - {\RequirePackage{parskip}[=v1]} -% standard one from 1989. Admittedly \section of article/book gives possibly -% anomalous spacing, but we can't require September 2018 release for some time. - {\RequirePackage{parskip}} - -% Style parameters and macros used by most documents here -\raggedbottom -\sloppy -\hbadness = 5000 % don't print trivial gripes - -% Require package fancyhdr except under memoir class -\@ifclassloaded{memoir}{}{\RequirePackage{fancyhdr}} -% Use \pagestyle{normal} as the primary pagestyle for text. -% Redefine the 'normal' header/footer style when using "fancyhdr" package: -\@ifpackageloaded{fancyhdr}{% - \ltx@ifundefined{c@chapter} - {% no \chapter, "howto" (non-Japanese) docclass - \fancypagestyle{plain}{ - \fancyhf{} - \fancyfoot[C]{{\py@HeaderFamily\thepage}} - \renewcommand{\headrulewidth}{0pt} - \renewcommand{\footrulewidth}{0pt} - } - % Same as 'plain', this way we can use it in template - % FIXME: shouldn't this have a running header with Name and Release like 'manual'? - \fancypagestyle{normal}{ - \fancyhf{} - \fancyfoot[C]{{\py@HeaderFamily\thepage}} - \renewcommand{\headrulewidth}{0pt} - \renewcommand{\footrulewidth}{0pt} - } - }% - {% classes with \chapter command - \fancypagestyle{normal}{ - \fancyhf{} - \fancyfoot[RO]{{\py@HeaderFamily\thepage}} - \fancyfoot[LO]{{\py@HeaderFamily\nouppercase{\rightmark}}} - \fancyhead[RO]{{\py@HeaderFamily \@title\sphinxheadercomma\py@release}} - \if@twoside - \fancyfoot[LE]{{\py@HeaderFamily\thepage}} - \fancyfoot[RE]{{\py@HeaderFamily\nouppercase{\leftmark}}} - \fancyhead[LE]{{\py@HeaderFamily \@title\sphinxheadercomma\py@release}} - \fi - \renewcommand{\headrulewidth}{0.4pt} - \renewcommand{\footrulewidth}{0.4pt} - % define chaptermark with \@chappos when \@chappos is available for Japanese - \ltx@ifundefined{@chappos}{} - {\def\chaptermark##1{\markboth{\@chapapp\space\thechapter\space\@chappos\space ##1}{}}} - } - % Update the plain style so we get the page number & footer line, - % but not a chapter or section title. This is to keep the first - % page of a chapter `clean.' - \fancypagestyle{plain}{ - \fancyhf{} - \fancyfoot[RO]{{\py@HeaderFamily\thepage}} - \if@twoside\fancyfoot[LE]{{\py@HeaderFamily\thepage}}\fi - \renewcommand{\headrulewidth}{0pt} - \renewcommand{\footrulewidth}{0.4pt} - } - } - } - {% no fancyhdr: memoir class - % Provide default for 'normal' style simply as an alias of 'plain' style - % This way we can use \pagestyle{normal} in LaTeX template - \def\ps@normal{\ps@plain} - % Users of memoir class are invited to redefine 'normal' style in preamble - } - - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatexstyletext.sty b/crypto/krb5/doc/pdf/sphinxlatexstyletext.sty deleted file mode 100644 index d90009035d25..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatexstyletext.sty +++ /dev/null @@ -1,181 +0,0 @@ -%% TEXT STYLING -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatexstyletext.sty}[2023/07/23 text styling] - -% Basically everything here consists of macros which are part of the latex -% markup produced by the Sphinx latex writer - -% But those arise rather from the default definitions of the respective -% latex environments done in sphinxlatexadmonitions.sty -\def\sphinxstylenotetitle #1{\sphinxstrong{#1} } -\let\sphinxstylehinttitle \sphinxstylenotetitle % #1 holds the localized notice name -\let\sphinxstyleimportanttitle\sphinxstylenotetitle % followed by a colon -\let\sphinxstyletiptitle \sphinxstylenotetitle -\let\sphinxstylewarningtitle \sphinxstylenotetitle -\let\sphinxstylecautiontitle \sphinxstylenotetitle -\let\sphinxstyleattentiontitle\sphinxstylenotetitle -\let\sphinxstyledangertitle \sphinxstylenotetitle -\let\sphinxstyleerrortitle \sphinxstylenotetitle -\def\sphinxstyleseealsotitle#1{\sphinxstrong{#1}\par\nopagebreak} -% -% A utility to remove a final colon. Removing last token is not easy in -% LaTeX, and there are additional complications: -% - some languages will make the : "active" in document body, -% - the generic admonition ends up using "note", so for \sphinxnotetitle to -% use it safely, the utility has to allow an input not having any final colon. -% - a bit far-fetched but maybe there is more than one colon inside the input -% (possible from a generic admonition title). -% Hence the scary code. -\def\sphinxremovefinalcolon#1{% #1 is the "active" : TeX token -\protected\def\sphinxremovefinalcolon ##1{% - % complications due to : possibly "active" - \begingroup\ifnum\catcode`:=\active - \def\x####1#1\relax{####1}% - \else\def\x####1:\relax{####1}\fi - \expandafter\endgroup\x##1\relax - % trick to let \x work also if input ##1 has no ending colon - \@gobblefour#1\relax:\relax\relax\relax - }% -}% end of wrapper to inject active : -\begingroup\catcode`:\active\expandafter\endgroup\sphinxremovefinalcolon: -% See doc/latex.rst for an example. - -% Some custom font markup commands. -\protected\def\sphinxstrong#1{\textbf{#1}} -\protected\def\sphinxcode#1{\texttt{#1}} -\protected\def\sphinxbfcode#1{\textbf{\sphinxcode{#1}}} -\protected\def\sphinxemail#1{\textsf{#1}} -\protected\def\sphinxtablecontinued#1{\textsf{#1}} -\protected\def\sphinxtitleref#1{\emph{#1}} -\protected\def\sphinxmenuselection#1{\emph{#1}} -\protected\def\sphinxguilabel#1{\emph{#1}} -\protected\def\sphinxkeyboard#1{\sphinxcode{#1}} -\protected\def\sphinxaccelerator#1{\underline{#1}} -\protected\def\sphinxcrossref#1{\emph{#1}} -\protected\def\sphinxtermref#1{\emph{#1}} -\protected\def\sphinxsamedocref#1{\emph{#1}} -\protected\def\sphinxparam#1{\emph{#1}} -\protected\def\sphinxtypeparam#1{\emph{#1}} -% \optional is used for ``[, arg]``, i.e. desc_optional nodes. -\long\protected\def\sphinxoptional#1{% - {\sphinxoptionalhook\textnormal{\Large[}}{#1}\hspace{0.5mm}{\textnormal{\Large]}}} -\let\sphinxoptionalhook\empty - -% additional customizable styling -\def\sphinxstyleindexentry #1{\texttt{#1}} -\def\sphinxstyleindexextra #1{ (\emph{#1})} -\def\sphinxstyleindexpageref #1{, \pageref{#1}} -\def\sphinxstyleindexpagemain#1{\textbf{#1}} -\def\spxentry{\@backslashchar spxentry}% let to \sphinxstyleindexentry in index -\def\spxextra{\@backslashchar spxextra}% let to \sphinxstyleindexextra in index -\def\sphinxstyleindexlettergroup #1% - {{\Large\sffamily#1}\nopagebreak\vspace{1mm}} -\def\sphinxstyleindexlettergroupDefault #1% - {{\Large\sffamily\sphinxnonalphabeticalgroupname}\nopagebreak\vspace{1mm}} -\protected\def\sphinxstyletopictitle #1{\textbf{#1}\par\medskip} -\let\sphinxstylesidebartitle\sphinxstyletopictitle -\protected\def\sphinxstyleothertitle #1{\textbf{#1}} -\protected\def\sphinxstylesidebarsubtitle #1{~\\\textbf{#1} \smallskip} -% \text.. commands do not allow multiple paragraphs -% attention, this one is not self-delimiting -\protected\def\sphinxstyletheadfamily {\sffamily} -\protected\def\sphinxstyleemphasis #1{\emph{#1}} -\protected\def\sphinxstyleliteralemphasis#1{\emph{\sphinxcode{#1}}} -\protected\def\sphinxstylestrong #1{\textbf{#1}} -\protected\def\sphinxstyleliteralstrong#1{\sphinxbfcode{#1}} -\protected\def\sphinxstyleabbreviation #1{\textsc{#1}} -\protected\def\sphinxstyleliteralintitle#1{\sphinxcode{#1}} -\newcommand*\sphinxstylecodecontinued[1]{{\footnotesize(#1)}}% -\newcommand*\sphinxstylecodecontinues[1]{{\footnotesize(#1)}}% -% figure legend comes after caption and may contain arbitrary body elements -\newenvironment{sphinxlegend}{\par\small}{\par} -% reduce hyperref "Token not allowed in a PDF string" warnings on PDF builds -\AtBeginDocument{\pdfstringdefDisableCommands{% -% all "protected" macros possibly ending up in section titles should be here -% TODO: examine if \sphinxhref, \sphinxurl, \sphinnolinkurl should be handled - \let\sphinxstyleemphasis \@firstofone - \let\sphinxstyleliteralemphasis \@firstofone - \let\sphinxstylestrong \@firstofone - \let\sphinxstyleliteralstrong \@firstofone - \let\sphinxstyleabbreviation \@firstofone - \let\sphinxstyleliteralintitle \@firstofone - \let\sphinxupquote \@firstofone - \let\sphinxstrong \@firstofone - \let\sphinxcode \@firstofone - \let\sphinxbfcode \@firstofone - \let\sphinxemail \@firstofone - \let\sphinxcrossref \@firstofone - \let\sphinxtermref \@firstofone - \let\sphinxsamedocref\@firstofone - \let\sphinxhyphen\sphinxhyphenforbookmarks - \def\PYG#1#2{#2}% (can not yet appear in section titles, but perhaps in future) -}} - -% Special characters -% -\def\sphinxparamcomma{, }% by default separate parameters with comma + space -% If the signature is rendered with one line per param, this wil be used -% instead (this \texttt makes the comma slightly more distinctive). -\def\sphinxparamcommaoneperline{\texttt{,}} -% -% The \kern\z@ is to prevent en-dash and em-dash TeX ligatures. -% A linebreak can occur after the dash in regular text (this is -% normal behaviour of "-" in TeX, it is not related to \kern\z@). -% -% Parsed-literals and inline literals also use the \sphinxhyphen -% but linebreaks there are prevented due to monospace font family. -% (xelatex needs a special addition, cf. sphinxlatexliterals.sty) -% -% Inside code-blocks, dashes are escaped via another macro, from -% Pygments latex output (search for \PYGZhy in sphinxlatexliterals.sty), -% and are configured to allow linebreaks despite the monospace font. -% (the #1 swallows the {} from \sphinxhyphen{} mark-up) -\protected\def\sphinxhyphen#1{-\kern\z@} -\protected\def\sphinxhyphennobreak#1{\mbox{-}} -% The {} from texescape mark-up is kept, else -- gives en-dash in PDF bookmark -\def\sphinxhyphenforbookmarks{-} - -% For curly braces inside \index macro -\def\sphinxleftcurlybrace{\{} -\def\sphinxrightcurlybrace{\}} - -% Declare Unicode characters used by linux tree command to pdflatex utf8/utf8x -\def\spx@bd#1#2{% - \leavevmode - \begingroup - \ifx\spx@bd@height \@undefined\def\spx@bd@height{\baselineskip}\fi - \ifx\spx@bd@width \@undefined\setbox0\hbox{0}\def\spx@bd@width{\wd0 }\fi - \ifx\spx@bd@thickness\@undefined\def\spx@bd@thickness{.6\p@}\fi - \ifx\spx@bd@lower \@undefined\def\spx@bd@lower{\dp\strutbox}\fi - \lower\spx@bd@lower#1{#2}% - \endgroup -}% -\@namedef{sphinx@u2500}% BOX DRAWINGS LIGHT HORIZONTAL - {\spx@bd{\vbox to\spx@bd@height} - {\vss\hrule\@height\spx@bd@thickness - \@width\spx@bd@width\vss}}% -\@namedef{sphinx@u2502}% BOX DRAWINGS LIGHT VERTICAL - {\spx@bd{\hb@xt@\spx@bd@width} - {\hss\vrule\@height\spx@bd@height - \@width \spx@bd@thickness\hss}}% -\@namedef{sphinx@u2514}% BOX DRAWINGS LIGHT UP AND RIGHT - {\spx@bd{\hb@xt@\spx@bd@width} - {\hss\raise.5\spx@bd@height - \hb@xt@\z@{\hss\vrule\@height.5\spx@bd@height - \@width \spx@bd@thickness\hss}% - \vbox to\spx@bd@height{\vss\hrule\@height\spx@bd@thickness - \@width.5\spx@bd@width\vss}}}% -\@namedef{sphinx@u251C}% BOX DRAWINGS LIGHT VERTICAL AND RIGHT - {\spx@bd{\hb@xt@\spx@bd@width} - {\hss - \hb@xt@\z@{\hss\vrule\@height\spx@bd@height - \@width \spx@bd@thickness\hss}% - \vbox to\spx@bd@height{\vss\hrule\@height\spx@bd@thickness - \@width.5\spx@bd@width\vss}}}% -\protected\def\sphinxunichar#1{\@nameuse{sphinx@u#1}}% - -% Tell TeX about pathological hyphenation cases: -\hyphenation{Base-HTTP-Re-quest-Hand-ler} - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxlatextables.sty b/crypto/krb5/doc/pdf/sphinxlatextables.sty deleted file mode 100644 index 9e4453259d69..000000000000 --- a/crypto/krb5/doc/pdf/sphinxlatextables.sty +++ /dev/null @@ -1,1246 +0,0 @@ -%% TABLES (WITH SUPPORT FOR MERGED CELLS OF GENERAL CONTENTS) -% -% change this info string if making any custom modification -\ProvidesFile{sphinxlatextables.sty}[2022/08/15 tables]% - -% Provides support for this output mark-up from Sphinx latex writer -% and table templates: -% -% - the tabulary and longtable environments from the eponymous packages -% - the varwidth environment -% - the >{} etc mark-up possible in tabularcolumns is from array package -% which is loaded by longtable and tabulary -% - \X, \Y, T column types; others (L, C, R, J) are from tabulary package -% - \sphinxaftertopcaption -% - \sphinxatlongtableend -% - \sphinxatlongtablestart -% - \sphinxattableend -% - \sphinxattablestart -% - \sphinxcapstartof -% - \sphinxcolwidth -% - \sphinxlongtablecapskipadjust -% - \sphinxmultirow -% - \sphinxstartmulticolumn -% - \sphinxstopmulticolumn -% - \sphinxtablestrut -% - \sphinxthecaptionisattop -% - \sphinxthelongtablecaptionisattop -% - \sphinxhline -% - \sphinxcline -% - \sphinxvlinecrossing -% - \sphinxfixclines -% - \sphinxtoprule -% - \sphinxmidrule -% - \sphinxbottomrule -% - \sphinxtableatstartofbodyhook -% - \sphinxtableafterendhook -% - \sphinxthistablewithglobalstyle -% - \sphinxthistablewithbooktabsstyle -% - \sphinxthistablewithborderlessstyle -% - \sphinxthistablewithstandardstyle -% - \sphinxthistablewithcolorrowsstyle -% - \sphinxthistablewithnocolorrowsstyle -% - \sphinxthistablewithvlinesstyle -% - \sphinxthistablewithnovlinesstyle -% -% Executes \RequirePackage for: -% -% - tabulary -% - longtable -% - varwidth -% - colortbl -% - booktabs if 'booktabs' in latex_table_style -% -% Extends tabulary and longtable via patches and custom macros to support -% merged cells possibly containing code-blocks in complex tables - -\RequirePackage{tabulary} -% tabulary has a bug with its re-definition of \multicolumn in its first pass -% which is not \long. But now Sphinx does not use LaTeX's \multicolumn but its -% own macro. Hence we don't even need to patch tabulary. See -% sphinxpackagemulticell.sty -% X or S (Sphinx) may have meanings if some table package is loaded hence -% \X was chosen to avoid possibility of conflict -\newcolumntype{\X}[2]{p{\dimexpr - (\linewidth-\spx@arrayrulewidth)*#1/#2-\tw@\tabcolsep-\spx@arrayrulewidth\relax}} -\newcolumntype{\Y}[1]{p{\dimexpr - #1\dimexpr\linewidth-\spx@arrayrulewidth\relax-\tw@\tabcolsep-\spx@arrayrulewidth\relax}} -% \spx@arrayrulewidth is used internally and its meaning will be set according -% to the table type; no extra user code should modify it. In particular any -% \setlength{\spx@arrayrulewidth}{...} may break all of LaTeX... (really...) -\def\spx@arrayrulewidth{\arrayrulewidth}% 5.3.0, to be adjusted by each table -% using here T (for Tabulary) feels less of a problem than the X could be -\newcolumntype{T}{J}% -% For tables allowing pagebreaks -\RequirePackage{longtable} -% User interface to set-up whitespace before and after tables: -\newcommand*\sphinxtablepre {0pt}% -\newcommand*\sphinxtablepost{\medskipamount}% -% Space from caption baseline to top of table or frame of literal-block -\newcommand*\sphinxbelowcaptionspace{.5\sphinxbaselineskip}% -% as one can not use \baselineskip from inside longtable (it is zero there) -% we need \sphinxbaselineskip, which defaults to \baselineskip -\def\sphinxbaselineskip{\baselineskip}% -% The following is to ensure that, whether tabular(y) or longtable: -% - if a caption is on top of table: -% a) the space between its last baseline and the top rule of table is -% exactly \sphinxbelowcaptionspace -% b) the space from last baseline of previous text to first baseline of -% caption is exactly \parskip+\baselineskip+ height of a strut. -% c) the caption text will wrap at width \LTcapwidth (4in) -% - make sure this works also if "caption" package is loaded by user -% (with its width or margin option taking place of \LTcapwidth role) -% TODO: obtain same for caption of literal block: a) & c) DONE, b) TO BE DONE -% -% To modify space below such top caption, adjust \sphinxbelowcaptionspace -% To add or remove space above such top caption, adjust \sphinxtablepre: -% notice that \abovecaptionskip, \belowcaptionskip, \LTpre are **ignored** -% A. Table with longtable -\def\sphinxatlongtablestart - {\par - \vskip\parskip - \vskip\dimexpr\sphinxtablepre\relax % adjust vertical position - \vbox{}% get correct baseline from above - \LTpre\z@skip\LTpost\z@skip % set to zero longtable's own skips - \edef\sphinxbaselineskip{\dimexpr\the\dimexpr\baselineskip\relax\relax}% - }% -% Compatibility with caption package -\def\sphinxthelongtablecaptionisattop{% - \spx@ifcaptionpackage{\noalign{\vskip-\belowcaptionskip}}{}% -}% -% Achieves exactly \sphinxbelowcaptionspace below longtable caption -\def\sphinxlongtablecapskipadjust - {\dimexpr-\dp\strutbox - -\spx@ifcaptionpackage{\abovecaptionskip}{\sphinxbaselineskip}% - +\sphinxbelowcaptionspace\relax}% -\def\sphinxatlongtableend{\@nobreakfalse % latex3/latex2e#173 - \prevdepth\z@\vskip\sphinxtablepost\relax}% -% B. Table with tabular or tabulary -\def\sphinxattablestart{\par\vskip\dimexpr\sphinxtablepre\relax}% -\let\sphinxattableend\sphinxatlongtableend -% This is used by tabular and tabulary templates -\newcommand*\sphinxcapstartof[1]{% - \vskip\parskip - \vbox{}% force baselineskip for good positioning by capstart of hyperanchor - % hyperref puts the anchor 6pt above this baseline; in case of caption - % this baseline will be \ht\strutbox above first baseline of caption - \def\@captype{#1}% - \capstart -% move back vertically, as tabular (or its caption) will compensate - \vskip-\baselineskip\vskip-\parskip -}% -\def\sphinxthecaptionisattop{% locate it after \sphinxcapstartof - \spx@ifcaptionpackage - {\caption@setposition{t}% - \vskip\baselineskip\vskip\parskip % undo those from \sphinxcapstartof - \vskip-\belowcaptionskip % anticipate caption package skip - % caption package uses a \vbox, not a \vtop, so "single line" case - % gives different result from "multi-line" without this: - \nointerlineskip - }% - {}% -}% -\def\sphinxthecaptionisatbottom{% (not finalized; for template usage) - \spx@ifcaptionpackage{\caption@setposition{b}}{}% -}% -% The aim of \sphinxcaption is to apply to tabular(y) the maximal width -% of caption as done by longtable -\def\sphinxtablecapwidth{\LTcapwidth}% -\newcommand\sphinxcaption{\@dblarg\spx@caption}% -\long\def\spx@caption[#1]#2{% - \noindent\hb@xt@\linewidth{\hss - \vtop{\@tempdima\dimexpr\sphinxtablecapwidth\relax -% don't exceed linewidth for the caption width - \ifdim\@tempdima>\linewidth\hsize\linewidth\else\hsize\@tempdima\fi -% longtable ignores \abovecaptionskip/\belowcaptionskip, so do the same here - \abovecaptionskip\sphinxabovecaptionskip % \z@skip - \belowcaptionskip\sphinxbelowcaptionskip % \z@skip - \caption[{#1}]% - {\strut\ignorespaces#2\ifhmode\unskip\@finalstrut\strutbox\fi}% - }\hss}% - \par\prevdepth\dp\strutbox -}% -\def\sphinxabovecaptionskip{\z@skip}% Do not use! Flagged for removal -\def\sphinxbelowcaptionskip{\z@skip}% Do not use! Flagged for removal -% This wrapper of \abovecaptionskip is used in sphinxVerbatim for top -% caption, and with another value in sphinxVerbatimintable -% TODO: To unify space above caption of a code-block with the one above -% caption of a table/longtable, \abovecaptionskip must not be used -% This auxiliary will get renamed and receive a different meaning -% in future. -\def\spx@abovecaptionskip{\abovecaptionskip}% -% Achieve \sphinxbelowcaptionspace below a caption located above a tabular -% or a tabulary -\newcommand\sphinxaftertopcaption -{% - \spx@ifcaptionpackage - {\par\prevdepth\dp\strutbox\nobreak\vskip-\abovecaptionskip}{\nobreak}% - \vskip\dimexpr\sphinxbelowcaptionspace\relax - \vskip-\baselineskip\vskip-\parskip -}% -% varwidth is crucial for our handling of general contents in merged cells -\RequirePackage{varwidth} -% but addition of a compatibility patch with hyperref is needed -% (tested with varwidth v 0.92 Mar 2009) -\AtBeginDocument {% - \let\@@vwid@Hy@raisedlink\Hy@raisedlink - \long\def\@vwid@Hy@raisedlink#1{\@vwid@wrap{\@@vwid@Hy@raisedlink{#1}}}% - \edef\@vwid@setup{% - \let\noexpand\Hy@raisedlink\noexpand\@vwid@Hy@raisedlink % HYPERREF ! - \unexpanded\expandafter{\@vwid@setup}}% -}% - -% NOTA BENE: since the multicolumn and multirow code was written Sphinx -% decided to prefix non public internal macros by \spx@ and in fact all -% such macros here should now be prefixed by \spx@table@, but doing the -% update is delayed to later. (written at 5.3.0) - -%%%%%%%%%%%%%%%%%%%%% -% --- MULTICOLUMN --- -% standard LaTeX's \multicolumn -% 1. does not allow verbatim contents, -% 2. interacts very poorly with tabulary. -% -% It is needed to write own macros for Sphinx: to allow code-blocks in merged -% cells rendered by tabular/longtable, and to allow multi-column cells with -% paragraphs to be taken into account sanely by tabulary algorithm for column -% widths. -% -% This requires quite a bit of hacking. First, in Sphinx, the multi-column -% contents will *always* be wrapped in a varwidth environment. The issue -% becomes to pass it the correct target width. We must trick tabulary into -% believing the multicolumn is simply separate columns, else tabulary does not -% incorporate the contents in its algorithm. But then we must clear the -% vertical rules... -% -% configuration of tabulary -\setlength{\tymin}{3\fontcharwd\font`0 }% minimal width of "squeezed" columns -\setlength{\tymax}{10000pt}% allow enough room for paragraphs to "compete" -% we need access to tabulary's final computed width. \@tempdima is too volatile -% to hope it has kept tabulary's value when \sphinxcolwidth needs it. -\newdimen\sphinx@TY@tablewidth -\def\tabulary{% - \def\TY@final{\sphinx@TY@tablewidth\@tempdima\tabular}% - \let\endTY@final\endtabular - \TY@tabular}% -% next hack is needed only if user has set latex_use_latex_multicolumn to True: -% it fixes tabulary's bug with \multicolumn defined "short" in first pass. (if -% upstream tabulary adds a \long, our extra one causes no harm) -\def\sphinx@tempa #1\def\multicolumn#2#3#4#5#6#7#8#9\sphinx@tempa - {\def\TY@tab{#1\long\def\multicolumn####1####2####3{\multispan####1\relax}#9}}% -\expandafter\sphinx@tempa\TY@tab\sphinx@tempa -% -% TN. 1: as \omit is never executed, Sphinx multicolumn does not need to worry -% like standard multicolumn about |l| vs l|. On the other hand it assumes -% columns are separated by a | ... (if not it will add extraneous -% \arrayrulewidth space for each column separation in its estimate of available -% width). -% -% Update at 5.3.0: code uses \spx@arrayrulewidth which is kept in sync with the -% table column specification (aka preamble): -% - no | in preamble: \spx@arrayrulewidth -> \z@ -% - at least a | in the preamble: \spx@arrayrulewidth -> \arrayrulewidth -% This is used for computation of merged cells widths. Mixed preambles using -% at least a | but not using it for all columns (as can be obtained via the -% tabularcolumns directive) may cause some merged cells contents to be slightly -% shifted to the left as they assume merged columns are | separated where in -% fact they perhaps are not. -% -% TN. 1b: as Sphinx multicolumn uses neither \omit nor \span, it can not -% (easily) get rid of extra macros from >{...} or <{...} between columns. At -% least, it has been made compatible with colortbl's \columncolor. -% -% TN. 2: tabulary's second pass is handled like tabular/longtable's single -% pass, with the difference that we hacked \TY@final to set in -% \sphinx@TY@tablewidth the final target width as computed by tabulary. This is -% needed only to handle columns with a "horizontal" specifier: "p" type columns -% (inclusive of tabulary's LJRC) holds the target column width in the -% \linewidth dimension. -% -% TN. 3: use of \begin{sphinxmulticolumn}...\end{sphinxmulticolumn} mark-up -% would need some hacking around the fact that groups can not span across table -% cells (the code does inserts & tokens, see TN1b). It was decided to keep it -% simple with \sphinxstartmulticolumn...\sphinxstopmulticolumn. -% -% MEMO about nesting: if sphinxmulticolumn is encountered in a nested tabular -% inside a tabulary it will think to be at top level in the tabulary. But -% Sphinx generates no nested tables, and if some LaTeX macro uses internally a -% tabular this will not have a \sphinxstartmulticolumn within it! -% -% 5.3.0 adds a check for multirow as single-row multi-column will allow a row -% colour but multi-row multi-column should not. -% Attention that this assumes \sphinxstartmulticolumn is always followed -% in latex mark-up either by \sphinxmultirow or \begin (from \begin{varwidth}). -\def\sphinxstartmulticolumn#1#2{% - \ifx\sphinxmultirow#2% - \gdef\spx@table@hackCT@inmergedcell{\spx@table@hackCT@nocolor}% - \else - \global\let\spx@table@hackCT@inmergedcell\spx@@table@hackCT@inmergedcell - \fi - \sphinx@startmulticolumn{#1}#2% -}% -\def\sphinx@startmulticolumn{% - \ifx\equation$% $ tabulary's first pass - \expandafter\sphinx@TYI@start@multicolumn - \else % either not tabulary or tabulary's second pass - \expandafter\sphinx@start@multicolumn - \fi -}% -\def\sphinxstopmulticolumn{% - \ifx\equation$% $ tabulary's first pass - \expandafter\sphinx@TYI@stop@multicolumn - \else % either not tabulary or tabulary's second pass - \ignorespaces - \fi -}% -\def\sphinx@TYI@start@multicolumn#1{% - % use \gdef always to avoid stack space build up - \gdef\sphinx@tempa{#1}\begingroup\setbox\z@\hbox\bgroup -}% -\def\sphinx@TYI@stop@multicolumn{\egroup % varwidth was used with \tymax - \xdef\sphinx@tempb{\the\dimexpr\wd\z@/\sphinx@tempa}% per column width - \endgroup - \expandafter\sphinx@TYI@multispan\expandafter{\sphinx@tempa}% -}% -\def\sphinx@TYI@multispan #1{% - \kern\sphinx@tempb\ignorespaces % the per column occupied width - \ifnum#1>\@ne % repeat, taking into account subtleties of TeX's & ... - \expandafter\sphinx@TYI@multispan@next\expandafter{\the\numexpr#1-\@ne\expandafter}% - \fi -}% -\def\sphinx@TYI@multispan@next{&\relax\sphinx@TYI@multispan}% -% -% Now the branch handling either the second pass of tabulary or the single pass -% of tabular/longtable. This is the delicate part where we gather the -% dimensions from the p columns either set-up by tabulary or by user p column -% or Sphinx \X, \Y columns. The difficulty is that to get the said width, the -% template must be inserted (other hacks would be horribly complicated except -% if we rewrote crucial parts of LaTeX's \@array !) and we can not do -% \omit\span like standard \multicolumn's easy approach. Thus we must cancel -% the \vrule separators. Also, perhaps the column specifier is of the l, c, r -% type, then we attempt an ad hoc rescue to give varwidth a reasonable target -% width. -\def\sphinx@start@multicolumn#1{% - \gdef\sphinx@multiwidth{0pt}\gdef\sphinx@tempa{#1}\sphinx@multispan{#1}% -}% -\def\sphinx@multispan #1{% - \ifnum#1=\@ne\expandafter\sphinx@multispan@end - \else\expandafter\sphinx@multispan@next - \fi {#1}% -}% -\def\sphinx@multispan@next #1{% - % trick to recognize L, C, R, J or p, m, b type columns - \ifdim\baselineskip>\z@ - \gdef\sphinx@tempb{\linewidth}% - \else - % if in an l, r, c type column, try and hope for the best - \xdef\sphinx@tempb{\the\dimexpr(\ifx\TY@final\@undefined\linewidth\else - \sphinx@TY@tablewidth\fi-\spx@arrayrulewidth)/\sphinx@tempa - -\tw@\tabcolsep-\spx@arrayrulewidth\relax}% - \fi - \noindent\kern\sphinx@tempb\relax - \xdef\sphinx@multiwidth - {\the\dimexpr\sphinx@multiwidth+\sphinx@tempb+\tw@\tabcolsep+\spx@arrayrulewidth}% - \spx@table@hackCT@fixcolorpanel - % silence a | column separator in our merged cell - \spx@table@hackCT@inhibitvline - % prevent column colours to interfere with our multi-column but allow row - % colour (we can't obey a \cellcolor as it has not be seen yet at this stage) - \spx@table@hackCT@inmergedcell&\relax - % repeat - \expandafter\sphinx@multispan\expandafter{\the\numexpr#1-\@ne}% -}% -\def\sphinx@multispan@end#1{% - % first, trace back our steps horizontally - \noindent\kern-\dimexpr\sphinx@multiwidth\relax - % and now we set the final computed width for the varwidth environment - \ifdim\baselineskip>\z@ - \xdef\sphinx@multiwidth{\the\dimexpr\sphinx@multiwidth+\linewidth}% - \else - \xdef\sphinx@multiwidth{\the\dimexpr\sphinx@multiwidth+ - (\ifx\TY@final\@undefined\linewidth\else - \sphinx@TY@tablewidth\fi-\spx@arrayrulewidth)/\sphinx@tempa - -\tw@\tabcolsep-\spx@arrayrulewidth\relax}% - \fi - % last cell of the multi-column - \aftergroup\spx@table@hackCT@fixcolorpanel - \aftergroup\spx@table@hackCT@inmergedcell -}% -\newcommand*\sphinxcolwidth[2]{% - % this dimension will always be used for varwidth, and serves as maximum - % width when cells are merged either via multirow or multicolumn or both, - % as always their contents is wrapped in varwidth environment. - \ifnum#1>\@ne % multi-column (and possibly also multi-row) - % we wrote our own multicolumn code especially to handle that (and allow - % verbatim contents) - \ifx\equation$%$ - \tymax % first pass of tabulary (cf MEMO above regarding nesting) - \else % the \@gobble thing is for compatibility with standard \multicolumn - \sphinx@multiwidth\@gobble{#1/#2}% - \fi - \else % single column multirow - \ifx\TY@final\@undefined % not a tabulary. - \ifdim\baselineskip>\z@ - % in a p{..} type column, \linewidth is the target box width - \linewidth - \else - % l, c, r columns. Do our best. - \dimexpr(\linewidth-\spx@arrayrulewidth)/#2- - \tw@\tabcolsep-\spx@arrayrulewidth\relax - \fi - \else % in tabulary - \ifx\equation$%$% first pass - \tymax % it is set to a big value so that paragraphs can express themselves - \else - % second pass. - \ifdim\baselineskip>\z@ - \linewidth % in a L, R, C, J column or a p, \X, \Y ... - \else - % we have hacked \TY@final to put in \sphinx@TY@tablewidth the table width - \dimexpr(\sphinx@TY@tablewidth-\spx@arrayrulewidth)/#2- - \tw@\tabcolsep-\spx@arrayrulewidth\relax - \fi - \fi - \fi - \fi -}% -% fallback default in case user has set latex_use_latex_multicolumn to True: -% \sphinxcolwidth will use this only inside LaTeX's standard \multicolumn -\def\sphinx@multiwidth #1#2{\dimexpr % #1 to gobble the \@gobble (!) - (\ifx\TY@final\@undefined\linewidth\else\sphinx@TY@tablewidth\fi - -\spx@arrayrulewidth)*#2-\tw@\tabcolsep-\spx@arrayrulewidth\relax}% - -% \spx@table@hackCT@inhibitvline -% packages like colortbl add group levels, we need to "climb back up" to be -% able to hack the \vline and also the colortbl inserted tokens. The hack -% sets the \arrayrulewidth to \z@ to inhibit a | separator at right end -% of the cell, if present (our code does not use \omit so can not avoid the -% \vline insertion, but setting its width to zero makes it do nothing). -% Some subtlety with colour panels must be taken care of. -\def\spx@table@hackCT@inhibitvline{\ifnum\currentgrouptype=6\relax - \kern\spx@arrayrulewidth % will be compensated by extra colour panel left overhang - \arrayrulewidth\z@% trick to inhibit the {\vrule width \arrayrulewidth} - \else\aftergroup\spx@table@hackCT@inhibitvline\fi}% - -% hacking around colour matters -% Sphinx 1.6 comment: -% It turns out \CT@row@color is not expanded contrarily to \CT@column@color -% during LaTeX+colortbl preamble preparation, hence it would be possible for -% \CT@setup to discard only the column color and choose to obey or not -% row color and cell color. It would even be possible to propagate cell color -% to row color for the duration of the Sphinx multicolumn... the (provisional?) -% choice has been made to cancel the colortbl colours for the multicolumn -% duration. -% Sphinx 5.3.0 comment: -% - colortbl has no mechanism to disable colour background in a given cell: -% \cellcolor triggers one more \color, but has no possibility to revert -% a previously emitted \color, only to override it via an additional \color -% - prior to 5.3.0, Sphinx did not officially support colour in tables, -% but it did have a mechanism to protect merged cells from being partly -% covered by colour panels at various places. At 5.3.0 this mechanism -% is relaxed a bit to allow row colour for a single-row merged cell. -% -% fixcolorpanel -\def\spx@table@hackCT@fixcolorpanel{\ifnum\currentgrouptype=6\relax - \edef\spx@table@leftcolorpanelextra - % \edef as \arrayrulewidth will be set to \z@ next, - % hence also \spx@arrayrulewidth... - {\sphinxcolorpanelextraoverhang+\the\spx@arrayrulewidth}% - \else\aftergroup\spx@table@hackCT@fixcolorpanel\fi}% -% -% inmergedcell -% \spx@table@hackCT@inmergedcell will be locally set to either this -% \spx@@table@hackCT@inmergedcell or to \spx@table@hackCT@nocolor -% "\let\spx@original@CT@setup\CT@setup" is done after loading colortbl -\def\spx@@table@hackCT@inmergedcell{\ifnum\currentgrouptype=6\relax - \let\CT@setup\spx@CT@setup@inmergedcell - \else\aftergroup\spx@@table@hackCT@inmergedcell\fi -}% -\newif\ifspx@table@inmergedcell -\def\spx@CT@setup@inmergedcell #1\endgroup{% - % - obey only row color and disable effect of \sphinxcolorblend - % - turn on the inmergedcell boolean to signal to \CT@row@color - \spx@original@CT@setup - \spx@table@inmergedcelltrue % needed by \CT@row@color - % deactivate effect of \sphinxcolorblend if it happened at all - \ifdefined\blendcolors\blendcolors{}\fi - \CT@row@color - \CT@do@color - \global\let\CT@cell@color\relax - \endgroup -}% -% -% nocolor -\def\spx@table@hackCT@nocolor{\ifnum\currentgrouptype=6\relax -% sadly \CT@column@color is possibly already expanded so we can't -% simply do \let\CT@column@color\relax etc... -% admittedly we could perhaps hack \CT@color but well - \let\CT@setup\spx@CT@setup@nocolor - \else\aftergroup\spx@table@hackCT@nocolor\fi -} -\def\spx@CT@setup@nocolor#1\endgroup{% - \global\let\CT@cell@color\relax - % the above fix was added at 5.3.0 - % formerly a \cellcolor added by a raw latex directive in the merged cell - % would have caused colour to apply to the *next* cell after the merged - % one; we don't support \cellcolor from merged cells contents anyhow. - \endgroup} -% -% norowcolor -\def\spx@table@hackCT@norowcolor{% -% a bit easier although merged cells complicate the matter as they do need -% to keep the rowcolor; and we can't know yet if we are in a merged cell - \ifnum\currentgrouptype=6\relax - \ifx\CT@row@color\relax - \else - \let\spx@saved@CT@row@color\CT@row@color - \def\CT@row@color{% - \ifspx@table@inmergedcell\expandafter\spx@saved@CT@row@color\fi - }% - \fi - \else\aftergroup\spx@table@hackCT@norowcolor\fi -} -% -% \sphinxcolorblend -\def\spx@table@hackCT@colorblend{% - \ifnum\currentgrouptype=6\relax - \expandafter\blendcolors\spx@colorblendparam - % merged cells will do a \blendcolors{} to cancel the effet - % we can not know here yet if in merged cell as the boolean - % \ifspx@table@inmergedcell is not yet updated - \else - \aftergroup\spx@table@hackCT@colorblend - \fi -} -\def\sphinxcolorblend#1{\gdef\spx@colorblendparam{{#1}}\spx@table@hackCT@colorblend} -% Either xcolor.sty exists on user system and has been loaded by sphinx.sty, -% or it does not exist, so we can use \@ifpackageloaded without delaying. -\@ifpackageloaded{xcolor}% - {}% - {\def\sphinxcolorblend#1{% -\PackageWarning{sphinx}{This table uses \string\sphinxcolorblend\space - but xcolor is not in\MessageBreak - the TeX/LaTeX installation, the command will be\MessageBreak - ignored in this and the next tables}% - \global\let\sphinxcolorblend\@gobble - \sphinxbuildwarning{colorblend}% - }% - } - - -%%%%%%%%%%%%%%%%%% -% --- MULTIROW --- -% standard \multirow -% 1. does not allow verbatim contents, -% 2. does not allow blank lines in its argument, -% 3. its * specifier means to typeset "horizontally" which is very -% bad for paragraph content. 2016 version has = specifier but it -% must be used with p type columns only, else results are bad, -% 4. it requires manual intervention if the contents is too long to fit -% in the asked-for number of rows. -% 5. colour panels (either from \rowcolor or \columncolor) will hide -% the bottom part of multirow text, hence manual tuning is needed -% to put the multirow insertion at the _bottom_. -% -% The Sphinx solution consists in always having contents wrapped -% in a varwidth environment so that it makes sense to estimate how many -% lines it will occupy, and then ensure by insertion of suitable struts -% that the table rows have the needed height. The needed mark-up is done -% by LaTeX writer, which has its own id for the merged cells. -% -% The colour issue is "solved" by clearing colour panels in all cells, -% whether or not the multirow is single-column or multi-column. -% -% MEMO at 5.3.0: to allow a multirow cell in a single column to react to -% \columncolor correctly, it seems only way is that the contents -% are inserted by bottom cell (this is mentioned in multirow.sty doc, too). -% Sphinx could at Python level "move" the contents to that cell. But the -% mechanism used here via \sphinxtablestrut to enlarge rows to make room for -% the contents if needed becomes more challenging yet, because \sphinxtablestrut -% mark-up will be parsed by TeX *before* it sees the contents of the merged -% cell.. So it seems the best way would be to actually store the contents into -% some owned-by-Sphinx box storage which needs to be globally allocated to -% that usage ; then we need multiple such boxes, say at least 5 to cover -% 99% or use case. Or perhaps some trick with storing in a \vbox and recovering -% via some \vsplit but this becomes complicated... perhaps in future. -% -% In passing we obtain baseline alignements across rows (only if -% \arraystretch is 1, as LaTeX's does not obey \arraystretch in "p" -% multi-line contents, only first and last line...) -% -% TODO: examine the situation with \arraystretch > 1. The \extrarowheight -% is hopeless for multirow anyhow, it makes baseline alignment strictly -% impossible. -\newcommand\sphinxmultirow[2]{\begingroup - % #1 = nb of spanned rows, #2 = Sphinx id of "cell", #3 = contents - % but let's fetch #3 in a way allowing verbatim contents ! - \def\sphinx@nbofrows{#1}\def\sphinx@cellid{#2}% - \afterassignment\sphinx@multirow\let\next= -}% -\def\sphinx@multirow {% - \setbox\z@\hbox\bgroup\aftergroup\sphinx@@multirow\strut -}% -\def\sphinx@@multirow {% -% MEMO: we could check status of \CT@cell@color here, but unfortunately we -% can't know the exact height which will be covered by the cells in total -% (it may be more than our \box\z@ dimensions). We could use an \fcolorbox -% wrapper on \box\z@ but this will not extend precisely to the bottom rule. -% -% Only solution if we want to obey a raw \cellcolor, or a \columncolor, seems -% to delay unboxing the gathered contents as part of the bottom row with -% a suitable vertical adjustment... -% - % The contents, which is a varwidth environment, has been captured in - % \box0 (a \hbox). - % We have with \sphinx@cellid an assigned unique id. The goal is to give - % about the same height to all the involved rows. - % For this Sphinx will insert a \sphinxtablestrut{cell_id} mark-up - % in LaTeX file and the expansion of the latter will do the suitable thing. - \dimen@\dp\z@ - \dimen\tw@\ht\@arstrutbox - \advance\dimen@\dimen\tw@ - \advance\dimen\tw@\dp\@arstrutbox - \count@=\dimen@ % type conversion dim -> int - \count\tw@=\dimen\tw@ - \divide\count@\count\tw@ % TeX division truncates - \advance\dimen@-\count@\dimen\tw@ - % 1300sp is about 0.02pt. For comparison a rule default width is 0.4pt. - % (note that if \count@ holds 0, surely \dimen@>1300sp) - \ifdim\dimen@>1300sp \advance\count@\@ne \fi - % now \count@ holds the count L of needed "lines" - % and \sphinx@nbofrows holds the number N of rows - % we have L >= 1 and N >= 1 - % if L is a multiple of N, ... clear what to do ! - % else write L = qN + r, 1 <= r < N and we will - % arrange for each row to have enough space for: - % q+1 "lines" in each of the first r rows - % q "lines" in each of the (N-r) bottom rows - % for a total of (q+1) * r + q * (N-r) = q * N + r = L - % It is possible that q == 0. - \count\tw@\count@ - % the TeX division truncates - \divide\count\tw@\sphinx@nbofrows\relax - \count4\count\tw@ % q - \multiply\count\tw@\sphinx@nbofrows\relax - \advance\count@-\count\tw@ % r - \expandafter\xdef\csname sphinx@tablestrut_\sphinx@cellid\endcsname - {\noexpand\sphinx@tablestrut{\the\count4}{\the\count@}{\sphinx@cellid}}% - \dp\z@\z@ - % this will use the real height if it is >\ht\@arstrutbox - \sphinxtablestrut{\sphinx@cellid}\box\z@ - \endgroup % group was opened in \sphinxmultirow -}% -\newcommand*\sphinxtablestrut[1]{% - % #1 is a "cell_id", i.e. the id of a merged group of table cells - \csname sphinx@tablestrut_#1\endcsname -}% -% LaTeX typesets the table row by row, hence each execution can do -% an update for the next row. -\newcommand*\sphinx@tablestrut[3]{\begingroup - % #1 = q, #2 = (initially) r, #3 = cell_id, q+1 lines in first r rows - % if #2 = 0, create space for max(q,1) table lines - % if #2 > 0, create space for q+1 lines and decrement #2 - \leavevmode - \count@#1\relax - \ifnum#2=\z@ - \ifnum\count@=\z@\count@\@ne\fi - \else - % next row will be with a #2 decremented by one - \expandafter\xdef\csname sphinx@tablestrut_#3\endcsname - {\noexpand\sphinx@tablestrut{#1}{\the\numexpr#2-\@ne}{#3}}% - \advance\count@\@ne - \fi - \vrule\@height\ht\@arstrutbox - \@depth\dimexpr\count@\ht\@arstrutbox+\count@\dp\@arstrutbox-\ht\@arstrutbox\relax - \@width\z@ - \endgroup - % we need this to avoid colour panels hiding bottom parts of multirow text - \spx@table@hackCT@nocolor -}% - -%%%%%%%%%%%%%%%%%% -% --- STYLING --- -% - -% -% Support for colour in table -% -% Core LaTeX package (very old, part of texlive-latex-base on Debian distr.) -% providing \columncolor, \rowcolor, \cellcolor and \arrayrulecolor. -\RequirePackage{colortbl} -\let\spx@original@CT@setup\CT@setup - -% LaTeX's \cline has **strong** deficiencies -% ****************************************** -% We work around them via an added \sphinxfixclines{number of columns} in the -% table mark-up, and also extra mark-up \sphinxvlinecrossing{col no} for -% crossings not contiguous to any cline. To fix the gap at left extremity of a -% \cline, we redefine the core LaTeX \c@line because this avoids adjoining a -% small square with potential PDF viewer anti-aliasing issues. We waited -% after loading colortbl because it also redefines \c@line for it to obey the -% colour set by \arrayrulecolor. -% MEMO: booktabs package does *not* redefine \@cline so we are safe here. -\def\@cline#1-#2\@nil{% - \omit - \@multicnt#1% - \advance\@multispan\m@ne - \ifnum\@multicnt=\@ne\@firstofone{&\omit}\fi - \@multicnt#2% - \advance\@multicnt-#1% - \advance\@multispan\@ne - {\CT@arc@ -% start of Sphinx modification - \ifnum#1>\@ne\kern-\spx@arrayrulewidth\fi% fix gap at join with vertical lines -% end of Sphinx modification -% Comments: -% -% If we had the information whether the previous column ended with a | or -% not, we could decide what to do here. Alternatively the mark-up could -% use either original \cline or the one modified as here depending on case. -% One wonders why LaTeX does not provide itself the alternative as a -% complement to \cline, to use on case by case basis. -% Here we handle both at same time via using the \spx@arrayrulewidth which -% will be \z@ if no | at all so will induce here nothing. -% -% As a result Sphinx basically supports well only tables having either all -% columns |-separated, or no | at all, as it uses \spx@arrayrrulewidth in -% all columns (here and in multicolumn code). -% -% We also considered a method not modifying \c@line but it requires too -% much extra mark-up from Python LaTeX writer and/or extra LaTeX coding. -% back to LaTeX+colortbl code - \leaders\hrule\@height\arrayrulewidth\hfill}% - \cr -% the last one will need to be compensated, this is job of \sphinxclines - \noalign{\vskip-\arrayrulewidth}% -} -\def\spx@table@fixvlinejoin{% - {\CT@arc@ % this is the color command set up by \arrayrulecolor - \vrule\@height\arrayrulewidth -% side remark: LaTeX has only a single \arrayrulewidth for all kinds -% for cell borders in table, horizontal or vertical... - \@depth\z@ - \@width\spx@arrayrulewidth - }% -} -% Sphinx LaTeX writer issues one such for each vertical line separating two -% contiguous multirow cells; i.e. those crossings which can are not already -% taken care of by our modified at left extremity \cline. -% One could imagine a more \...crossingS (plural) receiving a comma delimited -% list, which would simplify the mark-up but this would complexify both the -% Python and the LaTeX coding. -\def\sphinxtablevlinecrossing#1{% - \sphinxtabledecrementrownum - \omit - \@multispan{#1}% - \hfill - \spx@table@fixvlinejoin - \cr - \noalign{\vskip-\arrayrulewidth}% -} -% This "fixclines" is also needed if no \sphinxcline emitted and is useful -% even in extreme case with no \sphinxvlinecrossing either, to give correct -% height to multirow extending across all table width assuming other rows are -% separated generally by an \hline, so as to keep coherent line spacing. -% -% It is designed to work ok even if no | separators are in the table (because -% \spx@table@fixvlinejoin uses \spx@arrayrulewidth which is \z@ in that case). -\def\sphinxtablefixclines#1{% #1 is the number of columns of the table - \sphinxtabledecrementrownum - \omit - \spx@table@fixvlinejoin% unneeded if first \cline started at column 1 but does - % not hurt; fills small gap at left-bordered table - \@multispan{#1}% - \hfill - \spx@table@fixvlinejoin% fill small gap at right-bordered table - \cr - % this final one does NO \vskip-\arrayrulewidth... that's the whole point -} -%%%% end of \cline workarounds - -% -% - passing option "table" to xcolor also loads colortbl but we needed to -% load color or xcolor prior to the handling of the options -% -% - the \rowcolors command from [table]{xcolor} has various problems: -% -% * it is rigid and does not out-of-the-box allow a more complex scheme -% such as colorA+colorB+colorC+colorB+colorC+colorB+colorC... suitable to -% distinguish a header row. -% -% * its code does not export the used colour, an information which we may -% need for example to colourize the rule via \arrayrulecolor in the -% appropriate manner, for example to colourize the booktabs induced vertical -% whitespace to avoid gaps (if one wants to). -% -% * incompatibility with tabulary: the output depends on parity of total -% number of rows! -% -% * problems with longtable: the caption will receive a background colour -% panel, if we do not deactivate the \rowcolors action during definition of -% the headers and footers; this requires extra mark-up. Besides if we -% deactivate using \hiderowcolors during header and footer formation, the -% parity of the body rows is shifted, \rownum is even, not odd, at first body -% row. And setting \rownum at start of first body row is too late for -% influencing the colour. -% -% * it has a global impact and must be reset at each table. We can not -% issue it only once and it provides no public interface (without @) to -% cancel its effect conveniently (\hiderowcolors can only be used from -% *inside* a table.) -% -% * its core mechanism which increments the row count is triggered -% if a \cline is encountered... so this offsets the alternating colours... -% ... or not if there are two \cline's in the row... -% (as we will use same mechanism we have to correct this increment). -% -% So we need our own code. - -% Provide \rownum and rownum LaTeX counter (code copied from colortbl v1.0f) -\ltx@ifundefined{rownum}{% - \ltx@ifundefined{c@rownum}% - {\newcount\rownum\let\c@rownum\rownum}% - {\let\rownum\c@rownum}% - }% -{\let\c@rownum\rownum} -\providecommand\therownum{\arabic{rownum}} - -% extra overhang for color panels to avoid visual artifacts in pdf viewers -% (particularly if borderless) -\def\sphinxcolorpanelextraoverhang{0.1pt} -\def\spx@table@leftcolorpanelextra {\sphinxcolorpanelextraoverhang} -\def\spx@table@rightcolorpanelextra{\sphinxcolorpanelextraoverhang} -% the macro to which \CT@row@color will be set for coloured rows, serves both -% in header and body, the colours must have been defined at time of use -\def\spx@table@CT@row@color{\ifspx@table@inmergedcell - \CT@color{sphinxTableMergeColor}% - \else - \CT@color{sphinxTableRowColor}% - \fi - \@tempdimb\dimexpr\col@sep+\spx@table@leftcolorpanelextra\relax - \@tempdimc\dimexpr\col@sep+\spx@table@rightcolorpanelextra\relax - }% -% used by itself this will influence a single row if \CT@everycr is the -% colortbl one, to influences all rows the \CT@everycr must be modified (see -% below) -\def\sphinxrowcolorON {\global\let\CT@row@color\spx@table@CT@row@color}% -% this one turns off row colours until the next \sphinxrowcolorON -\def\sphinxrowcolorOFF{\global\let\CT@row@color\relax}% -% this one inhibits the row colour in one cell only (can be used as -% >{\sphinxnorowcolor} for turning off row colours in a given column) -\def\sphinxnorowcolor{\spx@table@hackCT@norowcolor}% - -% \sphinxtoprule (or rather \sphinxtabletoprulehook) will be modified by -% the colorrows class to execute this one: -\def\spx@table@@toprule@rowcolorON{% - \noalign{% - % Because of tabulary 2-pass system, the colour set-up at end of table - % would contaminate the header colours at start of table, so must reset - % them here. We want all header rows to obey same colours, so we don't - % use original \CT@everycr which sets \CT@row@color to \relax. - \global\CT@everycr{\the\everycr}% - \global\sphinxcolorlet{sphinxTableRowColor}{sphinxTableRowColorHeader}% - \global\sphinxcolorlet{sphinxTableMergeColor}{\sphinxTableMergeColorHeader}% - \sphinxrowcolorON - }% -}% - -% \sphinxtableatstartofbodyhook will be modified by colorrows class to -% execute this one; it starts the alternating colours and triggers increment -% or \rownum count at each new row (the xcolor base method for \rowcolors) -\def\spx@table@@startbodycolorrows{% - \noalign{% - \global\CT@everycr{% Nota Bene: in a longtable with \hline the \everycr is - % done two extra times! but 2 is even, so this is ok - \noalign{\global\advance\rownum\@ne % the xcolor \rowcolors base trick -% MEMO: colortbl \CT@row@color is expanded *after* the cell contents have been -% gathered and measured, so it can't be used to expose e.g. the colour to the -% cell contents macro code. Of course if it is known how the colour is chosen -% the procedure could be done from inside the cell. Simpler to expose the colour -% in a public name sphinxTableRowColor at start of the row in this \noalign. - \sphinxSwitchCaseRowColor\rownum - }% - \the\everycr - }% - \global\rownum\@ne % is done from inside table so ok with tabulary two passes - \sphinxSwitchCaseRowColor\rownum % set up color for the first body row - \sphinxrowcolorON % has been done from \sphinxtoprule location but let's do - % it again in case \sphinxtabletoprulehook has been used - % to inhibit colours in the header rows - }% end of noalign contents -} -% set the colours according to row parity; a priori #1 is \rownum, but -% the macro has been designed to be usable in user level added code -\def\sphinxSwitchCaseRowColor#1{% - \ifodd#1\relax - \global\sphinxcolorlet{sphinxTableRowColor}{sphinxTableRowColorOdd}% - \global\sphinxcolorlet{sphinxTableMergeColor}{\sphinxTableMergeColorOdd}% - \else - \global\sphinxcolorlet{sphinxTableRowColor}{sphinxTableRowColorEven}% - \global\sphinxcolorlet{sphinxTableMergeColor}{\sphinxTableMergeColorEven}% - \fi -} - -% each \cline or \cmidrule (booktabs) consumes one \cr, offsetting the \rownum -% parity; so this macro serves to compensate and must be added to each such -% \cline or \cmidrule (see below) -\def\spx@table@@decrementrownum{\noalign{\global\advance\rownum\m@ne}} -\let\sphinxtabledecrementrownum\@empty - -% \sphinxtableafterendhook will be modified by colorrows class to execute -% this after the table -\def\spx@table@resetcolortbl{% - \sphinxrowcolorOFF - \spx@table@reset@CTeverycr -% this last bit is done in order for the \sphinxbottomrule from the "foot" -% longtable template to be able to use same code as the \sphinxbottomrule -% at end of table body; see \sphinxbooktabsspecialbottomrule code - \global\rownum\z@ -} -\def\spx@table@reset@CTeverycr{% -% we should probably be more cautious and not hard-code here the colortbl -% set-up; so the macro is defined without @ to fac - \global\CT@everycr{\noalign{\global\let\CT@row@color\relax}\the\everycr}% -} - -% At last the style macros \sphinxthistablewithstandardstyle etc... - -% They are executed before the table environments in a scope limiting -% wrapper "savenotes" environment. -% -% 0) colour support is enacted via adding code to three hooks: -% - \sphinxtabletoprulehook (implicit from \sphinxtoprule expansion) -% - \sphinxtableatstartofbodyhook (explicit from table templates) -% - \sphinxtableafterendhook (explicit from table templates) -% additionally special adjustment must be made in \sphinxcline -% -\def\sphinxtoprule{\spx@toprule\sphinxtabletoprulehook} -% \spx@toprule is what is defined by the standard, booktabs and borderless -% styles. -% The colorrows class will prepend \spx@table@toprule@rowcolorON into -% \sphinxtabletoprulehook which a priori is \@empty but can contain user added -% extra code, and is executed after \spx@toprule. -\let\sphinxtabletoprulehook \@empty -\let\sphinxtableatstartofbodyhook\@empty -\let\sphinxtableafterendhook \@empty -% -% 1) we manage these three hooks in a way allowing a custom user extra wrapper -% environment from a container class to use them as entry point for some -% custom code. The container code is done first, prior to table templates. -% So, the style macros will *prepend* the needed color-code to the existing -% custom user code, so the custom user code can override them. The custom -% user code should not redefine any of the 3 \sphinxtable...hook macros via a -% \global\def, but their contents can use \gdef. In fact they probably need -% to for the first two hooks which are executed from inside the table and -% a priori need their code to be in a \noalign which limits scope. -% -% 2) the table templates and LaTeX writer code make it so that only -% one of either -% \sphinxthistablewithcolorrowsstyle, -% or \sphinxthistablewithnocolorrowsstyle -% will be inserted explicitly depending on local :class: for table. -% The global 'colorrows' style in latex_table_style translates at bottom -% of this file into code for inserting \sphinxthistablewithcolorrowsstyle -% at end of \sphinxthistablewithglobalstyle. So it is impossible -% to have first \sphinxthistablewithnocolorrowsstyle, then -% \sphinxthistablewithcolorrowsstyle. Nevertheless we have written -% the code so that in this case colorrows would indeed activate (except -% if it was already executed before as it self-annihilates). - -% standard style -\def\sphinxthistablewithstandardstyle{% - % Those two are produced by the latex writer - \def\sphinxhline {\hline}% - % \sphinxtabledecrementrownum is a no-op which is redefined by colorrows - % to correct the \rownum increment induced by \cline in colorrows regime - \def\sphinxcline {\sphinxtabledecrementrownum\cline}% - % LaTeX's \cline needs fixing - \let\sphinxvlinecrossing\sphinxtablevlinecrossing - \let\sphinxfixclines \sphinxtablefixclines - % Those three are inserted by the table templates - \def\spx@toprule {\hline}% - \def\sphinxmidrule {\hline}% - \def\sphinxbottomrule {\hline}% - % Do not tamper with this internal - \def\spx@arrayrulewidth{\arrayrulewidth}% -} - -% booktabs style -% The \@xcmidrule patch below will do beyond its main stuff -% \sphinxadjustcmidrulebelowsep -% Indeed the poor booktabs spacing with \cmidrule (if \sphinxbooktabscmidrule -% defined below is overwritten to use it) is quite awful. Do -% \let\sphinxadjustcmidrulebelowsep\empty -% if you prefer booktabs defaults. -\def\sphinxadjustcmidrulebelowsep{\belowrulesep=\aboverulesep} -\AtBeginDocument{% patch booktabs to avoid extra vertical space from - % consecutive \sphinxcline, if defined to use \cmidrule - \ifdefined\@xcmidrule - \let\spx@original@@xcmidrule\@xcmidrule - \def\@xcmidrule{\sphinxadjustcmidrulebelowsep - % if we don't do that, two \sphinxcline in the same row - % will cause the second short rule to be shifted down - \ifx\@tempa\sphinxcline\let\@tempa\cmidrule\fi - \spx@original@@xcmidrule}% - \fi -} -% wrappers to allow customization, e.g. via a container class -% the top, mid, bottom definitions are in fact overwritten (later, below) -% byt more complex ones needed to handle booktabs+colorrows context -\def\sphinxbooktabstoprule {\toprule} -\def\sphinxbooktabsmidrule {\midrule} -\def\sphinxbooktabsbottomrule{\bottomrule} -% -\let\sphinxbooktabscmidrule \@gobble % i.e. draw no short rules at all! -% You can redefine this to use \cmidrule with various options, such -% as \cmidrule(lr), but: -% Attention, if you want this to use \cmidrule (or \cline) you must, -% if the table uses row colours, -% also include the \sphinxtabledecrementrownum token like e.g. this -% \def\sphinxbooktabscmidrule{\sphinxtabledecrementrownum\cmidrule(lr)} -% and it must be first due to internals of the \cmidrule usage of \futurelet. - -\def\sphinxthistablewithbooktabsstyle{% - \let\sphinxhline\@empty % there is no wrapper macro here so if you want to change that - % you will have to redefine \sphinxthistablewithbooktabsstyle - \def\sphinxcline {\sphinxbooktabscmidrule}% defaults to give \@gobble - \let\sphinxvlinecrossing\@gobble % no | in a booktabs-style table ! - \let\sphinxfixclines \@gobble % should not be used with booktabs + \cmidrule - \def\spx@toprule {\sphinxbooktabstoprule}% - \def\sphinxmidrule {\sphinxbooktabsmidrule}% - \def\sphinxbottomrule{\sphinxbooktabsbottomrule}% - \def\spx@arrayrulewidth{\z@}% -} -\AtBeginDocument{\@ifpackageloaded{booktabs}% - {}% - {\def\sphinxthistablewithbooktabsstyle{% - \PackageWarning{sphinx}{% -Add \string\usepackage{booktabs} to the preamble to allow\MessageBreak -local use of booktabs table style}% - \sphinxbuildwarning{booktabs}% - \sphinxthistablewithstandardstyle - }}% -}% - -% borderless style -\def\sphinxthistablewithborderlessstyle{% - \let\sphinxhline \@empty - \let\sphinxcline \@gobble - \let\sphinxvlinecrossing\@gobble - \let\sphinxfixclines \@gobble - \let\spx@toprule \@empty - \let\sphinxmidrule \@empty - \let\sphinxbottomrule \@empty - \def\spx@arrayrulewidth{\z@}% -}% - -% colorrows style -% -\let\sphinxifthistablewithcolorrowsTF\@secondoftwo -\def\sphinxthistablewithcolorrowsstyle{% - \let\sphinxifthistablewithcolorrowsTF\@firstoftwo -% this is defined to auto-silence itself (in the surrounding scope-limiting -% environment) after one execution ("colorrows" can never follow "nocolorrows") - \let\sphinxthistablewithcolorrowsstyle\@empty -% - \let\spx@table@toprule@rowcolorON \spx@table@@toprule@rowcolorON - \let\spx@table@startbodycolorrows \spx@table@@startbodycolorrows - \let\sphinxtabledecrementrownum \spx@table@@decrementrownum -% Is it the best choice to "prepend" to existing code there? - \spx@prepend\spx@table@toprule@rowcolorON\to\sphinxtabletoprulehook - \spx@prepend\spx@table@startbodycolorrows\to\sphinxtableatstartofbodyhook -% -% this one is not set to \@empty by nocolorrows, because it looks harmless -% to execute it always, as it simply resets to standard colortbl state after -% the table; so we don't need an @@ version for this one - \spx@prepend\spx@table@resetcolortbl\to\sphinxtableafterendhook -} -\def\spx@prepend#1\to#2{% attention about using this only with #2 "storage macro" - \toks@{#1}% - \toks@\expandafter\expandafter\expandafter{\expandafter\the\expandafter\toks@#2}% - \edef#2{\the\toks@}% -}% - -\def\sphinxthistablewithnocolorrowsstyle{% - \let\sphinxifthistablewithcolorrowsTF\@secondoftwo -% rather than trying to remove the code added by 'colorrows' style, we -% simply make it no-op, without even checking if really it was activated. - \let\spx@table@toprule@rowcolorON\@empty - \let\spx@table@startbodycolorrows\@empty - \let\sphinxtabledecrementrownum \@empty -% we don't worry about \sphinxtableafterendhook as the \spx@table@resetcolortbl -% done at end can not do harm; and we could also have not bothered with the -% \sphinxtabledecrementrownum as its \rownum decrement, if active, is harmless -% in non-colorrows context -} - -% (not so easy) implementation of the booktabscolorgaps option. This option -% defaults to true and is not officially documented, as already colorrows is -% only opt-in, so it is there only as a "turn-off" switch, but if nobody -% complains in next few months, it will probably be removed altogether at -% 6.0.0. The reason it exists is because of longtable aspeces described -% below. -% -% As it is used via \sphinxsetup booktabscolorgaps status is not known here -% and may change locally. So it must be implemented via delayed or -% conditional code. -% -% We do not know the order of execution of \sphinxthistablewithbooktabsstyle -% versus \sphinxthistablewithcolorrows: if booktabs is global option it -% will be executed first; but if colorrows is global option and not booktabs -% then colorrows will be executed first via \sphinxthistablewithglobalstyle -% -% Modifying things from locations such as \sphinxtabletoprulehook which are -% executed within the table is not convenient as it must use \global -% but then we would have to undo this after the table. -% -% So what we do is to prepare booktabs specific macros to incorporate -% a conditional to check the colorrows status. We must each time check -% both if colorrows is activated and if colorgaps is. We do this via -% macros without @ so they can be used easily in customization code. -% When and if booktabscolorgaps option is removed, we can then replace -% \sphinxifbooktabswithcolorgapsTF by \sphinxifthistablewithcolorrowsTF -\def\sphinxifbooktabswithcolorgapsTF{% - \if1\ifspx@opt@booktabscolorgaps - \sphinxifthistablewithcolorrowsTF{1}{0}% - \else0\fi - \expandafter\@firstoftwo - \else\expandafter\@secondoftwo - \fi -} -% as this is done without "@" it can be relatively easily be overwritten -% by user in customization code -\def\sphinxbooktabstoprule{% - \sphinxifbooktabswithcolorgapsTF - {\sphinxbooktabsspecialtoprule}% - {\toprule}% -}% -\def\sphinxbooktabscolorgapsoverhang{0.1pt}% avoid pixel/rounding effects -% auxiliary fork -\long\def\spx@table@crazyfork - #1\endfirsthead\endhead\sphinxtableatstartofbodyhook#2#3\@nil{#2} -% we fetch the next token to check if there is a header or not -% this is a bit fragile as it relies on the table templates -% and it assumes this token #1 is never braced... -% let's make this \long in case #1 is \par (should not be) -\long\def\sphinxbooktabsspecialtoprule\sphinxtabletoprulehook#1{% - \specialrule{\heavyrulewidth}{\abovetopsep}{\z@}% - % this macro contains colour init code (and defines sphinxTableRowColor) - \sphinxtabletoprulehook - % unfortunately colortbl provides no way to save/restore the - % \arrayrulecolor status, we have to code it ourselves - \noalign{\global\let\spx@@saved@CT@arc@\CT@arc@ -% \@declaredcolor is not \long. Although #1 can probably never be \par with -% our templates, let's be cautious and not use the creazyfork inside the \color - \spx@table@crazyfork -% this crazy code checks if #1 is one of \endfirsthead, \endhead or -% \sphinxtableatstartofbodyhook, as criterion for table with no header - #1\endhead\sphinxtableatstartofbodyhook\@secondoftwo - \endfirsthead#1\sphinxtableatstartofbodyhook\@secondoftwo - \endfirsthead\endhead#1\@secondoftwo - \endfirsthead\endhead\sphinxtableatstartofbodyhook\@firstoftwo - \@nil - {\gdef\CT@arc@{\color{sphinxTableRowColor}}}% - {\gdef\CT@arc@{\color{sphinxTableRowColorOdd}}}% - }% end of \noalign - % \specialrule uses \noalign itself - \specialrule{\dimexpr\belowrulesep+\sphinxbooktabscolorgapsoverhang\relax}% - {\z@}{-\sphinxbooktabscolorgapsoverhang}% - \noalign{\global\let\CT@arc@\spx@@saved@CT@arc@}% - #1% let's not forget to re-insert this #1 in token stream - % fortunately longtable's \endfirsthead/\endhead are not delimiters but - % are really tokens awaiting expansion... -}% -\def\sphinxbooktabsmidrule{% - \sphinxifbooktabswithcolorgapsTF - {\sphinxbooktabsspecialmidrule}% - {\midrule}% -}% -\def\sphinxbooktabsspecialmidrule{% - \noalign{\global\let\spx@@saved@CT@arc@\CT@arc@ - \gdef\CT@arc@{\color{sphinxTableRowColor}}% this is RowColorHeader - }% - \specialrule{\dimexpr\aboverulesep+\sphinxbooktabscolorgapsoverhang\relax\relax}% - {-\sphinxbooktabscolorgapsoverhang}{\z@}% - \noalign{\global\let\CT@arc@\spx@@saved@CT@arc@}% - \specialrule{\lightrulewidth}{\z@}{\z@}% - \noalign{\gdef\CT@arc@{\color{sphinxTableRowColorOdd}}}% - \specialrule{\dimexpr\belowrulesep+\sphinxbooktabscolorgapsoverhang\relax\relax}% - {\z@}{-\sphinxbooktabscolorgapsoverhang}% - \noalign{\global\let\CT@arc@\spx@@saved@CT@arc@}% -}% -\def\sphinxbooktabsbottomrule{% - \sphinxifbooktabswithcolorgapsTF - {\sphinxbooktabsspecialbottomrule}% - {\bottomrule}% -}% -% The colour here is already updated because of the \\ before so we must -% execute again the colour selection code, but this is not too complicated. -% What is annoying though is that \sphinxbottomrule in the longtable context -% appears both in the "foot" part and after the last body row. For the first -% occurrence the \rownum could be arbitrary if it had not been reset by each -% table using it via the \sphinxtableafterendhook (see above). This avoids -% having to modify the longtable template. But as \rownum is thus 0 in the -% "foot", the \sphinxSwitchCaseRowColor has to know how to handle negative -% inputs (in fact the -1 value), the Sphinx definition has no issue with that -% but any redefinition must be aware of this constraint. -\def\sphinxbooktabsspecialbottomrule{% - \noalign{\global\let\spx@@saved@CT@arc@\CT@arc@ - \sphinxSwitchCaseRowColor{\numexpr\rownum-\@ne\relax}% - \gdef\CT@arc@{\color{sphinxTableRowColor}}% - }% - \specialrule{\dimexpr\aboverulesep+\sphinxbooktabscolorgapsoverhang\relax}% - {-\sphinxbooktabscolorgapsoverhang}{\z@}% - \noalign{\global\let\CT@arc@\spx@@saved@CT@arc@}% - \specialrule{\heavyrulewidth}{\z@}{\belowbottomsep}% -}% -% -% MEMO: with longtable \sphinxtoprule, \sphinxmidrule and \sphinxbottomrule -% are evaluated at time of constructing the headers and footers as boxes -% (already typeset material and expanded macros; \sphinxbottomrule is also -% evaluated at very end of table body, i.e. "normally"). So the used colour -% to fill the booktabs gaps is decided during the headers and footers -% construction by longtable. Actually they are expanded twice: in firsthead -% then in head, respectively in foot and lastfoot. But in current design the -% header row colours are fixed, not alternating, so there is at least no -% coherence issue there. - -% The \spx@arrayrulewidth is used for some complex matters of merged -% cells size computations. -% tabularcolumns argument will override any global or local style and -% trigger the appropriate adjustment of \spx@arrayrulewidth. -% Notice that this will be bad if the table uses booktabs style -% but anyhow table with booktabs should not use any | separator. -\def\sphinxthistablewithvlinesstyle{% - \def\spx@arrayrulewidth{\arrayrulewidth}% - \let\sphinxvlinecrossing\sphinxtablevlinecrossing - \let\sphinxfixclines \sphinxtablefixclines -}% -\def\sphinxthistablewithnovlinesstyle{% - \def\spx@arrayrulewidth{\z@}% - \let\sphinxvlinecrossing\@gobble - % let's not bother to modify \sphinxfixclines, it works fine and is - % useful in standard style + no vline (only hlines and clines); - % besides, only one of vline or novline style macro is executed -}% - -% default is the standard style -\def\sphinxthistablewithglobalstyle{\sphinxthistablewithstandardstyle} - -\ifspx@opt@booktabs - \RequirePackage{booktabs} - \def\sphinxthistablewithglobalstyle{\sphinxthistablewithbooktabsstyle} -\fi -\ifspx@opt@borderless - \def\sphinxthistablewithglobalstyle{\sphinxthistablewithborderlessstyle} -\fi -% colorrows appends to the current globalstyle (standard, booktabs, or borderless) -\ifspx@opt@colorrows % let the globalstyle trigger the colorrows style on top of it - \expandafter\def\expandafter\sphinxthistablewithglobalstyle\expandafter - {\sphinxthistablewithglobalstyle - \sphinxthistablewithcolorrowsstyle - } -\fi - - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxmanual.cls b/crypto/krb5/doc/pdf/sphinxmanual.cls deleted file mode 100644 index 2e4b30d921c3..000000000000 --- a/crypto/krb5/doc/pdf/sphinxmanual.cls +++ /dev/null @@ -1,128 +0,0 @@ -% -% sphinxmanual.cls for Sphinx (https://www.sphinx-doc.org/) -% - -\NeedsTeXFormat{LaTeX2e}[1995/12/01] -\ProvidesClass{sphinxmanual}[2019/12/01 v2.3.0 Document class (Sphinx manual)] - -% chapters starting at odd pages (overridden by 'openany' document option) -\PassOptionsToClass{openright}{\sphinxdocclass} - -% 'oneside' option overriding the 'twoside' default -\newif\if@oneside -\DeclareOption{oneside}{\@onesidetrue} -% Pass remaining document options to the parent class. -\DeclareOption*{\PassOptionsToClass{\CurrentOption}{\sphinxdocclass}} -\ProcessOptions\relax - -% Defaults two-side document -\if@oneside -% nothing to do (oneside is the default) -\else -\PassOptionsToClass{twoside}{\sphinxdocclass} -\fi - -\LoadClass{\sphinxdocclass} - -% Set some sane defaults for section numbering depth and TOC depth. You can -% reset these counters in your preamble. -% -\setcounter{secnumdepth}{2} -\setcounter{tocdepth}{1} - -% Adapt \and command to the flushright context of \sphinxmaketitle, to -% avoid ragged line endings if author names do not fit all on one single line -\DeclareRobustCommand{\and}{% - \end{tabular}\kern-\tabcolsep - \allowbreak - \hskip\dimexpr1em+\tabcolsep\@plus.17fil\begin{tabular}[t]{c}% -}% -% If it is desired that each author name be on its own line, use in preamble: -%\DeclareRobustCommand{\and}{% -% \end{tabular}\kern-\tabcolsep\\\begin{tabular}[t]{c}% -%}% -% Change the title page to look a bit better, and fit in with the fncychap -% ``Bjarne'' style a bit better. -% -\newcommand{\sphinxmaketitle}{% - \let\sphinxrestorepageanchorsetting\relax - \ifHy@pageanchor\def\sphinxrestorepageanchorsetting{\Hy@pageanchortrue}\fi - \hypersetup{pageanchor=false}% avoid duplicate destination warnings - \begin{titlepage}% - \let\footnotesize\small - \let\footnoterule\relax - \noindent\rule{\textwidth}{1pt}\par - \begingroup % for PDF information dictionary - \def\endgraf{ }\def\and{\& }% - \pdfstringdefDisableCommands{\def\\{, }}% overwrite hyperref setup - \hypersetup{pdfauthor={\@author}, pdftitle={\@title}}% - \endgroup - \begin{flushright}% - \sphinxlogo - \py@HeaderFamily - {\Huge \@title \par} - {\itshape\LARGE \py@release\releaseinfo \par} - \vfill - {\LARGE - \begin{tabular}[t]{c} - \@author - \end{tabular}\kern-\tabcolsep - \par} - \vfill\vfill - {\large - \@date \par - \vfill - \py@authoraddress \par - }% - \end{flushright}%\par - \@thanks - \end{titlepage}% - \setcounter{footnote}{0}% - \let\thanks\relax\let\maketitle\relax - %\gdef\@thanks{}\gdef\@author{}\gdef\@title{} - \clearpage - \ifdefined\sphinxbackoftitlepage\sphinxbackoftitlepage\fi - \if@openright\cleardoublepage\else\clearpage\fi - \sphinxrestorepageanchorsetting -} - -\newcommand{\sphinxtableofcontents}{% - \pagenumbering{roman}% - \begingroup - \parskip \z@skip - \sphinxtableofcontentshook - \tableofcontents - \endgroup - % before resetting page counter, let's do the right thing. - \if@openright\cleardoublepage\else\clearpage\fi - \pagenumbering{arabic}% -} - -% This is needed to get the width of the section # area wide enough in the -% library reference. Doing it here keeps it the same for all the manuals. -% -\newcommand{\sphinxtableofcontentshook}{% - \renewcommand*\l@section{\@dottedtocline{1}{1.5em}{2.6em}}% - \renewcommand*\l@subsection{\@dottedtocline{2}{4.1em}{3.5em}}% -} - -% Fix the bibliography environment to add an entry to the Table of -% Contents. -% For a report document class this environment is a chapter. -% -\newenvironment{sphinxthebibliography}[1]{% - \if@openright\cleardoublepage\else\clearpage\fi - % \phantomsection % not needed here since TeXLive 2010's hyperref - \begin{thebibliography}{#1}% - \addcontentsline{toc}{chapter}{\bibname}}{\end{thebibliography}} - -% Same for the indices. -% The memoir class already does this, so we don't duplicate it in that case. -% -\@ifclassloaded{memoir} - {\newenvironment{sphinxtheindex}{\begin{theindex}}{\end{theindex}}} - {\newenvironment{sphinxtheindex}{% - \if@openright\cleardoublepage\else\clearpage\fi - \phantomsection % needed as no chapter, section, ... created - \begin{theindex}% - \addcontentsline{toc}{chapter}{\indexname}}{\end{theindex}}} diff --git a/crypto/krb5/doc/pdf/sphinxmessages.sty b/crypto/krb5/doc/pdf/sphinxmessages.sty deleted file mode 100644 index 68ebffa887df..000000000000 --- a/crypto/krb5/doc/pdf/sphinxmessages.sty +++ /dev/null @@ -1,21 +0,0 @@ -% -% sphinxmessages.sty -% -% message resources for Sphinx -% -\ProvidesPackage{sphinxmessages}[2019/01/04 v2.0 Localized LaTeX macros (Sphinx team)] - -\renewcommand{\literalblockcontinuedname}{continued from previous page} -\renewcommand{\literalblockcontinuesname}{continues on next page} -\renewcommand{\sphinxnonalphabeticalgroupname}{Non\sphinxhyphen{}alphabetical} -\renewcommand{\sphinxsymbolsname}{Symbols} -\renewcommand{\sphinxnumbersname}{Numbers} -\def\pageautorefname{page} - -\addto\captionsenglish{\renewcommand{\figurename}{Fig.\@{} }} -\def\fnum@figure{\figurename\thefigure{}} - -\addto\captionsenglish{\renewcommand{\tablename}{Table }} -\def\fnum@table{\tablename\thetable{}} - -\addto\captionsenglish{\renewcommand{\literalblockname}{Listing}}
\ No newline at end of file diff --git a/crypto/krb5/doc/pdf/sphinxoptionsgeometry.sty b/crypto/krb5/doc/pdf/sphinxoptionsgeometry.sty deleted file mode 100644 index af5a804d5936..000000000000 --- a/crypto/krb5/doc/pdf/sphinxoptionsgeometry.sty +++ /dev/null @@ -1,54 +0,0 @@ -%% OPTIONS FOR GEOMETRY -% -% change this info string if making any custom modification -\ProvidesFile{sphinxoptionsgeometry.sty}[2021/01/27 geometry] - -% geometry -\ifx\kanjiskip\@undefined - \PassOptionsToPackage{% - hmargin={\unexpanded{\spx@opt@hmargin}},% - vmargin={\unexpanded{\spx@opt@vmargin}},% - marginpar=\unexpanded{\spx@opt@marginpar}} - {geometry} -\else - % set text width for Japanese documents to be integer multiple of 1zw - % and text height to be integer multiple of \baselineskip - % the execution is delayed to \sphinxsetup then geometry.sty - \normalsize\normalfont - \newcommand*\sphinxtextwidthja[1]{% - \if@twocolumn\tw@\fi - \dimexpr - \numexpr\dimexpr\paperwidth-\tw@\dimexpr#1\relax\relax/ - \dimexpr\if@twocolumn\tw@\else\@ne\fi zw\relax - zw\relax}% - \newcommand*\sphinxmarginparwidthja[1]{% - \dimexpr\numexpr\dimexpr#1\relax/\dimexpr1zw\relax zw\relax}% - \newcommand*\sphinxtextlinesja[1]{% - \numexpr\@ne+\dimexpr\paperheight-\topskip-\tw@\dimexpr#1\relax\relax/ - \baselineskip\relax}% - \ifx\@jsc@uplatextrue\@undefined\else - % the way we found in order for the papersize special written by - % geometry in the dvi file to be correct in case of jsbook class - \ifnum\mag=\@m\else % do nothing special if nomag class option or 10pt - \PassOptionsToPackage{truedimen}{geometry}% - \fi - \fi - \PassOptionsToPackage{% - hmarginratio={1:1},% - textwidth=\unexpanded{\sphinxtextwidthja{\spx@opt@hmargin}},% - vmarginratio={1:1},% - lines=\unexpanded{\sphinxtextlinesja{\spx@opt@vmargin}},% - marginpar=\unexpanded{\sphinxmarginparwidthja{\spx@opt@marginpar}},% - footskip=2\baselineskip,% - }{geometry}% - \AtBeginDocument - {% update a dimension used by the jsclasses - \ifx\@jsc@uplatextrue\@undefined\else\fullwidth\textwidth\fi - % for some reason, jreport normalizes all dimensions with \@settopoint - \@ifclassloaded{jreport} - {\@settopoint\textwidth\@settopoint\textheight\@settopoint\marginparwidth} - {}% <-- "false" clause of \@ifclassloaded - }% -\fi - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxoptionshyperref.sty b/crypto/krb5/doc/pdf/sphinxoptionshyperref.sty deleted file mode 100644 index b88f108df9a4..000000000000 --- a/crypto/krb5/doc/pdf/sphinxoptionshyperref.sty +++ /dev/null @@ -1,35 +0,0 @@ -%% Bookmarks and hyperlinks -% -% change this info string if making any custom modification -\ProvidesFile{sphinxoptionshyperref.sty}[2021/01/27 hyperref] - -% to make pdf with correct encoded bookmarks in Japanese -% this should precede the hyperref package -\ifx\kanjiskip\@undefined -% for non-Japanese: make sure bookmarks are ok also with lualatex - \PassOptionsToPackage{pdfencoding=unicode}{hyperref} -\else - \RequirePackage{atbegshi} - \ifx\ucs\@undefined - \ifnum 42146=\euc"A4A2 - \AtBeginShipoutFirst{\special{pdf:tounicode EUC-UCS2}} - \else - \AtBeginShipoutFirst{\special{pdf:tounicode 90ms-RKSJ-UCS2}} - \fi - \else - \AtBeginShipoutFirst{\special{pdf:tounicode UTF8-UCS2}} - \fi -\fi - -\ifx\@jsc@uplatextrue\@undefined\else - \PassOptionsToPackage{setpagesize=false}{hyperref} -\fi - -% These options can be overridden inside 'hyperref' key -% or by later use of \hypersetup. -\PassOptionsToPackage{colorlinks,breaklinks,% - linkcolor=InnerLinkColor,filecolor=OuterLinkColor,% - menucolor=OuterLinkColor,urlcolor=OuterLinkColor,% - citecolor=InnerLinkColor}{hyperref} - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxpackageboxes.sty b/crypto/krb5/doc/pdf/sphinxpackageboxes.sty deleted file mode 100644 index b0d3707062fe..000000000000 --- a/crypto/krb5/doc/pdf/sphinxpackageboxes.sty +++ /dev/null @@ -1,854 +0,0 @@ -%% COLOURED BOXES -% -% change this info string if making any custom modification -\ProvidesPackage{sphinxpackageboxes}[2023/03/19 v6.2.0 advanced colored boxes] -% Optionally executes \RequirePackage for: -% -% - pict2e. Ideally we would like to use the v0.4a 2020/08/16 release of this -% package as it allows dimensional arguments to its \moveto, \lineto, etc... -% Or we could use extra package "picture". We opt for custom wrappers -% \spx@moveto, \spx@lineto, ..., working with old versions. -% -% - ellipse. This package extends pict2e with elliptical arcs. Its author -% Daan Leijen also has contributed package longfbox which is part of -% TeXLive. Had I known about it, I would perhaps have based Sphinx CSS on -% top of longfbox at least partly. But this would not have spared me all -% the work in sphinx.sty, which was a long walk until 6.2.0 version. -% Besides I don't need the breakable boxes from longfbox, as Sphinx has -% its own rather advanced layer on top of framed. I would need to check if -% some thorny color issues solved by Sphinx (and not by tcolorbox) at page -% breaks are solved by longfbox as well. (I have not tested) - -% At 6.2.0 refactoring, we do not wait for at begin document to try to load -% pict2e. Actually since 6.0.0 the default is for code-blocks to use -% rounded boxes, and the only reason since then to wait "at begin document" -% was to check if user had reverted that default and in fact pict2e was not -% needed. But with \sphinxbox, we can not know for sure even in that case -% that pict2e is not needed. And even back then it would have been possible -% to user to try to employ \sphinxsetup via raw directive in document body -% and require some rounded corners (which was thus impossible to satisfy). -% Time to be much simpler and attempt unconditionally to load pict2e -% immediately. This will also have advantage that we can use -% \@ifpackageloaded{pict2e} and not have to query and save its setting later -% at begin document. -\IfFileExists{pict2e.sty} - {\RequirePackage{pict2e}} - {\PackageWarningNoLine{sphinx}{% - The package pict2e is required for rounded boxes.\MessageBreak - It does not seem to be available on your system.\MessageBreak - Options for setting radii will be ignored% - }% - % Formerly a \sphinxbuildwarning was issued but if we did that now it - % would mean that the produced PDF will always have a red banner near its - % end about pict2e not being available if indeed it is not available, even - % if user has reverted the default and dropped rounded corners. Formerly - % the serious warning was done after having checked at begin document that - % indeed a rounded corner option had been used. As we drop the check now, - % let's be more discrete and simply duplicate the earlier warning to make - % it visible near end of compilation log and console output. - \AtEndDocument{\PackageWarningNoLine{sphinx}{% - The package pict2e is required for rounded boxes.\MessageBreak - As it does not seem to be available on your system,\MessageBreak - options setting radii have all been ignored}}% - }% - -\IfFileExists{ellipse.sty} - {\RequirePackage{ellipse}} - {\PackageWarningNoLine{sphinx}{% - The package ellipse is required for elliptical corners.\MessageBreak - It does not seem to be available on your system.\MessageBreak - All non-straight corners will use circle arcs.% - }% - \AtEndDocument{\PackageWarningNoLine{sphinx}{% - The package ellipse is required for elliptical corners.\MessageBreak - As it does not seem to be available on your system,\MessageBreak - all non-straight corners have used circle arcs.}}% - }% - -% The pict2e release v0.4b of 2020/09/30 does not allocate scratch dimen -% register \@tempdimd which ellipse package uses. Thus ellipse package is -% broken since (written on March 20, 2023). Simply allocate the register -% ourself to fix that, pending some upstream fix. -\@ifpackageloaded{ellipse}{\ifdefined\@tempdimd\else\newdimen\@tempdimd\fi}{} - -% Provides box registers \spx@tempboxa, \spx@tempboxb usable in other places -\newbox\spx@tempboxa -\newbox\spx@tempboxb - -%%%%%%%%%%%%%%%% -% Internal registers, conditionals, colors to be configured by each caller -% via a preliminary "setup" call -% -\newif\ifspx@boxes@withshadow -\newif\ifspx@boxes@insetshadow -\newif\ifspx@boxes@withbackgroundcolor -\newif\ifspx@boxes@withshadowcolor -\newif\ifspx@boxes@withbordercolor -\newif\ifspx@boxes@shadowinbbox -% -\newdimen\spx@boxes@border -\newdimen\spx@boxes@border@top -\newdimen\spx@boxes@border@right -\newdimen\spx@boxes@border@bottom -\newdimen\spx@boxes@border@left -% -\newdimen\spx@boxes@padding@top -\newdimen\spx@boxes@padding@right -\newdimen\spx@boxes@padding@bottom -\newdimen\spx@boxes@padding@left -% -\newdimen\spx@boxes@shadow@xoffset -\newdimen\spx@boxes@shadow@yoffset -% -\newdimen\spx@boxes@radius@topleft@x -\newdimen\spx@boxes@radius@topright@x -\newdimen\spx@boxes@radius@bottomright@x -\newdimen\spx@boxes@radius@bottomleft@x -\newdimen\spx@boxes@radius@topleft@y -\newdimen\spx@boxes@radius@topright@y -\newdimen\spx@boxes@radius@bottomright@y -\newdimen\spx@boxes@radius@bottomleft@y -% -% These colors will be set to colors defined appropriately by caller of -% \spx@boxes@fcolorbox@setup macro -% spx@boxes@bordercolor -% spx@boxes@backgroundcolor -% spx@boxes@shadowcolor -% spx@boxes@textcolor - -%%%%%%%%%%%%%%%% -% "setup" macro -% -% It must be called prior to \spx@boxes@fcolorbox for parameters of the latter -% to be initialized. -% -% It also prepares \spx@boxes@fcolorbox to expand to one of -% \spx@boxes@fcolorbox@rectangle or \spx@boxes@fcolorbox@rounded depending on -% the configuration and availability of the pict2e package. -% -% The #1 is one of: pre, topic, warning, danger, etc.... -% -% We delay until here the parsing of radii options to extract x and y -% components. -\def\spx@boxes@setradii#1 #2 #3\@nnil#4#5{% - #4\dimexpr#1\relax - #5\dimexpr#2\relax - \ifdim#5=-\maxdimen#5#4\fi - % if one of them is zero or negative set both to zero - \ifdim#4>\z@\else#4\z@#5\z@\fi - \ifdim#5>\z@\else#4\z@#5\z@\fi -}% -% if ellipse.sty is not available ignore the second component of all radii -% specifications, use circle arcs with radius the x component -\@ifpackageloaded{ellipse} - {} - {\def\spx@boxes@setradii#1 #2 #3\@nnil#4#5{#4\dimexpr#1\relax #5#4}} - -% Using \dimexpr for maximal user input flexibility. -\def\spx@boxes@fcolorbox@setup#1{% - \spx@boxes@border@top \dimexpr\@nameuse{spx@#1@border@top}\relax - \spx@boxes@border@right \dimexpr\@nameuse{spx@#1@border@right}\relax - \spx@boxes@border@bottom\dimexpr\@nameuse{spx@#1@border@bottom}\relax - \spx@boxes@border@left \dimexpr\@nameuse{spx@#1@border@left}\relax - \spx@boxes@border \dimexpr\@nameuse{spx@#1@border}\relax - % - \spx@boxes@padding@top \dimexpr\@nameuse{spx@#1@padding@top}\relax - \spx@boxes@padding@right \dimexpr\@nameuse{spx@#1@padding@right}\relax - \spx@boxes@padding@bottom\dimexpr\@nameuse{spx@#1@padding@bottom}\relax - \spx@boxes@padding@left \dimexpr\@nameuse{spx@#1@padding@left}\relax - % - \edef\spx@temp{\csname spx@#1@radius@topleft\endcsname\space}% - \expandafter - \spx@boxes@setradii - \spx@temp - {-\maxdimen} - \@nnil - \spx@boxes@radius@topleft@x\spx@boxes@radius@topleft@y - \edef\spx@temp{\csname spx@#1@radius@topright\endcsname\space}% - \expandafter - \spx@boxes@setradii - \spx@temp - {-\maxdimen} - \@nnil - \spx@boxes@radius@topright@x\spx@boxes@radius@topright@y - \edef\spx@temp{\csname spx@#1@radius@bottomright\endcsname\space}% - \expandafter - \spx@boxes@setradii - \spx@temp - {-\maxdimen} - \@nnil - \spx@boxes@radius@bottomright@x\spx@boxes@radius@bottomright@y - \edef\spx@temp{\csname spx@#1@radius@bottomleft\endcsname\space}% - \expandafter - \spx@boxes@setradii - \spx@temp - {-\maxdimen} - \@nnil - \spx@boxes@radius@bottomleft@x\spx@boxes@radius@bottomleft@y - % - \@nameuse{ifspx@#1@withshadow}% - \spx@boxes@withshadowtrue - \spx@boxes@shadow@xoffset \dimexpr\@nameuse{spx@#1@shadow@xoffset}\relax - \spx@boxes@shadow@yoffset \dimexpr\@nameuse{spx@#1@shadow@yoffset}\relax - \else - \spx@boxes@withshadowfalse - \fi - % not nesting in previous to avoid TeX conditional subtleties - \@nameuse{ifspx@#1@insetshadow}% - \spx@boxes@insetshadowtrue - \else - \spx@boxes@insetshadowfalse - \fi - % - \@nameuse{ifspx@#1@withbordercolor}% - \spx@boxes@withbordercolortrue - \sphinxcolorlet{spx@boxes@bordercolor}{sphinx#1BorderColor}% - \else - \spx@boxes@withbordercolorfalse - \fi - % - \@nameuse{ifspx@#1@withbackgroundcolor}% - \spx@boxes@withbackgroundcolortrue - \sphinxcolorlet{spx@boxes@backgroundcolor}{sphinx#1BgColor}% - \else - \spx@boxes@withbackgroundcolorfalse - \fi - % - \@nameuse{ifspx@#1@withshadowcolor}% - \spx@boxes@withshadowcolortrue - \sphinxcolorlet{spx@boxes@shadowcolor}{sphinx#1ShadowColor}% - \else - \spx@boxes@withshadowcolorfalse - \fi - % Display elements pre, topic, warning et al. by default do not include - % shadow in box (legacy; and only topic actually uses a shadow per default) - % This may be refactored still more in future, but this 6.2.0 extra helped - % reduce workload from code-blocks (pre), contents (topic) and admonitions. - % As this conditional is a priori false and should only be changed locally - % (by \sphinxbox), this line is actually superfluous. - \spx@boxes@shadowinbboxfalse - \spx@boxes@fcolorbox@setup@fcolorbox -} -\@ifpackageloaded{pict2e} -{% pict2e is available and loaded - \def\spx@boxes@fcolorbox@setup@fcolorbox{% - \if1% use rounded boxes only if needed (rx>0 iff ry>0) - \ifdim\spx@boxes@radius@topleft@x >\z@0\fi - \ifdim\spx@boxes@radius@topright@x >\z@0\fi - \ifdim\spx@boxes@radius@bottomright@x>\z@0\fi - \ifdim\spx@boxes@radius@bottomleft@x >\z@0\fi - 1\def\spx@boxes@fcolorbox{\spx@boxes@fcolorbox@rectangle}% - \else - \def\spx@boxes@fcolorbox{\spx@boxes@fcolorbox@rounded}% - \fi - }% end of definition of setup@fcolorbox in case of presence of pict2e -}% -{% pict2e could not be loaded, we must always use fcolorbox@rectangle - \def\spx@boxes@fcolorbox@setup@fcolorbox{% - \def\spx@boxes@fcolorbox{\spx@boxes@fcolorbox@rectangle}% - }% end of definition of setup@fcolorbox in case of absence of pict2e -}% end of "no pict2e" branch - -%%%%%%%%%%%%%%%% -% Support of box-decoration-break=slice -% -% 6.2.0 has renamed and moved this here from sphinxlatexliterals.sty, -% to facilitate supporting box-decoration-break=slice for all directives, -% not only code-block. -% -% It also modified when these post actions are executed, in order -% for openboth to be able to trigger usage of fcolorbox@rectangle. -% So now openbottom and opentop also take advantage of this possible -% optimization. -\def\spx@boxes@fcolorbox@setup@openbottom{% - \spx@boxes@border@bottom \z@ - \spx@boxes@radius@bottomright@x\z@ \spx@boxes@radius@bottomright@y\z@ - \spx@boxes@radius@bottomleft@x \z@ \spx@boxes@radius@bottomleft@y \z@ - \spx@boxes@fcolorbox@setup@fcolorbox -}% -\def\spx@boxes@fcolorbox@setup@opentop{% - \spx@boxes@border@top \z@ - \spx@boxes@radius@topright@x\z@ \spx@boxes@radius@topright@y\z@ - \spx@boxes@radius@topleft@x \z@ \spx@boxes@radius@topleft@y \z@ - \spx@boxes@fcolorbox@setup@fcolorbox -}% -\def\spx@boxes@fcolorbox@setup@openboth{% - \spx@boxes@border@top \z@ - \spx@boxes@border@bottom \z@ - \spx@boxes@radius@bottomright@x\z@ \spx@boxes@radius@bottomright@y\z@ - \spx@boxes@radius@bottomleft@x \z@ \spx@boxes@radius@bottomleft@y \z@ - \spx@boxes@radius@topright@x\z@ \spx@boxes@radius@topright@y\z@ - \spx@boxes@radius@topleft@x \z@ \spx@boxes@radius@topleft@y \z@ - \def\spx@boxes@fcolorbox{\spx@boxes@fcolorbox@rectangle}% -}% - -%%%%%%%%%%%%%%%% -% \sphinxbox (added at 6.2.0) -% -% For an inline box, possibly rounded. -\newcommand\sphinxbox[1][]{% #1 stands for the options, they are... optional! - % \leavevmode makes sure TeX switches to paragraph mode, which is necessary - % if this is first in a paragraph or a list element. The \sphinxAtStartPar - % mechanism also ensures this automatically, if not redefined, but not with - % lualatex as then it is by default doing nothing. - \leavevmode - \begingroup - \ifcsname spx@boxes@sphinxbox@isnested\endcsname - % nested boxes reset all box options to be as the \sphinxboxsetup - % defaults, before applying their specific options - \spx@boxes@sphinxbox@reset - \else - % top layer box, toggle the nested flag - \csname spx@boxes@sphinxbox@isnested\endcsname - \fi - % we do not use \sphinxboxsetup as it is a user command extending the - % "reset" storage - \setkeys{sphinxbox}{#1}% - \spx@boxes@fcolorbox@setup{box}% - \spx@boxes@shadowinbboxtrue% inline sphinx boxes include shadow in bbox - \ifspx@box@withtextcolor\color{sphinxboxTextColor}\fi - % - % MEMO: the fcolorbox@{rectangle,rounded} draw the contents (which here - % will be encapsulated as \box\z@) last, i.e. after shadow, background, - % and border and their color commands. The \reset@color from naked - % top-level \color commands in argument (which can not arise from Sphinx - % mark-up anyhow) would end up being placed via color.sty \aftergroup core - % mechanism in token stream after \spx@boxes@sphinxbox@a (which is the - % first \aftergroup) hence after the box contents with its unbalanced - % color pushes is shipped to PDF. So the missing color pop specials are - % inserted then in correct order at correct place (after the \endgroup at - % end of \spx@boxes@sphinxbox@a but this is not relevant) and do not end - % up causing havoc in push/pop pairs (and all this happens on same page). - % - % There is thus no reason here to go to the trouble to add an extra - % \color@begingroup/\color@endgroup or like pair to encapsulate the caught - % contents in order for the \box\z@ to contain as many color pop's as it - % has color pushes. But as this is subtle, this comment was added for - % future maintenance. Actually even if the contents were not drawn last, - % their (purely theoretical, as Sphinx mark-up can not create it) missing - % color pop's would not have caused trouble I guess as long as the color - % insertions for shadow, background, border are correctly balanced. - \setbox0\hbox\bgroup\aftergroup\spx@boxes@sphinxbox@a - \afterassignment\spx@box@TeXextras - \let\next=% -} -\def\spx@boxes@sphinxbox@a{\spx@boxes@fcolorbox{% - \ifspx@opt@box@addstrut\strut\fi\box\z@}\endgroup} - -\newcommand\newsphinxbox[2][]{% - \newcommand#2[1][]{\sphinxbox[#1,##1]}% -} -% Let's catch \renewsphinxbox[...]{\sphinxbox} which would cause \sphinxbox -% to fall into infinite looping on use. -\newcommand\renewsphinxbox[2][]{% - \in@{#2}{\sphinxbox}% - \ifin@ - \PackageWarning{sphinx}{Attempt to \string\renewsphinxbox\space - the \string\sphinxbox\space command\MessageBreak - itself. This is not allowed and will be ignored.\MessageBreak - Reported}% - \else - \renewcommand#2[1][]{\sphinxbox[#1,##1]}% - \fi -} - -%%%%%%%%%%%%%%%% -% MACROS -% -% \spx@boxes@fcolorbox expands either to \spx@boxes@fcolorbox@rectangle -% or \spx@boxes@fcolorbox@rounded depending on preliminary set-up. -% -% This is decided by the "setup" which must have been executed by the caller. -% Let's give it some (thus unneeded) default fall-back for clarity. -\def\spx@boxes@fcolorbox{\spx@boxes@fcolorbox@rectangle} -% -% A macro \spx@boxes@fcolorbox@setuphook used to be executed at start of the -% \hbox constructs (rectangle or rounded). This was used until 6.2.0 for the -% support of pre_box-decoration-break option, hence was really an internal -% non-public macro. As it is not needed anymore, with some hesitation it got -% entirely removed at 6.2.0 on the occasion of a refactoring of interactions of -% this file with sphinxlatexliterals.sty. Besides its name should have been -% rather something such as \spx@boxes@fcolorbox@atstartofhbox. -% -% After "setup", \spx@boxes@fcolorbox expands to one of: -% -% - \spx@boxes@fcolorbox@rectangle (4 padding parameters, 4 border widths, 2 shadow widths, -% and three colours: background, border and shadow; same as in CSS styling) -% -% It branches to one of: -% - \spx@boxes@fcolorbox@externalshadow -% - \spx@boxes@fcolorbox@insetshadow (same concept of "inset" as in CSS styling) -% -% - \spx@boxes@fcolorbox@rounded: rounded corners using the picture environment -% and pict2e package for its low-weight interface to PDF graphics operations - -% MEMO: we have also successfully tested usage of tcolorbox.sty (its \tcbox) but -% decided to use pict2e.sty for the following reasons: -% 1- PDF build was observed to be an order of magnitude faster, -% 2- the boxes we can do with pict2e appear to be fancy enough, -% almost matching what one can see in HTML renderings, -% 2- orders of magnitude smaller dependency (tcolorbox uses the pgf TeX -% framework), although on Ubuntu it seems texlive-pictures is -% needed which also contains the whole of pgf/TikZ... so this point -% is a bit moot... - -% For code-blocks, attachments of caption and continuation hints are done -% exactly as prior to extension of Sphinx via this package, whether the box -% has straight or rounded corners. The vertical space occupied is the same, -% if nothing else is changed (perhaps in future the title itself could be also -% rendered in a rounded box?) - -%%%%%%%% -%//// \spx@boxes@fcolorbox@rectangle -% -% This box will have the same baseline as its argument (which is typeset in -% horizontal mode). It takes into account four border widths parameters, four -% padding parameters, two shadow widths (each possibly negative), and three -% colors: background, border and shadow. Its boundary box takes into account -% border and padding. Width of shadow is taken into account if the boolean -% \ifspx@boxes@shadowinbbox is \iftrue. The "setup" sets it to \iffalse. -% Prior to 6.2.0, shadow size was included in bbox but the callers manually -% removed it by extra steps. The \sphinxbox command sets it to \iftrue after -% the "setup". -% -% It is up to the caller to take extra steps if the border and padding must go -% into margin as well (see sphinxlatexliterals.sty for how this is done in -% \spx@verb@FrameCommand). -% -% In usage as a "FrameCommand" with framed.sty, the argument will already be a -% collection of TeX boxes (and interline glues). -% -% This was designed so that the parameters configured by "setup" are -% interpreted as they would be as CSS properties in an HTML context. -\long\def\spx@boxes@fcolorbox@rectangle#1{% - \hbox\bgroup - \setbox\spx@tempboxa - \hbox{\kern\dimexpr\spx@boxes@border@left+\spx@boxes@padding@left\relax - {#1}% - \kern\dimexpr\spx@boxes@padding@right+\spx@boxes@border@right\relax}% - \ht\spx@tempboxa - \dimexpr\ht\spx@tempboxa+\spx@boxes@border@top+\spx@boxes@padding@top\relax - \dp\spx@tempboxa - \dimexpr\dp\spx@tempboxa+\spx@boxes@padding@bottom+\spx@boxes@border@bottom\relax - \ifspx@boxes@insetshadow - \expandafter\spx@boxes@fcolorbox@insetshadow - \else - \expandafter\spx@boxes@fcolorbox@externalshadow - \fi -} - -% external shadow -\def\spx@boxes@fcolorbox@externalshadow{% - % reserve space to external shadow if on left - \ifspx@boxes@withshadow - \ifspx@boxes@shadowinbbox - \ifdim\spx@boxes@shadow@xoffset<\z@\kern-\spx@boxes@shadow@xoffset\fi - \fi - \fi - % BACKGROUND - % draw background and move back to reference point - \ifspx@boxes@withbackgroundcolor - {\color{spx@boxes@backgroundcolor}% - \vrule\@height\ht\spx@tempboxa - \@depth\dp\spx@tempboxa - \@width\wd\spx@tempboxa - \kern-\wd\spx@tempboxa - }% - \fi - % BOX SHADOW - % draw shadow and move back to reference point - \ifspx@boxes@withshadow - \vbox{% - \moveright\spx@boxes@shadow@xoffset - \hbox{\lower\spx@boxes@shadow@yoffset - \vbox{\ifspx@boxes@withshadowcolor - \color{spx@boxes@shadowcolor}% - \else - % 6.2.0: guard against a manually inserted \color command in - % contents which could leak at a page break to the shadow - \normalcolor - \fi - \ifdim\spx@boxes@shadow@yoffset<\z@ - \hrule\@height-\spx@boxes@shadow@yoffset - \kern\spx@boxes@shadow@yoffset - \fi - \setbox\spx@tempboxb\hb@xt@\wd\spx@tempboxa{% - \ifdim\spx@boxes@shadow@xoffset<\z@\vrule\@width-\spx@boxes@shadow@xoffset\fi - \hss - \ifdim\spx@boxes@shadow@xoffset>\z@\vrule\@width\spx@boxes@shadow@xoffset\fi - }% - \ht\spx@tempboxb\ht\spx@tempboxa - \dp\spx@tempboxb\dp\spx@tempboxa - \box\spx@tempboxb - \ifdim\spx@boxes@shadow@yoffset>\z@ - \kern-\spx@boxes@shadow@yoffset - \hrule\@height\spx@boxes@shadow@yoffset - \fi - \kern-\dp\spx@tempboxa - }% end of \vbox, attention it will have zero depth if yoffset>0 - \kern-\wd\spx@tempboxa - \ifdim\spx@boxes@shadow@xoffset>\z@ - \kern-\spx@boxes@shadow@xoffset - \fi - }% end of \hbox, attention its depth is only yoffset if yoffset>0 - }% end of \vbox - \fi % end of shadow drawing, and we are back to horizontal reference point - % BOX BORDER - \vbox{\ifspx@boxes@withbordercolor - \color{spx@boxes@bordercolor}% - \else - % 6.2.0: guard against a \color command in contents whose effect - % could leak to border at a pagebreak - \normalcolor - \fi - \hrule\@height\spx@boxes@border@top - \kern-\spx@boxes@border@top - \setbox\spx@tempboxb\hb@xt@\wd\spx@tempboxa - {\vrule\@width\spx@boxes@border@left - \hss\vrule\@width\spx@boxes@border@right - }% - \ht\spx@tempboxb\ht\spx@tempboxa - \dp\spx@tempboxb\dp\spx@tempboxa - \box\spx@tempboxb - \kern-\spx@boxes@border@bottom - \hrule\@height\spx@boxes@border@bottom - \kern-\dp\spx@tempboxa - }% attention this box has zero depth due to \hrule at bottom - % step back to horizontal reference point - \kern-\wd\spx@tempboxa - % end of border drawing - % CONTENTS - % adjust the total depth to include the bottom shadow - \ifspx@boxes@withshadow - \ifdim\spx@boxes@shadow@yoffset>\z@ - \dp\spx@tempboxa\dimexpr\dp\spx@tempboxa+\spx@boxes@shadow@yoffset\relax - \fi - \fi - \box\spx@tempboxa - % include lateral shadow in total width - \ifspx@boxes@withshadow - \ifspx@boxes@shadowinbbox - \ifdim\spx@boxes@shadow@xoffset>\z@\kern\spx@boxes@shadow@xoffset\fi - \fi - \fi - \egroup -} - -% inset shadow -% -% The parameters signs are interpreted as in CSS styling. -\def\spx@boxes@fcolorbox@insetshadow{% - % BACKGROUND - % draw background and move back to reference point - \ifspx@boxes@withbackgroundcolor - {\color{spx@boxes@backgroundcolor}% - \vrule\@height\ht\spx@tempboxa - \@depth\dp\spx@tempboxa - \@width\wd\spx@tempboxa - \kern-\wd\spx@tempboxa - }% - \fi - % BOX SHADOW - % draw shadow and move back to reference point - \ifspx@boxes@withshadow - \hbox{\vbox{\ifspx@boxes@withshadowcolor - \color{spx@boxes@shadowcolor}% - \else - % 6.2.0: guard against a manually inserted \color command in - % contents which could leak at a page break to the shadow - \normalcolor - \fi -% NOTA BENE -% We deliberately draw shadow partially under an area later covered by frame -% with the idea to avoid anti-aliasing problems but in fact this may be a bad -% idea with border is thin. -% This may need some extra testing with PDF viewers... reports welcome! - \ifdim\spx@boxes@shadow@yoffset>\z@ - \hrule\@height\dimexpr\spx@boxes@border@top+\spx@boxes@shadow@yoffset\relax - \kern-\spx@boxes@shadow@yoffset - \kern-\spx@boxes@border@top - \fi - \setbox\spx@tempboxb\hb@xt@\wd\spx@tempboxa{% - \ifdim\spx@boxes@shadow@xoffset>\z@ - \vrule\@width\dimexpr\spx@boxes@border@left+\spx@boxes@shadow@xoffset\relax\fi - \hss - \ifdim\spx@boxes@shadow@xoffset<\z@ - \vrule\@width\dimexpr-\spx@boxes@shadow@xoffset+\spx@boxes@border@right\relax\fi - }% - \ht\spx@tempboxb\ht\spx@tempboxa - \dp\spx@tempboxb\dp\spx@tempboxa - \box\spx@tempboxb - \ifdim\spx@boxes@shadow@yoffset<\z@ - \kern\spx@boxes@shadow@yoffset - \kern-\spx@boxes@border@bottom - \hrule\@height\dimexpr-\spx@boxes@shadow@yoffset+\spx@boxes@border@bottom\relax - \fi - \kern-\dp\spx@tempboxa - }% end of \vbox, attention it will have zero depth if yoffset<0 - \kern-\wd\spx@tempboxa - }% end of \hbox, attention its depth is only |yoffset| if yoffset<0 - \fi % end of inset shadow drawing, and we are back to horizontal reference point - % BOX BORDER - \vbox{\ifspx@boxes@withbordercolor - \color{spx@boxes@bordercolor}% - \else - % 6.2.0: guard against a \color command in contents whose effect - % could leak to border at a pagebreak - \normalcolor - \fi - \hrule\@height\spx@boxes@border@top - \kern-\spx@boxes@border@top - \setbox\spx@tempboxb\hb@xt@\wd\spx@tempboxa - {\vrule\@width\spx@boxes@border@left - \hss\vrule\@width\spx@boxes@border@right - }% - \ht\spx@tempboxb\ht\spx@tempboxa - \dp\spx@tempboxb\dp\spx@tempboxa - \box\spx@tempboxb - \kern-\spx@boxes@border@bottom - \hrule\@height\spx@boxes@border@bottom - \kern-\dp\spx@tempboxa - }% attention this box has zero depth due to \hrule at bottom - % step back to horizontal reference point - \kern-\wd\spx@tempboxa - % end of border drawing - % CONTENTS - \box\spx@tempboxa - \egroup -} - -% let's abort input if pict2e package could not be loaded. -% To be extra safe we also alias @rounded to @rectangle but -% a priori the architecture is done so that @rounded will never -% be called in that case by other Sphinx LaTeX components. -\@ifpackageloaded{pict2e} - {} - {\def\spx@boxes@fcolorbox@rounded{\spx@boxes@fcolorbox@rectangle}% - \endinput - } - -% we proceed now in the context of pict2e being available and loaded -% (TeX being a macro-expansion based language it would have -% swallowed all the coming definitions even if pict2e -% had in fact not been loaded... but we aborted the input above) -%%%%%%%% -%//// \spx@boxes@fcolorbox@rounded -% -% Prior to 6.2.0, a constant border-width was applied as the border was -% obtained as a \strokepath. This allowed 4 distinct radii but not to vary the -% border widths. Now the border is drawn by two \fillpath operation, the first -% one filling up to external border, the second one actually filling for the -% background paradoxically on top of it, up to internal border path. -% -% This 6.2.0 abandonment of \strokepath allowed great simplification in -% supporting opentop, openbottom and openboth situations, and it can -% allow automatic support of openleft and openright analogs. -% -% And 6.2.0 also implements elliptical arcs thanks to ellipse package, -% which extends pict2e. - -% Currently, inset shadow is not supported. -% -% Prior to 6.2.0 an inset shadow triggered the rectangle variant, so we never -% ended here, but now it is simply ignored. This change does not appear to me -% to be breaking, as it changes output only for conf.py's specifying both -% rounded corners and an inset shadow and the documentation said it was -% incompatible. - -% wrappers for pict2e usage if old -% Better not to copy over 2020 pict2e definitions in case -% something internal changes -% However our wrappers will work ONLY with dimensional inputs -% No need to pre-expand the arguments -% Braces in case the expression uses parentheses -\def\spx@moveto(#1,#2){\moveto({\strip@pt\dimexpr#1\relax},{\strip@pt\dimexpr#2\relax})} -\def\spx@lineto(#1,#2){\lineto({\strip@pt\dimexpr#1\relax},{\strip@pt\dimexpr#2\relax})} -% attention here the [N] becomes mandatory -% \circlearc[<N>]{<X>}{<Y>}{<RAD>}{<ANGLE1>}{<ANGLE2>} -\def\spx@circlearc[#1]#2#3#4%#5#6 - {\circlearc[#1]{\strip@pt\dimexpr#2\relax}% - {\strip@pt\dimexpr#3\relax}% - {\strip@pt\dimexpr#4\relax}% - } -% attention here too the [N] becomes mandatory -% the core path macro of ellipse.sty. Thanks to Daan Leijen, author of this -% package. -% \elliparc [<initial>]{<center-x>}{<center-y>}{<x-rad>}{<y-rad>}{<start-angle>}{<end-angle>} -% maybe this wrapper is unneeded but I don't have real time to check -\def\spx@elliparc[#1]#2#3#4#5%#6#7 - {\elliparc[#1]{\strip@pt\dimexpr#2\relax}% - {\strip@pt\dimexpr#3\relax}% - {\strip@pt\dimexpr#4\relax}% - {\strip@pt\dimexpr#5\relax}% - } - -% Macro whose execution prepares a path to be either stroked or filled -% Only fill operation is used at 6.2.0. The radii are given by the set box -% parameters, but the width and height are in \spx@width and \spx@height. A -% \put command will be used for appropriate shifts. -% 6.2.0 adds elliptical corners! -% But I feel perhaps I need to think about how x-radius and y-radius should -% interact with border-width. So consider output WIP for time being. -\def\spx@boxes@border@defpath{% - \spx@moveto(\spx@boxes@radius@bottomleft@x,\z@)% our \spx@moveto is a bit rigid - % and we must use \z@ not 0 here - \spx@lineto(\spx@width-\spx@boxes@radius@bottomright@x,\z@)% - % x and y radii are either both positive or both zero - % probably not needed to actually guard against the latter case, - % let's do it nevertheless - \ifdim\spx@boxes@radius@bottomright@x>\z@ - \ifdim\spx@boxes@radius@bottomright@x=\spx@boxes@radius@bottomright@y - \spx@circlearc[2]{\spx@width-\spx@boxes@radius@bottomright@x}% - {\spx@boxes@radius@bottomright@y}% - {\spx@boxes@radius@bottomright@x}{-90}{0}% - \else - \spx@elliparc[2]{\spx@width-\spx@boxes@radius@bottomright@x}% - {\spx@boxes@radius@bottomright@y}% - {\spx@boxes@radius@bottomright@x} - {\spx@boxes@radius@bottomright@y}{-90}{0}% - \fi - \fi - \spx@lineto(\spx@width,% - \spx@height-\spx@boxes@radius@topright@y)% - \ifdim\spx@boxes@radius@topright@x>\z@ - \ifdim\spx@boxes@radius@topright@x=\spx@boxes@radius@topright@y - \spx@circlearc[2]{\spx@width-\spx@boxes@radius@topright@x} - {\spx@height-\spx@boxes@radius@topright@y}% - {\spx@boxes@radius@topright@x}{0}{90}% - \else - \spx@elliparc[2]{\spx@width-\spx@boxes@radius@topright@x} - {\spx@height-\spx@boxes@radius@topright@y}% - {\spx@boxes@radius@topright@x}% - {\spx@boxes@radius@topright@y}{0}{90}% - \fi - \fi - \spx@lineto(\spx@boxes@radius@topleft@x,\spx@height)% - \ifdim\spx@boxes@radius@topleft@x>\z@ - \ifdim\spx@boxes@radius@topleft@x=\spx@boxes@radius@topleft@y - \spx@circlearc[2]{\spx@boxes@radius@topleft@x}% - {\spx@height-\spx@boxes@radius@topleft@y}% - {\spx@boxes@radius@topleft@x}{90}{180}% - \else - \spx@elliparc[2]{\spx@boxes@radius@topleft@x}% - {\spx@height-\spx@boxes@radius@topleft@y}% - {\spx@boxes@radius@topleft@x}% - {\spx@boxes@radius@topleft@y}{90}{180}% - \fi - \fi - \spx@lineto(\z@,\spx@boxes@radius@bottomleft@y)% - \ifdim\spx@boxes@radius@bottomleft@x>\z@ - \ifdim\spx@boxes@radius@bottomleft@x=\spx@boxes@radius@bottomleft@y - \spx@circlearc[2]{\spx@boxes@radius@bottomleft@x}% - {\spx@boxes@radius@bottomleft@y}% - {\spx@boxes@radius@bottomleft@x}{180}{270}% - \else - \spx@elliparc[2]{\spx@boxes@radius@bottomleft@x}% - {\spx@boxes@radius@bottomleft@y}% - {\spx@boxes@radius@bottomleft@x}% - {\spx@boxes@radius@bottomleft@y}{180}{270}% - \fi - \fi -}% end of definition of \spx@boxes@border@defpath - -% The customization of the various parameters must have been done via an -% appropriate call to \spx@boxes@fcolorbox@setup, which will have set up -% \spx@boxes@fcolorbox to expand to \spx@boxes@fcolorbox@rounded, and will -% have set its various parameters. -% -\long\def\spx@boxes@fcolorbox@rounded #1{% - \hbox{% - \ifspx@boxes@withshadow - \ifspx@boxes@insetshadow - \spx@boxes@withshadowfalse % ignore inset shadow - \fi - \fi - % reserve space to external shadow if on left - \ifspx@boxes@withshadow - \ifspx@boxes@shadowinbbox - \ifdim\spx@boxes@shadow@xoffset<\z@\kern-\spx@boxes@shadow@xoffset\fi - \fi - \fi - \vbox{% - % adjust vertical bbox - \ifspx@boxes@withshadow - \ifdim\spx@boxes@shadow@yoffset<\z@ - \kern-\spx@boxes@shadow@yoffset - \fi - \fi - \setlength{\unitlength}{1pt}% - \setbox\spx@tempboxa - \hbox{\kern\dimexpr\spx@boxes@border@left+\spx@boxes@padding@left\relax - {#1}% - \kern\dimexpr\spx@boxes@padding@right+\spx@boxes@border@right\relax}% - \ht\spx@tempboxa - \dimexpr\ht\spx@tempboxa+\spx@boxes@border@top+\spx@boxes@padding@top\relax - \dp\spx@tempboxa - \dimexpr\dp\spx@tempboxa+\spx@boxes@padding@bottom+\spx@boxes@border@bottom\relax - \edef\spx@width{\number\wd\spx@tempboxa sp}% - \edef\spx@height{\number\dimexpr\ht\spx@tempboxa+\dp\spx@tempboxa sp}% - \hbox{% - \begin{picture}% - % \strip@pt\dimexpr to work around "old" LaTeX picture limitation - % (we could use the "picture" package, this would add another dependency) - (\strip@pt\dimexpr\spx@width\relax,\strip@pt\dimexpr\spx@height\relax)% - \spx@boxes@border@defpath - \ifspx@boxes@withshadow - \ifspx@boxes@withshadowcolor - \color{spx@boxes@shadowcolor}% - \else - % 6.2.0: here and elsewhere guard against a manually inserted - % \color command in contents which could leak to the shadow - % to the shadow - \normalcolor - \fi - \put(\strip@pt\spx@boxes@shadow@xoffset,% - \strip@pt\dimexpr-\spx@boxes@shadow@yoffset\relax) - {\fillpath}% - \fi - \spx@boxes@border@defpath% must be redone after each \fillpath! (even if - % was in a \put) - \ifspx@boxes@withbordercolor - \color{spx@boxes@bordercolor}% - \else - \normalcolor - \fi - \fillpath - \ifspx@boxes@withbackgroundcolor - \color{spx@boxes@backgroundcolor}% - \else - \color{white}% - \fi - \edef\spx@width{\number\dimexpr\spx@width-\spx@boxes@border@left - -\spx@boxes@border@right sp}% - \edef\spx@height{\number\dimexpr\spx@height-\spx@boxes@border@top - -\spx@boxes@border@bottom sp}% - % redefine a path (in relative coordinates) matching the area delimited - % by the internal borders - \spx@boxes@border@defpath - % use \put to shift, and fill it with background color - \put(\strip@pt\spx@boxes@border@left,\strip@pt\spx@boxes@border@bottom) - {\fillpath}% - \end{picture}}% end of picture \hbox in \vbox - % back-up vertically for outputting the contents - \kern-\dimexpr\ht\spx@tempboxa+\dp\spx@tempboxa\relax - % adjust vertical bbox - \ifspx@boxes@withshadow - \ifdim\spx@boxes@shadow@yoffset>\z@ - \dp\spx@tempboxa\dimexpr\dp\spx@tempboxa+\spx@boxes@shadow@yoffset\relax - \fi - \fi - % inhibit TeX's "line skip" adjustment when piling up hboxes in a vbox - \nointerlineskip - \box\spx@tempboxa - }% end of \vbox - % include lateral shadow in total width - \ifspx@boxes@withshadow - \ifspx@boxes@shadowinbbox - \ifdim\spx@boxes@shadow@xoffset>\z@\kern\spx@boxes@shadow@xoffset\fi - \fi - \fi - }% end of \hbox -}% - - -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxpackagecyrillic.sty b/crypto/krb5/doc/pdf/sphinxpackagecyrillic.sty deleted file mode 100644 index 9aa62fc22baa..000000000000 --- a/crypto/krb5/doc/pdf/sphinxpackagecyrillic.sty +++ /dev/null @@ -1,55 +0,0 @@ -%% CYRILLIC IN NON-CYRILLIC DOCUMENTS (pdflatex only) -% -% refs: https://tex.stackexchange.com/q/460271/ -\ProvidesPackage{sphinxpackagecyrillic}% - [2018/11/21 v2.0 support for Cyrillic in non-Cyrillic documents] -\RequirePackage{kvoptions} -\SetupKeyvalOptions{prefix=spx@cyropt@} % use \spx@cyropt@ prefix -\DeclareBoolOption[false]{Xtwo} -\DeclareBoolOption[false]{TtwoA} -\DeclareDefaultOption{\@unknownoptionerror} -\ProcessLocalKeyvalOptions* % ignore class options - -\ifspx@cyropt@Xtwo -% original code by tex.sx user egreg (updated 2019/10/28): -% https://tex.stackexchange.com/a/460325/ -% 159 Cyrillic glyphs as available in X2 TeX 8bit font encoding -% This assumes inputenc loaded with utf8 option, or LaTeX release -% as recent as 2018/04/01 which does it automatically. - \@tfor\next:=% - {Ё}{Ђ}{Є}{Ѕ}{І}{Ј}{Љ}{Њ}{Ћ}{Ў}{Џ}{А}{Б}{В}{Г}{Д}{Е}{Ж}{З}{И}{Й}% - {К}{Л}{М}{Н}{О}{П}{Р}{С}{Т}{У}{Ф}{Х}{Ц}{Ч}{Ш}{Щ}{Ъ}{Ы}{Ь}{Э}{Ю}% - {Я}{а}{б}{в}{г}{д}{е}{ж}{з}{и}{й}{к}{л}{м}{н}{о}{п}{р}{с}{т}{у}% - {ф}{х}{ц}{ч}{ш}{щ}{ъ}{ы}{ь}{э}{ю}{я}{ё}{ђ}{є}{ѕ}{і}{ј}{љ}{њ}{ћ}% - {ў}{џ}{Ѣ}{ѣ}{Ѫ}{ѫ}{Ѵ}{ѵ}{Ґ}{ґ}{Ғ}{ғ}{Ҕ}{ҕ}{Җ}{җ}{Ҙ}{ҙ}{Қ}{қ}{Ҝ}{ҝ}% - {Ҟ}{ҟ}{Ҡ}{ҡ}{Ң}{ң}{Ҥ}{ҥ}{Ҧ}{ҧ}{Ҩ}{ҩ}{Ҫ}{ҫ}{Ҭ}{ҭ}{Ү}{ү}{Ұ}{ұ}{Ҳ}{ҳ}% - {Ҵ}{ҵ}{Ҷ}{ҷ}{Ҹ}{ҹ}{Һ}{һ}{Ҽ}{ҽ}{Ҿ}{ҿ}{Ӏ}{Ӄ}{ӄ}{Ӆ}{ӆ}{Ӈ}{ӈ}{Ӌ}{ӌ}% - {Ӎ}{ӎ}{Ӕ}{ӕ}{Ә}{ә}{Ӡ}{ӡ}{Ө}{ө}\do - {% - \begingroup\def\IeC{\protect\DeclareTextSymbolDefault}% - \protected@edef\@temp{\endgroup - \@ifl@t@r{\fmtversion}{2019/10/01}{\csname u8:\next\endcsname}{\next}}% - \@temp{X2}% - }% -\else -\ifspx@cyropt@TtwoA -% original code by tex.sx user jfbu: -% https://tex.stackexchange.com/a/460305/ -% 63*2+1=127 Cyrillic glyphs as found in T2A 8bit TeX font-encoding - \@tfor\@tempa:=% - {ae}{a}{b}{chrdsc}{chvcrs}{ch}{c}{dje}{dze}{dzhe}{d}{erev}{ery}{e}% - {f}{ghcrs}{gup}{g}{hdsc}{hrdsn}{h}{ie}{ii}{ishrt}{i}{je}% - {kbeak}{kdsc}{kvcrs}{k}{lje}{l}{m}{ndsc}{ng}{nje}{n}{otld}{o}{p}{r}% - {schwa}{sdsc}{sftsn}{shch}{shha}{sh}{s}{tshe}{t}{ushrt}{u}{v}% - {ya}{yhcrs}{yi}{yo}{yu}{y}{zdsc}{zhdsc}{zh}{z}\do - {% - \expandafter\DeclareTextSymbolDefault\expandafter - {\csname cyr\@tempa\endcsname}{T2A}% - \expandafter\uppercase\expandafter{\expandafter - \def\expandafter\@tempa\expandafter{\@tempa}}% - \expandafter\DeclareTextSymbolDefault\expandafter - {\csname CYR\@tempa\endcsname}{T2A}% - }% - \DeclareTextSymbolDefault{\CYRpalochka}{T2A}% -\fi\fi -\endinput diff --git a/crypto/krb5/doc/pdf/sphinxpackagefootnote.sty b/crypto/krb5/doc/pdf/sphinxpackagefootnote.sty deleted file mode 100644 index 55901234df17..000000000000 --- a/crypto/krb5/doc/pdf/sphinxpackagefootnote.sty +++ /dev/null @@ -1,433 +0,0 @@ -\NeedsTeXFormat{LaTeX2e} -\ProvidesPackage{sphinxpackagefootnote}% - [2022/08/15 v5.3.0 Sphinx custom footnotehyper package (Sphinx team)] -%% -%% Package: sphinxpackagefootnote -%% Version: based on footnotehyper.sty 2021/02/04 v1.1d -%% https://www.ctan.org/pkg/footnotehyper -%% License: the one applying to Sphinx -%% -% Provides support for footnote mark-up from Sphinx latex writer: -% - "footnote" and "footnotetext" environments allowing verbatim material -% - "savenotes" environment for wrapping environments, such as for tables -% which have problems with LaTeX footnotes -% - hyperlinks -% -% Sphinx uses exclusively this mark-up for footnotes: -% - \begin{footnote}[N] -% - \begin{footnotetext}[N] -% - \sphinxfootnotemark[N] -% where N is a number. -% -%% Some small differences from upstream footnotehyper.sty: -%% - a tabulary compatibility layer (partial but enough for Sphinx), -%% - usage of \spx@opt@BeforeFootnote -%% - usage of \sphinxunactivateextrasandspace from sphinx.sty, -%% - \sphinxlongtablepatch -%% -%% Starting with Sphinx v4.5.0, inherited footnotehyper macros for -%% footnote/footnotetext receive some Sphinx specific extras to -%% implement "intelligent" footnote marks checking page numbers. -%% -%% All footnotes output from Sphinx are hyperlinked. With "savenotes" -%% footnotes may appear on page distinct from footnote mark, the latter -%% will indicate page number of the footnote. -\newif\iffootnotehyperparse\footnotehyperparsetrue -\DeclareOption*{\PackageWarning{sphinxpackagefootnote}{Option `\CurrentOption' is unknown}}% -\ProcessOptions\relax -\newbox\FNH@notes -\newtoks\FNH@toks % 1.1c -\newdimen\FNH@width -\let\FNH@colwidth\columnwidth -\newif\ifFNH@savingnotes -\AtBeginDocument {% - \let\FNH@latex@footnote \footnote - \let\FNH@latex@footnotetext\footnotetext - \let\FNH@H@@footnotetext \@footnotetext - \let\FNH@H@@mpfootnotetext \@mpfootnotetext - \newenvironment{savenotes} - {\FNH@savenotes\ignorespaces}{\FNH@spewnotes\ignorespacesafterend}% - \let\spewnotes \FNH@spewnotes - \let\footnote \FNH@footnote - \let\footnotetext \FNH@footnotetext - \let\endfootnote \FNH@endfntext - \let\endfootnotetext\FNH@endfntext - % always True branch taken with Sphinx - \@ifpackageloaded{hyperref} - {\ifHy@hyperfootnotes - \let\FNH@H@@footnotetext\H@@footnotetext - \let\FNH@H@@mpfootnotetext\H@@mpfootnotetext - \else - \let\FNH@hyper@fntext\FNH@nohyp@fntext - \fi}% - {\let\FNH@hyper@fntext\FNH@nohyp@fntext}% -}% -\def\FNH@hyper@fntext{\FNH@fntext\FNH@hyper@fntext@i}% -\def\FNH@nohyp@fntext{\FNH@fntext\FNH@nohyp@fntext@i}% -\def\FNH@fntext #1{% - \ifx\ifmeasuring@\@undefined - \expandafter\@secondoftwo\else\expandafter\@firstofone\fi -% these two lines modified for Sphinx (tabulary compatibility): - {\ifmeasuring@\expandafter\@gobbletwo\else\expandafter\@firstofone\fi}% - {\ifx\equation$\expandafter\@gobbletwo\fi #1}%$ -}% -\long\def\FNH@hyper@fntext@i#1{% - \global\setbox\FNH@notes\vbox - {\unvbox\FNH@notes - \FNH@startnote - \@makefntext - {\rule\z@\footnotesep\ignorespaces - \ifHy@nesting\expandafter\ltx@firstoftwo - \else\expandafter\ltx@secondoftwo - \fi - {\expandafter\hyper@@anchor\expandafter{\Hy@footnote@currentHref}{#1}}% - {\Hy@raisedlink - {\expandafter\hyper@@anchor\expandafter{\Hy@footnote@currentHref}% - {\relax}}% - \let\@currentHref\Hy@footnote@currentHref - \let\@currentlabelname\@empty - #1}% - \@finalstrut\strutbox - }% - \FNH@endnote - }% -}% -\long\def\FNH@nohyp@fntext@i#1{% - \global\setbox\FNH@notes\vbox - {\unvbox\FNH@notes - \FNH@startnote - \@makefntext{\rule\z@\footnotesep\ignorespaces#1\@finalstrut\strutbox}% - \FNH@endnote - }% -}% -\def\FNH@startnote{% - \hsize\FNH@colwidth - \interlinepenalty\interfootnotelinepenalty - \reset@font\footnotesize - \floatingpenalty\@MM - \@parboxrestore - \protected@edef\@currentlabel{\csname p@\@mpfn\endcsname\@thefnmark}% - \color@begingroup -}% -\def\FNH@endnote{\color@endgroup}% -\def\FNH@savenotes{% - \begingroup - \ifFNH@savingnotes\else - \FNH@savingnotestrue - \let\@footnotetext \FNH@hyper@fntext - \let\@mpfootnotetext \FNH@hyper@fntext - \let\H@@mpfootnotetext\FNH@nohyp@fntext - \FNH@width\columnwidth - \let\FNH@colwidth\FNH@width - \global\setbox\FNH@notes\box\voidb@x - \let\FNH@thempfn\thempfn - \let\FNH@mpfn\@mpfn - \ifx\@minipagerestore\relax\let\@minipagerestore\@empty\fi - \expandafter\def\expandafter\@minipagerestore\expandafter{% - \@minipagerestore - \let\thempfn\FNH@thempfn - \let\@mpfn\FNH@mpfn - }% - \fi -}% -\def\FNH@spewnotes {% - \if@endpe\ifx\par\@@par\FNH@toks{}\else - \FNH@toks\expandafter{\expandafter - \def\expandafter\par\expandafter{\par}\@endpetrue}% - \expandafter\expandafter\expandafter - \FNH@toks - \expandafter\expandafter\expandafter - {\expandafter\the\expandafter\FNH@toks - \expandafter\def\expandafter\@par\expandafter{\@par}}% - \expandafter\expandafter\expandafter - \FNH@toks - \expandafter\expandafter\expandafter - {\expandafter\the\expandafter\FNH@toks - \expandafter\everypar\expandafter{\the\everypar}}\fi - \else\FNH@toks{}\fi - \expandafter - \endgroup\the\FNH@toks - \ifFNH@savingnotes\else - \ifvoid\FNH@notes\else - \begingroup - \let\@makefntext\@empty - \let\@finalstrut\@gobble - \let\rule\@gobbletwo - \ifx\@footnotetext\@mpfootnotetext - \expandafter\FNH@H@@mpfootnotetext - \else - \expandafter\FNH@H@@footnotetext - \fi{\unvbox\FNH@notes}% - \endgroup - \fi - \fi -}% -\def\FNH@footnote@envname {footnote}% -\def\FNH@footnotetext@envname{footnotetext}% -\def\FNH@footnote{% -% this line added for Sphinx: - \spx@opt@BeforeFootnote - \ifx\@currenvir\FNH@footnote@envname - \expandafter\FNH@footnoteenv - \else - \expandafter\FNH@latex@footnote - \fi -}% -\def\FNH@footnoteenv{% -% this line added for Sphinx (footnotes in parsed literal blocks): - \catcode13=5 \sphinxunactivateextrasandspace - \@ifnextchar[% - \FNH@footnoteenv@i %] - {\stepcounter\@mpfn - \protected@xdef\@thefnmark{\thempfn}% - \@footnotemark - \def\FNH@endfntext@fntext{\@footnotetext}% - \FNH@startfntext}% -}% -\def\FNH@footnoteenv@i[#1]{% - \begingroup - % This legacy code from LaTeX core restricts #1 to be digits only - % This limitation could be lifted but legacy Sphinx anyhow obeys it - \csname c@\@mpfn\endcsname #1\relax - \unrestored@protected@xdef\@thefnmark{\thempfn}% - \endgroup -% -- Sphinx specific: -% currently commented out due to -% https://github.com/sphinx-doc/sphinx/pull/10191#issuecomment-1038807448 -% Memo: memoir class detection of successive footnote marks (to separate them -% by commas) is broken by \refstepcounter and also by \label, and some -% mitigation such as in \sphinxfootref would be needed - % \global\let\spx@saved@thefnmark\@thefnmark - % % this is done to access robustly the page number where footnote mark is - % \refstepcounter{sphinxfootnotemark}\label{footnotemark.\thesphinxfootnotemark}% - % % if possible, compare page numbers of mark and footnote to define \@thefnmark - % \ltx@ifundefined{r@\thesphinxscope.footnote.#1}% - % {}% one more latex run is needed - % {\sphinx@xdef@thefnmark{#1}}% check of page numbers possible -% -- - \@footnotemark - \def\FNH@endfntext@fntext{\@footnotetext}% -% -- Sphinx specific: - % we need to reset \@thefnmark as it is used by \FNH@startfntext via - % \FNH@startnote to set \@currentlabel which will be used by \label -% currently commented out (see above) - % \global\let\@thefnmark\spx@saved@thefnmark -% -- - \FNH@startfntext -% -- again Sphinx specific - % \@currentlabel as needed by \label got set by \FNH@startnote - % insert this at start of footnote text then the label will allow - % to robustly know on which page the footnote text ends up -% currently only of use for extra footnote marks so in case footnote multiply referred - \phantomsection\label{\thesphinxscope.footnote.#1}% -}% -\def\FNH@footnotetext{% - \ifx\@currenvir\FNH@footnotetext@envname - \expandafter\FNH@footnotetextenv - \else - \expandafter\FNH@latex@footnotetext - \fi -}% -\def\FNH@footnotetextenv{% - \@ifnextchar[% - \FNH@footnotetextenv@i %] - {\protected@xdef\@thefnmark{\thempfn}% - \def\FNH@endfntext@fntext{\@footnotetext}% - \FNH@startfntext}% -}% -\def\FNH@footnotetextenv@i[#1]{% - \begingroup - \csname c@\@mpfn\endcsname #1\relax - \unrestored@protected@xdef\@thefnmark{\thempfn}% - \endgroup - \ifFNH@savingnotes - \def\FNH@endfntext@fntext{\FNH@nohyp@fntext}% - \else - \def\FNH@endfntext@fntext{\FNH@H@@footnotetext}% - \fi - \FNH@startfntext -% -- Sphinx specific addition - \phantomsection\label{\thesphinxscope.footnote.#1}% -}% -\def\FNH@startfntext{% - \setbox\z@\vbox\bgroup - \FNH@startnote - \FNH@prefntext - \rule\z@\footnotesep\ignorespaces -}% -\def\FNH@endfntext {% - \@finalstrut\strutbox - \FNH@postfntext - \FNH@endnote - \egroup - \begingroup - \let\@makefntext\@empty\let\@finalstrut\@gobble\let\rule\@gobbletwo - \FNH@endfntext@fntext {\unvbox\z@}% - \endgroup -}% -\let\FNH@prefntext\@empty -\let\FNH@postfntext\@empty -\AtBeginDocument{\iffootnotehyperparse\expandafter\FNH@check\fi}% -\def\FNH@safeif#1{% - \iftrue\csname if#1\endcsname\csname fi\endcsname\expandafter\@firstoftwo - \else\csname fi\endcsname\expandafter\@secondoftwo - \fi -}% -\def\FNH@check{% - \ifx\@makefntextFB\@undefined\expandafter\FNH@check@ - \else\expandafter\FNH@frenchb@ - \fi -}% -\def\FNH@frenchb@{% - \def\FNH@prefntext{% - \localleftbox{}% - \let\FBeverypar@save\FBeverypar@quote - \let\FBeverypar@quote\relax - \FNH@safeif{FB@koma}% - {\FNH@safeif{FBFrenchFootnotes}% - {\ifx\footnote\thanks - \let\@@makefnmark\@@makefnmarkTH - \@makefntextTH{} % space as in french.ldf - \else - \let\@@makefnmark\@@makefnmarkFB - \@makefntextFB{} % space as in french.ldf - \fi - }{\let\@@makefnmark\@@makefnmarkORI - \@makefntextORI{}% no space as in french.ldf - }% - }% - {\FNH@safeif{FBFrenchFootnotes}% - {\@makefntextFB{}}% - {\@makefntextORI{}}% - }% - }% - \def\FNH@postfntext{% - \let\FBeverypar@quote\FBeverypar@save - \localleftbox{\FBeveryline@quote}% - }% -}% -\def\FNH@check@{% - \expandafter\FNH@check@a\@makefntext{1.2!3?4,}% - \FNH@@@1.2!3?4,\FNH@@@\relax -}% -\long\def\FNH@check@a #11.2!3?4,#2\FNH@@@#3{% - \ifx\relax#3\expandafter\FNH@checkagain@ - \else - \def\FNH@prefntext{#1}\def\FNH@postfntext{#2}% - \expandafter\FNH@check@b - \fi -}% -\def\FNH@checkagain@{% - \expandafter\FNH@checkagain@a - \detokenize\expandafter{\@makefntext{1.2!3?4,}}\relax\FNH@@@ -}% -\edef\FNH@temp{\noexpand\FNH@checkagain@a ##1\string{1.2!3?4,\string}}% -\expandafter\def\FNH@temp#2#3\FNH@@@{% - \ifx\relax#2% - \def\FNH@prefntext{\@makefntext{}}% - \else\FNH@bad@makefntext@alert - \fi -}% -\def\FNH@check@b #1\relax{% - \expandafter\expandafter\expandafter\FNH@check@c - \expandafter\meaning\expandafter\FNH@prefntext - \meaning\FNH@postfntext1.2!3?4,\FNH@check@c\relax -}% -\def\FNH@check@c #11.2!3?4,#2#3\relax{% - \ifx\FNH@check@c#2\else\FNH@bad@makefntext@alert\fi -}% -% slight reformulation for Sphinx -\def\FNH@bad@makefntext@alert{% - \sphinxbuildwarning{badfootnotes}% - \PackageWarningNoLine{sphinxpackagefootnote}% - {Footnotes will be sub-optimal, sorry. This is due to the document class or^^J - some package modifying macro \string\@makefntext.^^J - You can try to report this incompatibility at^^J - https://github.com/sphinx-doc/sphinx with this info:}% - \typeout{\meaning\@makefntext}% - \let\FNH@prefntext\@empty\let\FNH@postfntext\@empty -}% -% this macro from original footnote.sty is not used anymore by Sphinx -% but for simplicity sake let's just keep it as is -\def\makesavenoteenv{\@ifnextchar[\FNH@msne@ii\FNH@msne@i}%] -\def\FNH@msne@i #1{% - \expandafter\let\csname FNH$#1\expandafter\endcsname %$ - \csname #1\endcsname - \expandafter\let\csname endFNH$#1\expandafter\endcsname %$ - \csname end#1\endcsname - \FNH@msne@ii[#1]{FNH$#1}%$ -}% -\def\FNH@msne@ii[#1]#2{% - \expandafter\edef\csname#1\endcsname{% - \noexpand\savenotes - \expandafter\noexpand\csname#2\endcsname - }% - \expandafter\edef\csname end#1\endcsname{% - \expandafter\noexpand\csname end#2\endcsname - \noexpand\expandafter - \noexpand\spewnotes - \noexpand\if@endpe\noexpand\@endpetrue\noexpand\fi - }% -}% -% -% some extras for Sphinx : -% \sphinxfootnotemark: -% - if in section titles will auto-remove itself from TOC -\def\sphinxfootnotemark [#1]% - {\ifx\thepage\relax\else\sphinxfootref{#1}\fi}% -\newcounter{sphinxfootnotemark} -\renewcommand\thesphinxfootnotemark{\number\value{sphinxfootnotemark}} -% - compares page number of footnote mark versus the one of footnote text -\def\sphinx@xdef@thefnmark#1{% - \expandafter\expandafter\expandafter\sphinx@footref@get - \csname r@\thesphinxscope.footnote.#1\endcsname\relax - \expandafter\expandafter\expandafter\sphinx@footmark@getpage - \csname r@footnotemark.\thesphinxfootnotemark\endcsname\thepage\relax - \protected@xdef\@thefnmark{% - \ifx\spx@footmarkpage\spx@footrefpage - \spx@footreflabel - \else - % the macro \sphinxthefootnotemark is in sphinx.sty - \sphinxthefootnotemark{\spx@footreflabel}{\spx@footrefpage}% - \fi - }% -}% -\def\sphinx@footref@get #1#2#3#4#5\relax{% - \def\spx@footreflabel{#1}% - \def\spx@footrefpage {#2}% - \def\spx@footrefHref {#4}% -}% -\def\sphinx@footmark@getpage #1#2#3\relax{% - \edef\spx@footmarkpage{#2}% -}% -\protected\def\sphinxfootref#1{% #1 always is explicit number in Sphinx - \spx@opt@BeforeFootnote - % each of \refstepcounter and \label interferes with memoir class detection - % of successive footnote marks, so we move them to inside \@makefnmark - \let\spx@saved@makefnmark\@makefnmark - \ltx@ifundefined{r@\thesphinxscope.footnote.#1}% - {\gdef\@thefnmark{?}% on first LaTeX run - \refstepcounter{sphinxfootnotemark}\label{footnotemark.\thesphinxfootnotemark}% - }% - {\sphinx@xdef@thefnmark{#1}% also defines \spx@footrefHref - \def\@makefnmark{% will be used by \H@@footnotemark - \refstepcounter{sphinxfootnotemark}\label{footnotemark.\thesphinxfootnotemark}% - \hyper@linkstart{link}{\spx@footrefHref}% - \spx@saved@makefnmark - \hyper@linkend - }% - }% - \H@@footnotemark - \let\@makefnmark\spx@saved@makefnmark -}% -\AtBeginDocument{% - % let hyperref less complain - \pdfstringdefDisableCommands{\def\sphinxfootnotemark [#1]{}}% - % to obtain hyperlinked footnotes in longtable environment we must replace - % hyperref's patch of longtable's patch of \@footnotetext by our own - \let\LT@p@ftntext\FNH@hyper@fntext - % this *requires* longtable to be used always wrapped in savenotes environment -}% -\endinput -%% -%% End of file `sphinxpackagefootnote.sty'. diff --git a/crypto/krb5/doc/pdf/user.pdf b/crypto/krb5/doc/pdf/user.pdf Binary files differdeleted file mode 100644 index f3d969fd7232..000000000000 --- a/crypto/krb5/doc/pdf/user.pdf +++ /dev/null diff --git a/crypto/krb5/doc/pdf/user.tex b/crypto/krb5/doc/pdf/user.tex deleted file mode 100644 index f8e4a18a5a72..000000000000 --- a/crypto/krb5/doc/pdf/user.tex +++ /dev/null @@ -1,2493 +0,0 @@ -%% Generated by Sphinx. -\def\sphinxdocclass{report} -\documentclass[letterpaper,10pt,english]{sphinxmanual} -\ifdefined\pdfpxdimen - \let\sphinxpxdimen\pdfpxdimen\else\newdimen\sphinxpxdimen -\fi \sphinxpxdimen=.75bp\relax -\ifdefined\pdfimageresolution - \pdfimageresolution= \numexpr \dimexpr1in\relax/\sphinxpxdimen\relax -\fi -%% let collapsible pdf bookmarks panel have high depth per default -\PassOptionsToPackage{bookmarksdepth=5}{hyperref} - -\PassOptionsToPackage{booktabs}{sphinx} -\PassOptionsToPackage{colorrows}{sphinx} - -\PassOptionsToPackage{warn}{textcomp} -\usepackage[utf8]{inputenc} -\ifdefined\DeclareUnicodeCharacter -% support both utf8 and utf8x syntaxes - \ifdefined\DeclareUnicodeCharacterAsOptional - \def\sphinxDUC#1{\DeclareUnicodeCharacter{"#1}} - \else - \let\sphinxDUC\DeclareUnicodeCharacter - \fi - \sphinxDUC{00A0}{\nobreakspace} - \sphinxDUC{2500}{\sphinxunichar{2500}} - \sphinxDUC{2502}{\sphinxunichar{2502}} - \sphinxDUC{2514}{\sphinxunichar{2514}} - \sphinxDUC{251C}{\sphinxunichar{251C}} - \sphinxDUC{2572}{\textbackslash} -\fi -\usepackage{cmap} -\usepackage[T1]{fontenc} -\usepackage{amsmath,amssymb,amstext} -\usepackage{babel} - - - -\usepackage{tgtermes} -\usepackage{tgheros} -\renewcommand{\ttdefault}{txtt} - - - -\usepackage[Bjarne]{fncychap} -\usepackage{sphinx} - -\fvset{fontsize=auto} -\usepackage{geometry} - - -% Include hyperref last. -\usepackage{hyperref} -% Fix anchor placement for figures with captions. -\usepackage{hypcap}% it must be loaded after hyperref. -% Set up styles of URL: it should be placed after hyperref. -\urlstyle{same} - - -\usepackage{sphinxmessages} -\setcounter{tocdepth}{1} - - - -\title{Kerberos User Guide} -\date{ } -\release{1.22\sphinxhyphen{}final} -\author{MIT} -\newcommand{\sphinxlogo}{\vbox{}} -\renewcommand{\releasename}{Release} -\makeindex -\begin{document} - -\ifdefined\shorthandoff - \ifnum\catcode`\=\string=\active\shorthandoff{=}\fi - \ifnum\catcode`\"=\active\shorthandoff{"}\fi -\fi - -\pagestyle{empty} -\sphinxmaketitle -\pagestyle{plain} -\sphinxtableofcontents -\pagestyle{normal} -\phantomsection\label{\detokenize{user/index::doc}} - - -\sphinxstepscope - - -\chapter{Password management} -\label{\detokenize{user/pwd_mgmt:password-management}}\label{\detokenize{user/pwd_mgmt::doc}} -\sphinxAtStartPar -Your password is the only way Kerberos has of verifying your identity. -If someone finds out your password, that person can masquerade as -you—send email that comes from you, read, edit, or delete your files, -or log into other hosts as you—and no one will be able to tell the -difference. For this reason, it is important that you choose a good -password, and keep it secret. If you need to give access to your -account to someone else, you can do so through Kerberos (see -{\hyperref[\detokenize{user/pwd_mgmt:grant-access}]{\sphinxcrossref{\DUrole{std,std-ref}{Granting access to your account}}}}). You should never tell your password to anyone, -including your system administrator, for any reason. You should -change your password frequently, particularly any time you think -someone may have found out what it is. - - -\section{Changing your password} -\label{\detokenize{user/pwd_mgmt:changing-your-password}} -\sphinxAtStartPar -To change your Kerberos password, use the {\hyperref[\detokenize{user/user_commands/kpasswd:kpasswd-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kpasswd}}}} command. -It will ask you for your old password (to prevent someone else from -walking up to your computer when you’re not there and changing your -password), and then prompt you for the new one twice. (The reason you -have to type it twice is to make sure you have typed it correctly.) -For example, user \sphinxcode{\sphinxupquote{david}} would do the following: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kpasswd} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{david}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}} \PYG{n}{Type} \PYG{n}{your} \PYG{n}{old} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Enter} \PYG{n}{new} \PYG{n}{password}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}} \PYG{n}{Type} \PYG{n}{your} \PYG{n}{new} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Enter} \PYG{n}{it} \PYG{n}{again}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}} \PYG{n}{Type} \PYG{n}{the} \PYG{n}{new} \PYG{n}{password} \PYG{n}{again}\PYG{o}{.} -\PYG{n}{Password} \PYG{n}{changed}\PYG{o}{.} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If \sphinxcode{\sphinxupquote{david}} typed the incorrect old password, he would get the -following message: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kpasswd} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{david}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}} \PYG{n}{Type} \PYG{n}{the} \PYG{n}{incorrect} \PYG{n}{old} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{kpasswd}\PYG{p}{:} \PYG{n}{Password} \PYG{n}{incorrect} \PYG{k}{while} \PYG{n}{getting} \PYG{n}{initial} \PYG{n}{ticket} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If you make a mistake and don’t type the new password the same way -twice, kpasswd will ask you to try again: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kpasswd} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{david}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}} \PYG{n}{Type} \PYG{n}{the} \PYG{n}{old} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Enter} \PYG{n}{new} \PYG{n}{password}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}} \PYG{n}{Type} \PYG{n}{the} \PYG{n}{new} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{Enter} \PYG{n}{it} \PYG{n}{again}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}} \PYG{n}{Type} \PYG{n}{a} \PYG{n}{different} \PYG{n}{new} \PYG{n}{password}\PYG{o}{.} -\PYG{n}{kpasswd}\PYG{p}{:} \PYG{n}{Password} \PYG{n}{mismatch} \PYG{k}{while} \PYG{n}{reading} \PYG{n}{password} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Once you change your password, it takes some time for the change to -propagate through the system. Depending on how your system is set up, -this might be anywhere from a few minutes to an hour or more. If you -need to get new Kerberos tickets shortly after changing your password, -try the new password. If the new password doesn’t work, try again -using the old one. - - -\section{Granting access to your account} -\label{\detokenize{user/pwd_mgmt:granting-access-to-your-account}}\label{\detokenize{user/pwd_mgmt:grant-access}} -\sphinxAtStartPar -If you need to give someone access to log into your account, you can -do so through Kerberos, without telling the person your password. -Simply create a file called {\hyperref[\detokenize{user/user_config/k5login:k5login-5}]{\sphinxcrossref{\DUrole{std,std-ref}{.k5login}}}} in your home directory. -This file should contain the Kerberos principal of each person to whom -you wish to give access. Each principal must be on a separate line. -Here is a sample .k5login file: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{david}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This file would allow the users \sphinxcode{\sphinxupquote{jennifer}} and \sphinxcode{\sphinxupquote{david}} to use your -user ID, provided that they had Kerberos tickets in their respective -realms. If you will be logging into other hosts across a network, you -will want to include your own Kerberos principal in your .k5login file -on each of these hosts. - -\sphinxAtStartPar -Using a .k5login file is much safer than giving out your password, -because: -\begin{itemize} -\item {} -\sphinxAtStartPar -You can take access away any time simply by removing the principal -from your .k5login file. - -\item {} -\sphinxAtStartPar -Although the user has full access to your account on one particular -host (or set of hosts if your .k5login file is shared, e.g., over -NFS), that user does not inherit your network privileges. - -\item {} -\sphinxAtStartPar -Kerberos keeps a log of who obtains tickets, so a system -administrator could find out, if necessary, who was capable of using -your user ID at a particular time. - -\end{itemize} - -\sphinxAtStartPar -One common application is to have a .k5login file in root’s home -directory, giving root access to that machine to the Kerberos -principals listed. This allows system administrators to allow users -to become root locally, or to log in remotely as root, without their -having to give out the root password, and without anyone having to -type the root password over the network. - - -\section{Password quality verification} -\label{\detokenize{user/pwd_mgmt:password-quality-verification}} -\sphinxAtStartPar -TODO - -\sphinxstepscope - - -\chapter{Ticket management} -\label{\detokenize{user/tkt_mgmt:ticket-management}}\label{\detokenize{user/tkt_mgmt::doc}} -\sphinxAtStartPar -On many systems, Kerberos is built into the login program, and you get -tickets automatically when you log in. Other programs, such as ssh, -can forward copies of your tickets to a remote host. Most of these -programs also automatically destroy your tickets when they exit. -However, MIT recommends that you explicitly destroy your Kerberos -tickets when you are through with them, just to be sure. One way to -help ensure that this happens is to add the {\hyperref[\detokenize{user/user_commands/kdestroy:kdestroy-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kdestroy}}}} command -to your .logout file. Additionally, if you are going to be away from -your machine and are concerned about an intruder using your -permissions, it is safest to either destroy all copies of your -tickets, or use a screensaver that locks the screen. - - -\section{Kerberos ticket properties} -\label{\detokenize{user/tkt_mgmt:kerberos-ticket-properties}} -\sphinxAtStartPar -There are various properties that Kerberos tickets can have: - -\sphinxAtStartPar -If a ticket is \sphinxstylestrong{forwardable}, then the KDC can issue a new ticket -(with a different network address, if necessary) based on the -forwardable ticket. This allows for authentication forwarding without -requiring a password to be typed in again. For example, if a user -with a forwardable TGT logs into a remote system, the KDC could issue -a new TGT for that user with the network address of the remote system, -allowing authentication on that host to work as though the user were -logged in locally. - -\sphinxAtStartPar -When the KDC creates a new ticket based on a forwardable ticket, it -sets the \sphinxstylestrong{forwarded} flag on that new ticket. Any tickets that are -created based on a ticket with the forwarded flag set will also have -their forwarded flags set. - -\sphinxAtStartPar -A \sphinxstylestrong{proxiable} ticket is similar to a forwardable ticket in that it -allows a service to take on the identity of the client. Unlike a -forwardable ticket, however, a proxiable ticket is only issued for -specific services. In other words, a ticket\sphinxhyphen{}granting ticket cannot be -issued based on a ticket that is proxiable but not forwardable. - -\sphinxAtStartPar -A \sphinxstylestrong{proxy} ticket is one that was issued based on a proxiable ticket. - -\sphinxAtStartPar -A \sphinxstylestrong{postdated} ticket is issued with the invalid flag set. After the -starting time listed on the ticket, it can be presented to the KDC to -obtain valid tickets. - -\sphinxAtStartPar -Ticket\sphinxhyphen{}granting tickets with the \sphinxstylestrong{postdateable} flag set can be used -to obtain postdated service tickets. - -\sphinxAtStartPar -\sphinxstylestrong{Renewable} tickets can be used to obtain new session keys without -the user entering their password again. A renewable ticket has two -expiration times. The first is the time at which this particular -ticket expires. The second is the latest possible expiration time for -any ticket issued based on this renewable ticket. - -\sphinxAtStartPar -A ticket with the \sphinxstylestrong{initial flag} set was issued based on the -authentication protocol, and not on a ticket\sphinxhyphen{}granting ticket. -Application servers that wish to ensure that the user’s key has been -recently presented for verification could specify that this flag must -be set to accept the ticket. - -\sphinxAtStartPar -An \sphinxstylestrong{invalid} ticket must be rejected by application servers. -Postdated tickets are usually issued with this flag set, and must be -validated by the KDC before they can be used. - -\sphinxAtStartPar -A \sphinxstylestrong{preauthenticated} ticket is one that was only issued after the -client requesting the ticket had authenticated itself to the KDC. - -\sphinxAtStartPar -The \sphinxstylestrong{hardware authentication} flag is set on a ticket which required -the use of hardware for authentication. The hardware is expected to -be possessed only by the client which requested the tickets. - -\sphinxAtStartPar -If a ticket has the \sphinxstylestrong{transit policy} checked flag set, then the KDC -that issued this ticket implements the transited\sphinxhyphen{}realm check policy -and checked the transited\sphinxhyphen{}realms list on the ticket. The -transited\sphinxhyphen{}realms list contains a list of all intermediate realms -between the realm of the KDC that issued the first ticket and that of -the one that issued the current ticket. If this flag is not set, then -the application server must check the transited realms itself or else -reject the ticket. - -\sphinxAtStartPar -The \sphinxstylestrong{okay as delegate} flag indicates that the server specified in -the ticket is suitable as a delegate as determined by the policy of -that realm. Some client applications may use this flag to decide -whether to forward tickets to a remote host, although many -applications do not honor it. - -\sphinxAtStartPar -An \sphinxstylestrong{anonymous} ticket is one in which the named principal is a -generic principal for that realm; it does not actually specify the -individual that will be using the ticket. This ticket is meant only -to securely distribute a session key. - - -\section{Obtaining tickets with kinit} -\label{\detokenize{user/tkt_mgmt:obtaining-tickets-with-kinit}}\label{\detokenize{user/tkt_mgmt:obtain-tkt}} -\sphinxAtStartPar -If your site has integrated Kerberos V5 with the login system, you -will get Kerberos tickets automatically when you log in. Otherwise, -you may need to explicitly obtain your Kerberos tickets, using the -{\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}} program. Similarly, if your Kerberos tickets expire, -use the kinit program to obtain new ones. - -\sphinxAtStartPar -To use the kinit program, simply type \sphinxcode{\sphinxupquote{kinit}} and then type your -password at the prompt. For example, Jennifer (whose username is -\sphinxcode{\sphinxupquote{jennifer}}) works for Bleep, Inc. (a fictitious company with the -domain name mit.edu and the Kerberos realm ATHENA.MIT.EDU). She would -type: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kinit} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{p}{[}\PYG{n}{Type} \PYG{n}{jennifer}\PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{s password here.]} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If you type your password incorrectly, kinit will give you the -following error message: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kinit} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{p}{[}\PYG{n}{Type} \PYG{n}{the} \PYG{n}{wrong} \PYG{n}{password} \PYG{n}{here}\PYG{o}{.}\PYG{p}{]} -\PYG{n}{kinit}\PYG{p}{:} \PYG{n}{Password} \PYG{n}{incorrect} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -and you won’t get Kerberos tickets. - -\sphinxAtStartPar -By default, kinit assumes you want tickets for your own username in -your default realm. Suppose Jennifer’s friend David is visiting, and -he wants to borrow a window to check his mail. David needs to get -tickets for himself in his own realm, EXAMPLE.COM. He would type: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kinit} \PYG{n}{david}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{david}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{p}{[}\PYG{n}{Type} \PYG{n}{david}\PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{s password here.]} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -David would then have tickets which he could use to log onto his own -machine. Note that he typed his password locally on Jennifer’s -machine, but it never went over the network. Kerberos on the local -host performed the authentication to the KDC in the other realm. - -\sphinxAtStartPar -If you want to be able to forward your tickets to another host, you -need to request forwardable tickets. You do this by specifying the -\sphinxstylestrong{\sphinxhyphen{}f} option: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kinit} \PYG{o}{\PYGZhy{}}\PYG{n}{f} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{p}{[}\PYG{n}{Type} \PYG{n}{your} \PYG{n}{password} \PYG{n}{here}\PYG{o}{.}\PYG{p}{]} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Note that kinit does not tell you that it obtained forwardable -tickets; you can verify this using the {\hyperref[\detokenize{user/user_commands/klist:klist-1}]{\sphinxcrossref{\DUrole{std,std-ref}{klist}}}} command (see -{\hyperref[\detokenize{user/tkt_mgmt:view-tkt}]{\sphinxcrossref{\DUrole{std,std-ref}{Viewing tickets with klist}}}}). - -\sphinxAtStartPar -Normally, your tickets are good for your system’s default ticket -lifetime, which is ten hours on many systems. You can specify a -different ticket lifetime with the \sphinxstylestrong{\sphinxhyphen{}l} option. Add the letter -\sphinxstylestrong{s} to the value for seconds, \sphinxstylestrong{m} for minutes, \sphinxstylestrong{h} for hours, or -\sphinxstylestrong{d} for days. For example, to obtain forwardable tickets for -\sphinxcode{\sphinxupquote{david@EXAMPLE.COM}} that would be good for three hours, you would -type: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kinit} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{\PYGZhy{}}\PYG{n}{l} \PYG{l+m+mi}{3}\PYG{n}{h} \PYG{n}{david}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{Password} \PYG{k}{for} \PYG{n}{david}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{p}{[}\PYG{n}{Type} \PYG{n}{david}\PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{s password here.]} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -You cannot mix units; specifying a lifetime of 3h30m would -result in an error. Note also that most systems specify a -maximum ticket lifetime. If you request a longer ticket -lifetime, it will be automatically truncated to the maximum -lifetime. -\end{sphinxadmonition} - - -\section{Viewing tickets with klist} -\label{\detokenize{user/tkt_mgmt:viewing-tickets-with-klist}}\label{\detokenize{user/tkt_mgmt:view-tkt}} -\sphinxAtStartPar -The {\hyperref[\detokenize{user/user_commands/klist:klist-1}]{\sphinxcrossref{\DUrole{std,std-ref}{klist}}}} command shows your tickets. When you first obtain -tickets, you will have only the ticket\sphinxhyphen{}granting ticket. The listing -would look like this: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{klist} -\PYG{n}{Ticket} \PYG{n}{cache}\PYG{p}{:} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{krb5cc\PYGZus{}ttypa} -\PYG{n}{Default} \PYG{n}{principal}\PYG{p}{:} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - -\PYG{n}{Valid} \PYG{n}{starting} \PYG{n}{Expires} \PYG{n}{Service} \PYG{n}{principal} -\PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{19}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{21} \PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{08}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{05}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The ticket cache is the location of your ticket file. In the above -example, this file is named \sphinxcode{\sphinxupquote{/tmp/krb5cc\_ttypa}}. The default -principal is your Kerberos principal. - -\sphinxAtStartPar -The “valid starting” and “expires” fields describe the period of time -during which the ticket is valid. The “service principal” describes -each ticket. The ticket\sphinxhyphen{}granting ticket has a first component -\sphinxcode{\sphinxupquote{krbtgt}}, and a second component which is the realm name. - -\sphinxAtStartPar -Now, if \sphinxcode{\sphinxupquote{jennifer}} connected to the machine \sphinxcode{\sphinxupquote{daffodil.mit.edu}}, -and then typed “klist” again, she would have gotten the following -result: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{klist} -\PYG{n}{Ticket} \PYG{n}{cache}\PYG{p}{:} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{krb5cc\PYGZus{}ttypa} -\PYG{n}{Default} \PYG{n}{principal}\PYG{p}{:} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - -\PYG{n}{Valid} \PYG{n}{starting} \PYG{n}{Expires} \PYG{n}{Service} \PYG{n}{principal} -\PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{19}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{21} \PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{08}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{05}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{20}\PYG{p}{:}\PYG{l+m+mi}{22}\PYG{p}{:}\PYG{l+m+mi}{30} \PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{08}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{05}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Here’s what happened: when \sphinxcode{\sphinxupquote{jennifer}} used ssh to connect to the -host \sphinxcode{\sphinxupquote{daffodil.mit.edu}}, the ssh program presented her -ticket\sphinxhyphen{}granting ticket to the KDC and requested a host ticket for the -host \sphinxcode{\sphinxupquote{daffodil.mit.edu}}. The KDC sent the host ticket, which ssh -then presented to the host \sphinxcode{\sphinxupquote{daffodil.mit.edu}}, and she was allowed -to log in without typing her password. - -\sphinxAtStartPar -Suppose your Kerberos tickets allow you to log into a host in another -domain, such as \sphinxcode{\sphinxupquote{trillium.example.com}}, which is also in another -Kerberos realm, \sphinxcode{\sphinxupquote{EXAMPLE.COM}}. If you ssh to this host, you will -receive a ticket\sphinxhyphen{}granting ticket for the realm \sphinxcode{\sphinxupquote{EXAMPLE.COM}}, plus -the new host ticket for \sphinxcode{\sphinxupquote{trillium.example.com}}. klist will now -show: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{klist} -\PYG{n}{Ticket} \PYG{n}{cache}\PYG{p}{:} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{krb5cc\PYGZus{}ttypa} -\PYG{n}{Default} \PYG{n}{principal}\PYG{p}{:} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - -\PYG{n}{Valid} \PYG{n}{starting} \PYG{n}{Expires} \PYG{n}{Service} \PYG{n}{principal} -\PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{19}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{21} \PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{08}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{05}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{20}\PYG{p}{:}\PYG{l+m+mi}{22}\PYG{p}{:}\PYG{l+m+mi}{30} \PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{08}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{05}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{20}\PYG{p}{:}\PYG{l+m+mi}{24}\PYG{p}{:}\PYG{l+m+mi}{18} \PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{08}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{05}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} -\PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{20}\PYG{p}{:}\PYG{l+m+mi}{24}\PYG{p}{:}\PYG{l+m+mi}{18} \PYG{l+m+mi}{06}\PYG{o}{/}\PYG{l+m+mi}{08}\PYG{o}{/}\PYG{l+m+mi}{04} \PYG{l+m+mi}{05}\PYG{p}{:}\PYG{l+m+mi}{49}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -Depending on your host’s and realm’s configuration, you may also see a -ticket with the service principal \sphinxcode{\sphinxupquote{host/trillium.example.com@}}. If -so, this means that your host did not know what realm -trillium.example.com is in, so it asked the \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} KDC for -a referral. The next time you connect to \sphinxcode{\sphinxupquote{trillium.example.com}}, -the odd\sphinxhyphen{}looking entry will be used to avoid needing to ask for a -referral again. - -\sphinxAtStartPar -You can use the \sphinxstylestrong{\sphinxhyphen{}f} option to view the flags that apply to your -tickets. The flags are: - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -F -& -\sphinxAtStartPar -Forwardable -\\ -\sphinxhline -\sphinxAtStartPar -f -& -\sphinxAtStartPar -forwarded -\\ -\sphinxhline -\sphinxAtStartPar -P -& -\sphinxAtStartPar -Proxiable -\\ -\sphinxhline -\sphinxAtStartPar -p -& -\sphinxAtStartPar -proxy -\\ -\sphinxhline -\sphinxAtStartPar -D -& -\sphinxAtStartPar -postDateable -\\ -\sphinxhline -\sphinxAtStartPar -d -& -\sphinxAtStartPar -postdated -\\ -\sphinxhline -\sphinxAtStartPar -R -& -\sphinxAtStartPar -Renewable -\\ -\sphinxhline -\sphinxAtStartPar -I -& -\sphinxAtStartPar -Initial -\\ -\sphinxhline -\sphinxAtStartPar -i -& -\sphinxAtStartPar -invalid -\\ -\sphinxhline -\sphinxAtStartPar -H -& -\sphinxAtStartPar -Hardware authenticated -\\ -\sphinxhline -\sphinxAtStartPar -A -& -\sphinxAtStartPar -preAuthenticated -\\ -\sphinxhline -\sphinxAtStartPar -T -& -\sphinxAtStartPar -Transit policy checked -\\ -\sphinxhline -\sphinxAtStartPar -O -& -\sphinxAtStartPar -Okay as delegate -\\ -\sphinxhline -\sphinxAtStartPar -a -& -\sphinxAtStartPar -anonymous -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\sphinxAtStartPar -Here is a sample listing. In this example, the user \sphinxstyleemphasis{jennifer} -obtained her initial tickets (\sphinxstylestrong{I}), which are forwardable (\sphinxstylestrong{F}) -and postdated (\sphinxstylestrong{d}) but not yet validated (\sphinxstylestrong{i}): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{klist} \PYG{o}{\PYGZhy{}}\PYG{n}{f} -\PYG{n}{Ticket} \PYG{n}{cache}\PYG{p}{:} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{krb5cc\PYGZus{}320} -\PYG{n}{Default} \PYG{n}{principal}\PYG{p}{:} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - -\PYG{n}{Valid} \PYG{n}{starting} \PYG{n}{Expires} \PYG{n}{Service} \PYG{n}{principal} -\PYG{l+m+mi}{31}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{05} \PYG{l+m+mi}{19}\PYG{p}{:}\PYG{l+m+mi}{06}\PYG{p}{:}\PYG{l+m+mi}{25} \PYG{l+m+mi}{31}\PYG{o}{/}\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{05} \PYG{l+m+mi}{19}\PYG{p}{:}\PYG{l+m+mi}{16}\PYG{p}{:}\PYG{l+m+mi}{25} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} - \PYG{n}{Flags}\PYG{p}{:} \PYG{n}{FdiI} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -In the following example, the user \sphinxstyleemphasis{david}’s tickets were forwarded -(\sphinxstylestrong{f}) to this host from another host. The tickets are reforwardable -(\sphinxstylestrong{F}): - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{klist} \PYG{o}{\PYGZhy{}}\PYG{n}{f} -\PYG{n}{Ticket} \PYG{n}{cache}\PYG{p}{:} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{krb5cc\PYGZus{}p11795} -\PYG{n}{Default} \PYG{n}{principal}\PYG{p}{:} \PYG{n}{david}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} - -\PYG{n}{Valid} \PYG{n}{starting} \PYG{n}{Expires} \PYG{n}{Service} \PYG{n}{principal} -\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{31}\PYG{o}{/}\PYG{l+m+mi}{05} \PYG{l+m+mi}{11}\PYG{p}{:}\PYG{l+m+mi}{52}\PYG{p}{:}\PYG{l+m+mi}{29} \PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{31}\PYG{o}{/}\PYG{l+m+mi}{05} \PYG{l+m+mi}{21}\PYG{p}{:}\PYG{l+m+mi}{11}\PYG{p}{:}\PYG{l+m+mi}{23} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} - \PYG{n}{Flags}\PYG{p}{:} \PYG{n}{Ff} -\PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{31}\PYG{o}{/}\PYG{l+m+mi}{05} \PYG{l+m+mi}{12}\PYG{p}{:}\PYG{l+m+mi}{03}\PYG{p}{:}\PYG{l+m+mi}{48} \PYG{l+m+mi}{07}\PYG{o}{/}\PYG{l+m+mi}{31}\PYG{o}{/}\PYG{l+m+mi}{05} \PYG{l+m+mi}{21}\PYG{p}{:}\PYG{l+m+mi}{11}\PYG{p}{:}\PYG{l+m+mi}{23} \PYG{n}{host}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} - \PYG{n}{Flags}\PYG{p}{:} \PYG{n}{Ff} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - - -\section{Destroying tickets with kdestroy} -\label{\detokenize{user/tkt_mgmt:destroying-tickets-with-kdestroy}} -\sphinxAtStartPar -Your Kerberos tickets are proof that you are indeed yourself, and -tickets could be stolen if someone gains access to a computer where -they are stored. If this happens, the person who has them can -masquerade as you until they expire. For this reason, you should -destroy your Kerberos tickets when you are away from your computer. - -\sphinxAtStartPar -Destroying your tickets is easy. Simply type kdestroy: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdestroy} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -If {\hyperref[\detokenize{user/user_commands/kdestroy:kdestroy-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kdestroy}}}} fails to destroy your tickets, it will beep and -give an error message. For example, if kdestroy can’t find any -tickets to destroy, it will give the following message: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdestroy} -\PYG{n}{kdestroy}\PYG{p}{:} \PYG{n}{No} \PYG{n}{credentials} \PYG{n}{cache} \PYG{n}{file} \PYG{n}{found} \PYG{k}{while} \PYG{n}{destroying} \PYG{n}{cache} -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} -\end{sphinxVerbatim} - -\sphinxstepscope - - -\chapter{User config files} -\label{\detokenize{user/user_config/index:user-config-files}}\label{\detokenize{user/user_config/index::doc}} -\sphinxAtStartPar -The following files in your home directory can be used to control the -behavior of Kerberos as it applies to your account (unless they have -been disabled by your host’s configuration): - -\sphinxstepscope - - -\section{kerberos} -\label{\detokenize{user/user_config/kerberos:kerberos}}\label{\detokenize{user/user_config/kerberos:kerberos-7}}\label{\detokenize{user/user_config/kerberos::doc}} - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_config/kerberos:description}} -\sphinxAtStartPar -The Kerberos system authenticates individual users in a network -environment. After authenticating yourself to Kerberos, you can use -Kerberos\sphinxhyphen{}enabled programs without having to present passwords or -certificates to those programs. - -\sphinxAtStartPar -If you receive the following response from {\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}}: - -\sphinxAtStartPar -kinit: Client not found in Kerberos database while getting initial -credentials - -\sphinxAtStartPar -you haven’t been registered as a Kerberos user. See your system -administrator. - -\sphinxAtStartPar -A Kerberos name usually contains three parts. The first is the -\sphinxstylestrong{primary}, which is usually a user’s or service’s name. The second -is the \sphinxstylestrong{instance}, which in the case of a user is usually null. -Some users may have privileged instances, however, such as \sphinxcode{\sphinxupquote{root}} or -\sphinxcode{\sphinxupquote{admin}}. In the case of a service, the instance is the fully -qualified name of the machine on which it runs; i.e. there can be an -ssh service running on the machine ABC (\sphinxhref{mailto:ssh/ABC@REALM}{ssh/ABC@REALM}), which is -different from the ssh service running on the machine XYZ -(\sphinxhref{mailto:ssh/XYZ@REALM}{ssh/XYZ@REALM}). The third part of a Kerberos name is the \sphinxstylestrong{realm}. -The realm corresponds to the Kerberos service providing authentication -for the principal. Realms are conventionally all\sphinxhyphen{}uppercase, and often -match the end of hostnames in the realm (for instance, host01.example.com -might be in realm EXAMPLE.COM). - -\sphinxAtStartPar -When writing a Kerberos name, the principal name is separated from the -instance (if not null) by a slash, and the realm (if not the local -realm) follows, preceded by an “@” sign. The following are examples -of valid Kerberos names: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{david} -\PYG{n}{jennifer}\PYG{o}{/}\PYG{n}{admin} -\PYG{n}{joeuser}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{cbrown}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@FUBAR}\PYG{o}{.}\PYG{n}{ORG} -\end{sphinxVerbatim} - -\sphinxAtStartPar -When you authenticate yourself with Kerberos you get an initial -Kerberos \sphinxstylestrong{ticket}. (A Kerberos ticket is an encrypted protocol -message that provides authentication.) Kerberos uses this ticket for -network utilities such as ssh. The ticket transactions are done -transparently, so you don’t have to worry about their management. - -\sphinxAtStartPar -Note, however, that tickets expire. Administrators may configure more -privileged tickets, such as those with service or instance of \sphinxcode{\sphinxupquote{root}} -or \sphinxcode{\sphinxupquote{admin}}, to expire in a few minutes, while tickets that carry -more ordinary privileges may be good for several hours or a day. If -your login session extends beyond the time limit, you will have to -re\sphinxhyphen{}authenticate yourself to Kerberos to get new tickets using the -{\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}} command. - -\sphinxAtStartPar -Some tickets are \sphinxstylestrong{renewable} beyond their initial lifetime. This -means that \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}R}} can extend their lifetime without requiring -you to re\sphinxhyphen{}authenticate. - -\sphinxAtStartPar -If you wish to delete your local tickets, use the {\hyperref[\detokenize{user/user_commands/kdestroy:kdestroy-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kdestroy}}}} -command. - -\sphinxAtStartPar -Kerberos tickets can be forwarded. In order to forward tickets, you -must request \sphinxstylestrong{forwardable} tickets when you kinit. Once you have -forwardable tickets, most Kerberos programs have a command line option -to forward them to the remote host. This can be useful for, e.g., -running kinit on your local machine and then sshing into another to do -work. Note that this should not be done on untrusted machines since -they will then have your tickets. - - -\subsection{ENVIRONMENT VARIABLES} -\label{\detokenize{user/user_config/kerberos:environment-variables}} -\sphinxAtStartPar -Several environment variables affect the operation of Kerberos\sphinxhyphen{}enabled -programs. These include: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{KRB5CCNAME}} -\sphinxAtStartPar -Default name for the credentials cache file, in the form -\sphinxstyleemphasis{TYPE}:\sphinxstyleemphasis{residual}. The type of the default cache may determine -the availability of a cache collection. \sphinxcode{\sphinxupquote{FILE}} is not a -collection type; \sphinxcode{\sphinxupquote{KEYRING}}, \sphinxcode{\sphinxupquote{DIR}}, and \sphinxcode{\sphinxupquote{KCM}} are. - -\sphinxAtStartPar -If not set, the value of \sphinxstylestrong{default\_ccache\_name} from -configuration files (see \sphinxstylestrong{KRB5\_CONFIG}) will be used. If that -is also not set, the default \sphinxstyleemphasis{type} is \sphinxcode{\sphinxupquote{FILE}}, and the -\sphinxstyleemphasis{residual} is the path /tmp/krb5cc\_*uid*, where \sphinxstyleemphasis{uid} is the -decimal user ID of the user. - -\sphinxlineitem{\sphinxstylestrong{KRB5\_KTNAME}} -\sphinxAtStartPar -Specifies the location of the default keytab file, in the form -\sphinxstyleemphasis{TYPE}:\sphinxstyleemphasis{residual}. If no \sphinxstyleemphasis{type} is present, the \sphinxstylestrong{FILE} type is -assumed and \sphinxstyleemphasis{residual} is the pathname of the keytab file. If -unset, \DUrole{xref,std,std-ref}{DEFKTNAME} will be used. - -\sphinxlineitem{\sphinxstylestrong{KRB5\_CONFIG}} -\sphinxAtStartPar -Specifies the location of the Kerberos configuration file. The -default is \DUrole{xref,std,std-ref}{SYSCONFDIR}\sphinxcode{\sphinxupquote{/krb5.conf}}. Multiple filenames can -be specified, separated by a colon; all files which are present -will be read. - -\sphinxlineitem{\sphinxstylestrong{KRB5\_KDC\_PROFILE}} -\sphinxAtStartPar -Specifies the location of the KDC configuration file, which -contains additional configuration directives for the Key -Distribution Center daemon and associated programs. The default -is \DUrole{xref,std,std-ref}{LOCALSTATEDIR}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kdc.conf}}. - -\sphinxlineitem{\sphinxstylestrong{KRB5RCACHENAME}} -\sphinxAtStartPar -(New in release 1.18) Specifies the location of the default replay -cache, in the form \sphinxstyleemphasis{type}:\sphinxstyleemphasis{residual}. The \sphinxcode{\sphinxupquote{file2}} type with a -pathname residual specifies a replay cache file in the version\sphinxhyphen{}2 -format in the specified location. The \sphinxcode{\sphinxupquote{none}} type (residual is -ignored) disables the replay cache. The \sphinxcode{\sphinxupquote{dfl}} type (residual is -ignored) indicates the default, which uses a file2 replay cache in -a temporary directory. The default is \sphinxcode{\sphinxupquote{dfl:}}. - -\sphinxlineitem{\sphinxstylestrong{KRB5RCACHETYPE}} -\sphinxAtStartPar -Specifies the type of the default replay cache, if -\sphinxstylestrong{KRB5RCACHENAME} is unspecified. No residual can be specified, -so \sphinxcode{\sphinxupquote{none}} and \sphinxcode{\sphinxupquote{dfl}} are the only useful types. - -\sphinxlineitem{\sphinxstylestrong{KRB5RCACHEDIR}} -\sphinxAtStartPar -Specifies the directory used by the \sphinxcode{\sphinxupquote{dfl}} replay cache type. -The default is the value of the \sphinxstylestrong{TMPDIR} environment variable, -or \sphinxcode{\sphinxupquote{/var/tmp}} if \sphinxstylestrong{TMPDIR} is not set. - -\sphinxlineitem{\sphinxstylestrong{KRB5\_TRACE}} -\sphinxAtStartPar -Specifies a filename to write trace log output to. Trace logs can -help illuminate decisions made internally by the Kerberos -libraries. For example, \sphinxcode{\sphinxupquote{env KRB5\_TRACE=/dev/stderr kinit}} -would send tracing information for {\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}} to -\sphinxcode{\sphinxupquote{/dev/stderr}}. The default is not to write trace log output -anywhere. - -\sphinxlineitem{\sphinxstylestrong{KRB5\_CLIENT\_KTNAME}} -\sphinxAtStartPar -Default client keytab file name. If unset, \DUrole{xref,std,std-ref}{DEFCKTNAME} will be -used). - -\sphinxlineitem{\sphinxstylestrong{KPROP\_PORT}} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{kprop(8)} port to use. Defaults to 754. - -\sphinxlineitem{\sphinxstylestrong{GSS\_MECH\_CONFIG}} -\sphinxAtStartPar -Specifies a filename containing GSSAPI mechanism module -configuration. The default is to read \DUrole{xref,std,std-ref}{SYSCONFDIR}\sphinxcode{\sphinxupquote{/gss/mech}} -and files with a \sphinxcode{\sphinxupquote{.conf}} suffix within the directory -\DUrole{xref,std,std-ref}{SYSCONFDIR}\sphinxcode{\sphinxupquote{/gss/mech.d}}. - -\end{description} - -\sphinxAtStartPar -Most environment variables are disabled for certain programs, such as -login system programs and setuid programs, which are designed to be -secure when run within an untrusted process environment. - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_config/kerberos:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_commands/kdestroy:kdestroy-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kdestroy}}}}, {\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}}, {\hyperref[\detokenize{user/user_commands/klist:klist-1}]{\sphinxcrossref{\DUrole{std,std-ref}{klist}}}}, -{\hyperref[\detokenize{user/user_commands/kswitch:kswitch-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kswitch}}}}, {\hyperref[\detokenize{user/user_commands/kpasswd:kpasswd-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kpasswd}}}}, {\hyperref[\detokenize{user/user_commands/ksu:ksu-1}]{\sphinxcrossref{\DUrole{std,std-ref}{ksu}}}}, -\DUrole{xref,std,std-ref}{krb5.conf(5)}, \DUrole{xref,std,std-ref}{kdc.conf(5)}, \DUrole{xref,std,std-ref}{kadmin(1)}, -\DUrole{xref,std,std-ref}{kadmind(8)}, \DUrole{xref,std,std-ref}{kdb5\_util(8)}, \DUrole{xref,std,std-ref}{krb5kdc(8)} - - -\subsection{BUGS} -\label{\detokenize{user/user_config/kerberos:bugs}} - -\subsection{AUTHORS} -\label{\detokenize{user/user_config/kerberos:authors}} -\begin{DUlineblock}{0em} -\item[] Steve Miller, MIT Project Athena/Digital Equipment Corporation -\item[] Clifford Neuman, MIT Project Athena -\item[] Greg Hudson, MIT Kerberos Consortium -\item[] Robbie Harwood, Red Hat, Inc. -\end{DUlineblock} - - -\subsection{HISTORY} -\label{\detokenize{user/user_config/kerberos:history}} -\sphinxAtStartPar -The MIT Kerberos 5 implementation was developed at MIT, with -contributions from many outside parties. It is currently maintained -by the MIT Kerberos Consortium. - - -\subsection{RESTRICTIONS} -\label{\detokenize{user/user_config/kerberos:restrictions}} -\sphinxAtStartPar -Copyright 1985, 1986, 1989\sphinxhyphen{}1996, 2002, 2011, 2018 Masachusetts -Institute of Technology - -\sphinxstepscope - - -\section{.k5login} -\label{\detokenize{user/user_config/k5login:k5login}}\label{\detokenize{user/user_config/k5login:k5login-5}}\label{\detokenize{user/user_config/k5login::doc}} - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_config/k5login:description}} -\sphinxAtStartPar -The .k5login file, which resides in a user’s home directory, contains -a list of the Kerberos principals. Anyone with valid tickets for a -principal in the file is allowed host access with the UID of the user -in whose home directory the file resides. One common use is to place -a .k5login file in root’s home directory, thereby granting system -administrators remote root access to the host via Kerberos. - - -\subsection{EXAMPLES} -\label{\detokenize{user/user_config/k5login:examples}} -\sphinxAtStartPar -Suppose the user \sphinxcode{\sphinxupquote{alice}} had a .k5login file in her home directory -containing just the following line: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{bob}\PYG{n+nd}{@FOOBAR}\PYG{o}{.}\PYG{n}{ORG} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This would allow \sphinxcode{\sphinxupquote{bob}} to use Kerberos network applications, such as -ssh(1), to access \sphinxcode{\sphinxupquote{alice}}’s account, using \sphinxcode{\sphinxupquote{bob}}’s Kerberos -tickets. In a default configuration (with \sphinxstylestrong{k5login\_authoritative} set -to true in \DUrole{xref,std,std-ref}{krb5.conf(5)}), this .k5login file would not let -\sphinxcode{\sphinxupquote{alice}} use those network applications to access her account, since -she is not listed! With no .k5login file, or with \sphinxstylestrong{k5login\_authoritative} -set to false, a default rule would permit the principal \sphinxcode{\sphinxupquote{alice}} in the -machine’s default realm to access the \sphinxcode{\sphinxupquote{alice}} account. - -\sphinxAtStartPar -Let us further suppose that \sphinxcode{\sphinxupquote{alice}} is a system administrator. -Alice and the other system administrators would have their principals -in root’s .k5login file on each host: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} - -\PYG{n}{joeadmin}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} -\end{sphinxVerbatim} - -\sphinxAtStartPar -This would allow either system administrator to log in to these hosts -using their Kerberos tickets instead of having to type the root -password. Note that because \sphinxcode{\sphinxupquote{bob}} retains the Kerberos tickets for -his own principal, \sphinxcode{\sphinxupquote{bob@FOOBAR.ORG}}, he would not have any of the -privileges that require \sphinxcode{\sphinxupquote{alice}}’s tickets, such as root access to -any of the site’s hosts, or the ability to change \sphinxcode{\sphinxupquote{alice}}’s -password. - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_config/k5login:see-also}} -\sphinxAtStartPar -kerberos(1) - -\sphinxstepscope - - -\section{.k5identity} -\label{\detokenize{user/user_config/k5identity:k5identity}}\label{\detokenize{user/user_config/k5identity:k5identity-5}}\label{\detokenize{user/user_config/k5identity::doc}} - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_config/k5identity:description}} -\sphinxAtStartPar -The .k5identity file, which resides in a user’s home directory, -contains a list of rules for selecting a client principals based on -the server being accessed. These rules are used to choose a -credential cache within the cache collection when possible. - -\sphinxAtStartPar -Blank lines and lines beginning with \sphinxcode{\sphinxupquote{\#}} are ignored. Each line has -the form: -\begin{quote} - -\sphinxAtStartPar -\sphinxstyleemphasis{principal} \sphinxstyleemphasis{field}=\sphinxstyleemphasis{value} … -\end{quote} - -\sphinxAtStartPar -If the server principal meets all of the field constraints, then -principal is chosen as the client principal. The following fields are -recognized: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{realm}} -\sphinxAtStartPar -If the realm of the server principal is known, it is matched -against \sphinxstyleemphasis{value}, which may be a pattern using shell wildcards. -For host\sphinxhyphen{}based server principals, the realm will generally only be -known if there is a \DUrole{xref,std,std-ref}{domain\_realm} section in -\DUrole{xref,std,std-ref}{krb5.conf(5)} with a mapping for the hostname. - -\sphinxlineitem{\sphinxstylestrong{service}} -\sphinxAtStartPar -If the server principal is a host\sphinxhyphen{}based principal, its service -component is matched against \sphinxstyleemphasis{value}, which may be a pattern using -shell wildcards. - -\sphinxlineitem{\sphinxstylestrong{host}} -\sphinxAtStartPar -If the server principal is a host\sphinxhyphen{}based principal, its hostname -component is converted to lower case and matched against \sphinxstyleemphasis{value}, -which may be a pattern using shell wildcards. - -\sphinxAtStartPar -If the server principal matches the constraints of multiple lines -in the .k5identity file, the principal from the first matching -line is used. If no line matches, credentials will be selected -some other way, such as the realm heuristic or the current primary -cache. - -\end{description} - - -\subsection{EXAMPLE} -\label{\detokenize{user/user_config/k5identity:example}} -\sphinxAtStartPar -The following example .k5identity file selects the client principal -\sphinxcode{\sphinxupquote{alice@KRBTEST.COM}} if the server principal is within that realm, -the principal \sphinxcode{\sphinxupquote{alice/root@EXAMPLE.COM}} if the server host is within -a servers subdomain, and the principal \sphinxcode{\sphinxupquote{alice/mail@EXAMPLE.COM}} when -accessing the IMAP service on \sphinxcode{\sphinxupquote{mail.example.com}}: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{alice}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{realm}\PYG{o}{=}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM} -\PYG{n}{alice}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{host}\PYG{o}{=}\PYG{o}{*}\PYG{o}{.}\PYG{n}{servers}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} -\PYG{n}{alice}\PYG{o}{/}\PYG{n}{mail}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{host}\PYG{o}{=}\PYG{n}{mail}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} \PYG{n}{service}\PYG{o}{=}\PYG{n}{imap} -\end{sphinxVerbatim} - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_config/k5identity:see-also}} -\sphinxAtStartPar -kerberos(1), \DUrole{xref,std,std-ref}{krb5.conf(5)} - -\sphinxstepscope - - -\chapter{User commands} -\label{\detokenize{user/user_commands/index:user-commands}}\label{\detokenize{user/user_commands/index:id1}}\label{\detokenize{user/user_commands/index::doc}} -\sphinxstepscope - - -\section{kdestroy} -\label{\detokenize{user/user_commands/kdestroy:kdestroy}}\label{\detokenize{user/user_commands/kdestroy:kdestroy-1}}\label{\detokenize{user/user_commands/kdestroy::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/kdestroy:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kdestroy} -{[}\sphinxstylestrong{\sphinxhyphen{}A}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}q}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{cache\_name}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{princ\_name}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/kdestroy:description}} -\sphinxAtStartPar -The kdestroy utility destroys the user’s active Kerberos authorization -tickets by overwriting and deleting the credentials cache that -contains them. If the credentials cache is not specified, the default -credentials cache is destroyed. - - -\subsection{OPTIONS} -\label{\detokenize{user/user_commands/kdestroy:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}A}} -\sphinxAtStartPar -Destroys all caches in the collection, if a cache collection is -available. May be used with the \sphinxstylestrong{\sphinxhyphen{}c} option to specify the -collection to be destroyed. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}q}} -\sphinxAtStartPar -Run quietly. Normally kdestroy beeps if it fails to destroy the -user’s tickets. The \sphinxstylestrong{\sphinxhyphen{}q} flag suppresses this behavior. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{cache\_name}} -\sphinxAtStartPar -Use \sphinxstyleemphasis{cache\_name} as the credentials (ticket) cache name and -location; if this option is not used, the default cache name and -location are used. - -\sphinxAtStartPar -The default credentials cache may vary between systems. If the -\sphinxstylestrong{KRB5CCNAME} environment variable is set, its value is used to -name the default ticket cache. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{princ\_name}} -\sphinxAtStartPar -If a cache collection is available, destroy the cache for -\sphinxstyleemphasis{princ\_name} instead of the primary cache. May be used with the -\sphinxstylestrong{\sphinxhyphen{}c} option to specify the collection to be searched. - -\end{description} - - -\subsection{NOTE} -\label{\detokenize{user/user_commands/kdestroy:note}} -\sphinxAtStartPar -Most installations recommend that you place the kdestroy command in -your .logout file, so that your tickets are destroyed automatically -when you log out. - - -\subsection{ENVIRONMENT} -\label{\detokenize{user/user_commands/kdestroy:environment}} -\sphinxAtStartPar -See {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} for a description of Kerberos environment -variables. - - -\subsection{FILES} -\label{\detokenize{user/user_commands/kdestroy:files}}\begin{description} -\sphinxlineitem{\DUrole{xref,std,std-ref}{DEFCCNAME}} -\sphinxAtStartPar -Default location of Kerberos 5 credentials cache - -\end{description} - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/kdestroy:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}}, {\hyperref[\detokenize{user/user_commands/klist:klist-1}]{\sphinxcrossref{\DUrole{std,std-ref}{klist}}}}, {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} - -\sphinxstepscope - - -\section{kinit} -\label{\detokenize{user/user_commands/kinit:kinit}}\label{\detokenize{user/user_commands/kinit:kinit-1}}\label{\detokenize{user/user_commands/kinit::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/kinit:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kinit} -{[}\sphinxstylestrong{\sphinxhyphen{}V}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}l} \sphinxstyleemphasis{lifetime}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{start\_time}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{renewable\_life}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}p} | \sphinxhyphen{}\sphinxstylestrong{P}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}f} | \sphinxhyphen{}\sphinxstylestrong{F}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}a}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}A}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}C}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}E}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}v}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}R}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}k} {[}\sphinxstylestrong{\sphinxhyphen{}i} | \sphinxhyphen{}\sphinxstylestrong{t} \sphinxstyleemphasis{keytab\_file}{]}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{cache\_name}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}n}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}S} \sphinxstyleemphasis{service\_name}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}I} \sphinxstyleemphasis{input\_ccache}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}T} \sphinxstyleemphasis{armor\_ccache}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}X} \sphinxstyleemphasis{attribute}{[}=\sphinxstyleemphasis{value}{]}{]} -{[}\sphinxstylestrong{\textendash{}request\sphinxhyphen{}pac} | \sphinxstylestrong{\textendash{}no\sphinxhyphen{}request\sphinxhyphen{}pac}{]} -{[}\sphinxstyleemphasis{principal}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/kinit:description}} -\sphinxAtStartPar -kinit obtains and caches an initial ticket\sphinxhyphen{}granting ticket for -\sphinxstyleemphasis{principal}. If \sphinxstyleemphasis{principal} is absent, kinit chooses an appropriate -principal name based on existing credential cache contents or the -local username of the user invoking kinit. Some options modify the -choice of principal name. - - -\subsection{OPTIONS} -\label{\detokenize{user/user_commands/kinit:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}V}} -\sphinxAtStartPar -display verbose output. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}l} \sphinxstyleemphasis{lifetime}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Requests a ticket with the lifetime -\sphinxstyleemphasis{lifetime}. - -\sphinxAtStartPar -For example, \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}l 5:30}} or \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}l 5h30m}}. - -\sphinxAtStartPar -If the \sphinxstylestrong{\sphinxhyphen{}l} option is not specified, the default ticket lifetime -(configured by each site) is used. Specifying a ticket lifetime -longer than the maximum ticket lifetime (configured by each site) -will not override the configured maximum ticket lifetime. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{start\_time}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Requests a postdated ticket. Postdated -tickets are issued with the \sphinxstylestrong{invalid} flag set, and need to be -resubmitted to the KDC for validation before use. - -\sphinxAtStartPar -\sphinxstyleemphasis{start\_time} specifies the duration of the delay before the ticket -can become valid. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{renewable\_life}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Requests renewable tickets, with a total -lifetime of \sphinxstyleemphasis{renewable\_life}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}f}} -\sphinxAtStartPar -requests forwardable tickets. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}F}} -\sphinxAtStartPar -requests non\sphinxhyphen{}forwardable tickets. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}p}} -\sphinxAtStartPar -requests proxiable tickets. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}P}} -\sphinxAtStartPar -requests non\sphinxhyphen{}proxiable tickets. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}a}} -\sphinxAtStartPar -requests tickets restricted to the host’s local address{[}es{]}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}A}} -\sphinxAtStartPar -requests tickets not restricted by address. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}C}} -\sphinxAtStartPar -requests canonicalization of the principal name, and allows the -KDC to reply with a different client principal from the one -requested. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}E}} -\sphinxAtStartPar -treats the principal name as an enterprise name. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}v}} -\sphinxAtStartPar -requests that the ticket\sphinxhyphen{}granting ticket in the cache (with the -\sphinxstylestrong{invalid} flag set) be passed to the KDC for validation. If the -ticket is within its requested time range, the cache is replaced -with the validated ticket. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}R}} -\sphinxAtStartPar -requests renewal of the ticket\sphinxhyphen{}granting ticket. Note that an -expired ticket cannot be renewed, even if the ticket is still -within its renewable life. - -\sphinxAtStartPar -Note that renewable tickets that have expired as reported by -{\hyperref[\detokenize{user/user_commands/klist:klist-1}]{\sphinxcrossref{\DUrole{std,std-ref}{klist}}}} may sometimes be renewed using this option, -because the KDC applies a grace period to account for client\sphinxhyphen{}KDC -clock skew. See \DUrole{xref,std,std-ref}{krb5.conf(5)} \sphinxstylestrong{clockskew} setting. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k} {[}\sphinxstylestrong{\sphinxhyphen{}i} | \sphinxstylestrong{\sphinxhyphen{}t} \sphinxstyleemphasis{keytab\_file}{]}} -\sphinxAtStartPar -requests a ticket, obtained from a key in the local host’s keytab. -The location of the keytab may be specified with the \sphinxstylestrong{\sphinxhyphen{}t} -\sphinxstyleemphasis{keytab\_file} option, or with the \sphinxstylestrong{\sphinxhyphen{}i} option to specify the use -of the default client keytab; otherwise the default keytab will be -used. By default, a host ticket for the local host is requested, -but any principal may be specified. On a KDC, the special keytab -location \sphinxcode{\sphinxupquote{KDB:}} can be used to indicate that kinit should open -the KDC database and look up the key directly. This permits an -administrator to obtain tickets as any principal that supports -authentication based on the key. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}n}} -\sphinxAtStartPar -Requests anonymous processing. Two types of anonymous principals -are supported. - -\sphinxAtStartPar -For fully anonymous Kerberos, configure pkinit on the KDC and -configure \sphinxstylestrong{pkinit\_anchors} in the client’s \DUrole{xref,std,std-ref}{krb5.conf(5)}. -Then use the \sphinxstylestrong{\sphinxhyphen{}n} option with a principal of the form \sphinxcode{\sphinxupquote{@REALM}} -(an empty principal name followed by the at\sphinxhyphen{}sign and a realm -name). If permitted by the KDC, an anonymous ticket will be -returned. - -\sphinxAtStartPar -A second form of anonymous tickets is supported; these -realm\sphinxhyphen{}exposed tickets hide the identity of the client but not the -client’s realm. For this mode, use \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}n}} with a normal -principal name. If supported by the KDC, the principal (but not -realm) will be replaced by the anonymous principal. - -\sphinxAtStartPar -As of release 1.8, the MIT Kerberos KDC only supports fully -anonymous operation. - -\end{description} - -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}I} \sphinxstyleemphasis{input\_ccache} -\begin{quote} - -\sphinxAtStartPar -Specifies the name of a credentials cache that already contains a -ticket. When obtaining that ticket, if information about how that -ticket was obtained was also stored to the cache, that information -will be used to affect how new credentials are obtained, including -preselecting the same methods of authenticating to the KDC. -\end{quote} -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}T} \sphinxstyleemphasis{armor\_ccache}} -\sphinxAtStartPar -Specifies the name of a credentials cache that already contains a -ticket. If supported by the KDC, this cache will be used to armor -the request, preventing offline dictionary attacks and allowing -the use of additional preauthentication mechanisms. Armoring also -makes sure that the response from the KDC is not modified in -transit. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{cache\_name}} -\sphinxAtStartPar -use \sphinxstyleemphasis{cache\_name} as the Kerberos 5 credentials (ticket) cache -location. If this option is not used, the default cache location -is used. - -\sphinxAtStartPar -The default cache location may vary between systems. If the -\sphinxstylestrong{KRB5CCNAME} environment variable is set, its value is used to -locate the default cache. If a principal name is specified and -the type of the default cache supports a collection (such as the -DIR type), an existing cache containing credentials for the -principal is selected or a new one is created and becomes the new -primary cache. Otherwise, any existing contents of the default -cache are destroyed by kinit. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}S} \sphinxstyleemphasis{service\_name}} -\sphinxAtStartPar -specify an alternate service name to use when getting initial -tickets. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}X} \sphinxstyleemphasis{attribute}{[}=\sphinxstyleemphasis{value}{]}} -\sphinxAtStartPar -specify a pre\sphinxhyphen{}authentication \sphinxstyleemphasis{attribute} and \sphinxstyleemphasis{value} to be -interpreted by pre\sphinxhyphen{}authentication modules. The acceptable -attribute and value values vary from module to module. This -option may be specified multiple times to specify multiple -attributes. If no value is specified, it is assumed to be “yes”. - -\sphinxAtStartPar -The following attributes are recognized by the PKINIT -pre\sphinxhyphen{}authentication mechanism: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{X509\_user\_identity}=\sphinxstyleemphasis{value}} -\sphinxAtStartPar -specify where to find user’s X509 identity information - -\sphinxlineitem{\sphinxstylestrong{X509\_anchors}=\sphinxstyleemphasis{value}} -\sphinxAtStartPar -specify where to find trusted X509 anchor information - -\sphinxlineitem{\sphinxstylestrong{disable\_freshness}{[}\sphinxstylestrong{=yes}{]}} -\sphinxAtStartPar -disable sending freshness tokens (for testing purposes only) - -\end{description} - -\sphinxlineitem{\sphinxstylestrong{\textendash{}request\sphinxhyphen{}pac} | \sphinxstylestrong{\textendash{}no\sphinxhyphen{}request\sphinxhyphen{}pac}} -\sphinxAtStartPar -mutually exclusive. If \sphinxstylestrong{\textendash{}request\sphinxhyphen{}pac} is set, ask the KDC to -include a PAC in authdata; if \sphinxstylestrong{\textendash{}no\sphinxhyphen{}request\sphinxhyphen{}pac} is set, ask the -KDC not to include a PAC; if neither are set, the KDC will follow -its default, which is typically is to include a PAC if doing so is -supported. - -\end{description} - - -\subsection{ENVIRONMENT} -\label{\detokenize{user/user_commands/kinit:environment}} -\sphinxAtStartPar -See {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} for a description of Kerberos environment -variables. - - -\subsection{FILES} -\label{\detokenize{user/user_commands/kinit:files}}\begin{description} -\sphinxlineitem{\DUrole{xref,std,std-ref}{DEFCCNAME}} -\sphinxAtStartPar -default location of Kerberos 5 credentials cache - -\sphinxlineitem{\DUrole{xref,std,std-ref}{DEFKTNAME}} -\sphinxAtStartPar -default location for the local host’s keytab. - -\end{description} - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/kinit:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_commands/klist:klist-1}]{\sphinxcrossref{\DUrole{std,std-ref}{klist}}}}, {\hyperref[\detokenize{user/user_commands/kdestroy:kdestroy-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kdestroy}}}}, {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} - -\sphinxstepscope - - -\section{klist} -\label{\detokenize{user/user_commands/klist:klist}}\label{\detokenize{user/user_commands/klist:klist-1}}\label{\detokenize{user/user_commands/klist::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/klist:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{klist} -{[}\sphinxstylestrong{\sphinxhyphen{}e}{]} -{[}{[}\sphinxstylestrong{\sphinxhyphen{}c}{]} {[}\sphinxstylestrong{\sphinxhyphen{}l}{]} {[}\sphinxstylestrong{\sphinxhyphen{}A}{]} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} {[}\sphinxstylestrong{\sphinxhyphen{}s}{]} {[}\sphinxstylestrong{\sphinxhyphen{}a} {[}\sphinxstylestrong{\sphinxhyphen{}n}{]}{]}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}C}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}k} {[}\sphinxstylestrong{\sphinxhyphen{}i}{]} {[}\sphinxstylestrong{\sphinxhyphen{}t}{]} {[}\sphinxstylestrong{\sphinxhyphen{}K}{]}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}V}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}d}{]} -{[}\sphinxstyleemphasis{cache\_name}|\sphinxstyleemphasis{keytab\_name}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/klist:description}} -\sphinxAtStartPar -klist lists the Kerberos principal and Kerberos tickets held in a -credentials cache, or the keys held in a keytab file. - - -\subsection{OPTIONS} -\label{\detokenize{user/user_commands/klist:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e}} -\sphinxAtStartPar -Displays the encryption types of the session key and the ticket -for each credential in the credential cache, or each key in the -keytab file. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}l}} -\sphinxAtStartPar -If a cache collection is available, displays a table summarizing -the caches present in the collection. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}A}} -\sphinxAtStartPar -If a cache collection is available, displays the contents of all -of the caches in the collection. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}c}} -\sphinxAtStartPar -List tickets held in a credentials cache. This is the default if -neither \sphinxstylestrong{\sphinxhyphen{}c} nor \sphinxstylestrong{\sphinxhyphen{}k} is specified. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}f}} -\sphinxAtStartPar -Shows the flags present in the credentials, using the following -abbreviations: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{F} \PYG{n}{Forwardable} -\PYG{n}{f} \PYG{n}{forwarded} -\PYG{n}{P} \PYG{n}{Proxiable} -\PYG{n}{p} \PYG{n}{proxy} -\PYG{n}{D} \PYG{n}{postDateable} -\PYG{n}{d} \PYG{n}{postdated} -\PYG{n}{R} \PYG{n}{Renewable} -\PYG{n}{I} \PYG{n}{Initial} -\PYG{n}{i} \PYG{n}{invalid} -\PYG{n}{H} \PYG{n}{Hardware} \PYG{n}{authenticated} -\PYG{n}{A} \PYG{n}{preAuthenticated} -\PYG{n}{T} \PYG{n}{Transit} \PYG{n}{policy} \PYG{n}{checked} -\PYG{n}{O} \PYG{n}{Okay} \PYG{k}{as} \PYG{n}{delegate} -\PYG{n}{a} \PYG{n}{anonymous} -\end{sphinxVerbatim} - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}s}} -\sphinxAtStartPar -Causes klist to run silently (produce no output). klist will exit -with status 1 if the credentials cache cannot be read or is -expired, and with status 0 otherwise. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}a}} -\sphinxAtStartPar -Display list of addresses in credentials. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}n}} -\sphinxAtStartPar -Show numeric addresses instead of reverse\sphinxhyphen{}resolving addresses. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}C}} -\sphinxAtStartPar -List configuration data that has been stored in the credentials -cache when klist encounters it. By default, configuration data -is not listed. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k}} -\sphinxAtStartPar -List keys held in a keytab file. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}i}} -\sphinxAtStartPar -In combination with \sphinxstylestrong{\sphinxhyphen{}k}, defaults to using the default client -keytab instead of the default acceptor keytab, if no name is -given. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}t}} -\sphinxAtStartPar -Display the time entry timestamps for each keytab entry in the -keytab file. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}K}} -\sphinxAtStartPar -Display the value of the encryption key in each keytab entry in -the keytab file. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}d}} -\sphinxAtStartPar -Display the authdata types (if any) for each entry. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}V}} -\sphinxAtStartPar -Display the Kerberos version number and exit. - -\end{description} - -\sphinxAtStartPar -If \sphinxstyleemphasis{cache\_name} or \sphinxstyleemphasis{keytab\_name} is not specified, klist will display -the credentials in the default credentials cache or keytab file as -appropriate. If the \sphinxstylestrong{KRB5CCNAME} environment variable is set, its -value is used to locate the default ticket cache. - - -\subsection{ENVIRONMENT} -\label{\detokenize{user/user_commands/klist:environment}} -\sphinxAtStartPar -See {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} for a description of Kerberos environment -variables. - - -\subsection{FILES} -\label{\detokenize{user/user_commands/klist:files}}\begin{description} -\sphinxlineitem{\DUrole{xref,std,std-ref}{DEFCCNAME}} -\sphinxAtStartPar -Default location of Kerberos 5 credentials cache - -\sphinxlineitem{\DUrole{xref,std,std-ref}{DEFKTNAME}} -\sphinxAtStartPar -Default location for the local host’s keytab file. - -\end{description} - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/klist:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}}, {\hyperref[\detokenize{user/user_commands/kdestroy:kdestroy-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kdestroy}}}}, {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} - -\sphinxstepscope - - -\section{kpasswd} -\label{\detokenize{user/user_commands/kpasswd:kpasswd}}\label{\detokenize{user/user_commands/kpasswd:kpasswd-1}}\label{\detokenize{user/user_commands/kpasswd::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/kpasswd:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kpasswd} {[}\sphinxstyleemphasis{principal}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/kpasswd:description}} -\sphinxAtStartPar -The kpasswd command is used to change a Kerberos principal’s password. -kpasswd first prompts for the current Kerberos password, then prompts -the user twice for the new password, and the password is changed. - -\sphinxAtStartPar -If the principal is governed by a policy that specifies the length -and/or number of character classes required in the new password, the -new password must conform to the policy. (The five character classes -are lower case, upper case, numbers, punctuation, and all other -characters.) - - -\subsection{OPTIONS} -\label{\detokenize{user/user_commands/kpasswd:options}}\begin{description} -\sphinxlineitem{\sphinxstyleemphasis{principal}} -\sphinxAtStartPar -Change the password for the Kerberos principal principal. -Otherwise, kpasswd uses the principal name from an existing ccache -if there is one; if not, the principal is derived from the -identity of the user invoking the kpasswd command. - -\end{description} - - -\subsection{ENVIRONMENT} -\label{\detokenize{user/user_commands/kpasswd:environment}} -\sphinxAtStartPar -See {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/kpasswd:see-also}} -\sphinxAtStartPar -\DUrole{xref,std,std-ref}{kadmin(1)}, \DUrole{xref,std,std-ref}{kadmind(8)}, {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} - -\sphinxstepscope - - -\section{krb5\sphinxhyphen{}config} -\label{\detokenize{user/user_commands/krb5-config:krb5-config}}\label{\detokenize{user/user_commands/krb5-config:krb5-config-1}}\label{\detokenize{user/user_commands/krb5-config::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/krb5-config:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{krb5\sphinxhyphen{}config} -{[}\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}help} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}all} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}version} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}vendor} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}prefix} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}exec\sphinxhyphen{}prefix} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}defccname} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}defktname} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}defcktname} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}cflags} | \sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}libs} {[}\sphinxstyleemphasis{libraries}{]}{]} - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/krb5-config:description}} -\sphinxAtStartPar -krb5\sphinxhyphen{}config tells the application programmer what flags to use to compile -and link programs against the installed Kerberos libraries. - - -\subsection{OPTIONS} -\label{\detokenize{user/user_commands/krb5-config:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}help}} -\sphinxAtStartPar -prints a usage message. This is the default behavior when no options -are specified. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}all}} -\sphinxAtStartPar -prints the version, vendor, prefix, and exec\sphinxhyphen{}prefix. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}version}} -\sphinxAtStartPar -prints the version number of the Kerberos installation. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}vendor}} -\sphinxAtStartPar -prints the name of the vendor of the Kerberos installation. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}prefix}} -\sphinxAtStartPar -prints the prefix for which the Kerberos installation was built. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}exec\sphinxhyphen{}prefix}} -\sphinxAtStartPar -prints the prefix for executables for which the Kerberos installation -was built. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}defccname}} -\sphinxAtStartPar -prints the built\sphinxhyphen{}in default credentials cache location. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}defktname}} -\sphinxAtStartPar -prints the built\sphinxhyphen{}in default keytab location. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}defcktname}} -\sphinxAtStartPar -prints the built\sphinxhyphen{}in default client (initiator) keytab location. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}cflags}} -\sphinxAtStartPar -prints the compilation flags used to build the Kerberos installation. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}}\sphinxstylestrong{\sphinxhyphen{}libs} {[}\sphinxstyleemphasis{library}{]}} -\sphinxAtStartPar -prints the compiler options needed to link against \sphinxstyleemphasis{library}. -Allowed values for \sphinxstyleemphasis{library} are: - - -\begin{savenotes}\sphinxattablestart -\sphinxthistablewithglobalstyle -\centering -\begin{tabulary}{\linewidth}[t]{TT} -\sphinxtoprule -\sphinxtableatstartofbodyhook -\sphinxAtStartPar -krb5 -& -\sphinxAtStartPar -Kerberos 5 applications (default) -\\ -\sphinxhline -\sphinxAtStartPar -gssapi -& -\sphinxAtStartPar -GSSAPI applications with Kerberos 5 bindings -\\ -\sphinxhline -\sphinxAtStartPar -kadm\sphinxhyphen{}client -& -\sphinxAtStartPar -Kadmin client -\\ -\sphinxhline -\sphinxAtStartPar -kadm\sphinxhyphen{}server -& -\sphinxAtStartPar -Kadmin server -\\ -\sphinxhline -\sphinxAtStartPar -kdb -& -\sphinxAtStartPar -Applications that access the Kerberos database -\\ -\sphinxbottomrule -\end{tabulary} -\sphinxtableafterendhook\par -\sphinxattableend\end{savenotes} - -\end{description} - - -\subsection{EXAMPLES} -\label{\detokenize{user/user_commands/krb5-config:examples}} -\sphinxAtStartPar -krb5\sphinxhyphen{}config is particularly useful for compiling against a Kerberos -installation that was installed in a non\sphinxhyphen{}standard location. For example, -a Kerberos installation that is installed in \sphinxcode{\sphinxupquote{/opt/krb5/}} but uses -libraries in \sphinxcode{\sphinxupquote{/usr/local/lib/}} for text localization would produce -the following output: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{krb5}\PYG{o}{\PYGZhy{}}\PYG{n}{config} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{n}{libs} \PYG{n}{krb5} -\PYG{o}{\PYGZhy{}}\PYG{n}{L}\PYG{o}{/}\PYG{n}{opt}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{lib} \PYG{o}{\PYGZhy{}}\PYG{n}{Wl}\PYG{p}{,}\PYG{o}{\PYGZhy{}}\PYG{n}{rpath} \PYG{o}{\PYGZhy{}}\PYG{n}{Wl}\PYG{p}{,}\PYG{o}{/}\PYG{n}{opt}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{lib} \PYG{o}{\PYGZhy{}}\PYG{n}{L}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{lib} \PYG{o}{\PYGZhy{}}\PYG{n}{lkrb5} \PYG{o}{\PYGZhy{}}\PYG{n}{lk5crypto} \PYG{o}{\PYGZhy{}}\PYG{n}{lcom\PYGZus{}err} -\end{sphinxVerbatim} - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/krb5-config:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}}, cc(1) - -\sphinxstepscope - - -\section{ksu} -\label{\detokenize{user/user_commands/ksu:ksu}}\label{\detokenize{user/user_commands/ksu:ksu-1}}\label{\detokenize{user/user_commands/ksu::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/ksu:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{ksu} -{[} \sphinxstyleemphasis{target\_user} {]} -{[} \sphinxstylestrong{\sphinxhyphen{}n} \sphinxstyleemphasis{target\_principal\_name} {]} -{[} \sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{source\_cache\_name} {]} -{[} \sphinxstylestrong{\sphinxhyphen{}k} {]} -{[} \sphinxstylestrong{\sphinxhyphen{}r} time {]} -{[} \sphinxstylestrong{\sphinxhyphen{}p} | \sphinxstylestrong{\sphinxhyphen{}P}{]} -{[} \sphinxstylestrong{\sphinxhyphen{}f} | \sphinxstylestrong{\sphinxhyphen{}F}{]} -{[} \sphinxstylestrong{\sphinxhyphen{}l} \sphinxstyleemphasis{lifetime} {]} -{[} \sphinxstylestrong{\sphinxhyphen{}z | Z} {]} -{[} \sphinxstylestrong{\sphinxhyphen{}q} {]} -{[} \sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{command} {[} args … {]} {]} {[} \sphinxstylestrong{\sphinxhyphen{}a} {[} args … {]} {]} - - -\subsection{REQUIREMENTS} -\label{\detokenize{user/user_commands/ksu:requirements}} -\sphinxAtStartPar -Must have Kerberos version 5 installed to compile ksu. Must have a -Kerberos version 5 server running to use ksu. - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/ksu:description}} -\sphinxAtStartPar -ksu is a Kerberized version of the su program that has two missions: -one is to securely change the real and effective user ID to that of -the target user, and the other is to create a new security context. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -For the sake of clarity, all references to and attributes of -the user invoking the program will start with “source” -(e.g., “source user”, “source cache”, etc.). - -\sphinxAtStartPar -Likewise, all references to and attributes of the target -account will start with “target”. -\end{sphinxadmonition} - - -\subsection{AUTHENTICATION} -\label{\detokenize{user/user_commands/ksu:authentication}} -\sphinxAtStartPar -To fulfill the first mission, ksu operates in two phases: -authentication and authorization. Resolving the target principal name -is the first step in authentication. The user can either specify his -principal name with the \sphinxstylestrong{\sphinxhyphen{}n} option (e.g., \sphinxcode{\sphinxupquote{\sphinxhyphen{}n jqpublic@USC.EDU}}) -or a default principal name will be assigned using a heuristic -described in the OPTIONS section (see \sphinxstylestrong{\sphinxhyphen{}n} option). The target user -name must be the first argument to ksu; if not specified root is the -default. If \sphinxcode{\sphinxupquote{.}} is specified then the target user will be the -source user (e.g., \sphinxcode{\sphinxupquote{ksu .}}). If the source user is root or the -target user is the source user, no authentication or authorization -takes place. Otherwise, ksu looks for an appropriate Kerberos ticket -in the source cache. - -\sphinxAtStartPar -The ticket can either be for the end\sphinxhyphen{}server or a ticket granting -ticket (TGT) for the target principal’s realm. If the ticket for the -end\sphinxhyphen{}server is already in the cache, it’s decrypted and verified. If -it’s not in the cache but the TGT is, the TGT is used to obtain the -ticket for the end\sphinxhyphen{}server. The end\sphinxhyphen{}server ticket is then verified. -If neither ticket is in the cache, but ksu is compiled with the -\sphinxstylestrong{GET\_TGT\_VIA\_PASSWD} define, the user will be prompted for a -Kerberos password which will then be used to get a TGT. If the user -is logged in remotely and does not have a secure channel, the password -may be exposed. If neither ticket is in the cache and -\sphinxstylestrong{GET\_TGT\_VIA\_PASSWD} is not defined, authentication fails. - - -\subsection{AUTHORIZATION} -\label{\detokenize{user/user_commands/ksu:authorization}} -\sphinxAtStartPar -This section describes authorization of the source user when ksu is -invoked without the \sphinxstylestrong{\sphinxhyphen{}e} option. For a description of the \sphinxstylestrong{\sphinxhyphen{}e} -option, see the OPTIONS section. - -\sphinxAtStartPar -Upon successful authentication, ksu checks whether the target -principal is authorized to access the target account. In the target -user’s home directory, ksu attempts to access two authorization files: -{\hyperref[\detokenize{user/user_config/k5login:k5login-5}]{\sphinxcrossref{\DUrole{std,std-ref}{.k5login}}}} and .k5users. In the .k5login file each line -contains the name of a principal that is authorized to access the -account. - -\sphinxAtStartPar -For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{jqpublic}\PYG{n+nd}{@USC}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{jqpublic}\PYG{o}{/}\PYG{n}{secure}\PYG{n+nd}{@USC}\PYG{o}{.}\PYG{n}{EDU} -\PYG{n}{jqpublic}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@USC}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The format of .k5users is the same, except the principal name may be -followed by a list of commands that the principal is authorized to -execute (see the \sphinxstylestrong{\sphinxhyphen{}e} option in the OPTIONS section for details). - -\sphinxAtStartPar -Thus if the target principal name is found in the .k5login file the -source user is authorized to access the target account. Otherwise ksu -looks in the .k5users file. If the target principal name is found -without any trailing commands or followed only by \sphinxcode{\sphinxupquote{*}} then the -source user is authorized. If either .k5login or .k5users exist but -an appropriate entry for the target principal does not exist then -access is denied. If neither file exists then the principal will be -granted access to the account according to the aname\sphinxhyphen{}\textgreater{}lname mapping -rules. Otherwise, authorization fails. - - -\subsection{EXECUTION OF THE TARGET SHELL} -\label{\detokenize{user/user_commands/ksu:execution-of-the-target-shell}} -\sphinxAtStartPar -Upon successful authentication and authorization, ksu proceeds in a -similar fashion to su. The environment is unmodified with the -exception of USER, HOME and SHELL variables. If the target user is -not root, USER gets set to the target user name. Otherwise USER -remains unchanged. Both HOME and SHELL are set to the target login’s -default values. In addition, the environment variable \sphinxstylestrong{KRB5CCNAME} -gets set to the name of the target cache. The real and effective user -ID are changed to that of the target user. The target user’s shell is -then invoked (the shell name is specified in the password file). Upon -termination of the shell, ksu deletes the target cache (unless ksu is -invoked with the \sphinxstylestrong{\sphinxhyphen{}k} option). This is implemented by first doing a -fork and then an exec, instead of just exec, as done by su. - - -\subsection{CREATING A NEW SECURITY CONTEXT} -\label{\detokenize{user/user_commands/ksu:creating-a-new-security-context}} -\sphinxAtStartPar -ksu can be used to create a new security context for the target -program (either the target shell, or command specified via the \sphinxstylestrong{\sphinxhyphen{}e} -option). The target program inherits a set of credentials from the -source user. By default, this set includes all of the credentials in -the source cache plus any additional credentials obtained during -authentication. The source user is able to limit the credentials in -this set by using \sphinxstylestrong{\sphinxhyphen{}z} or \sphinxstylestrong{\sphinxhyphen{}Z} option. \sphinxstylestrong{\sphinxhyphen{}z} restricts the copy -of tickets from the source cache to the target cache to only the -tickets where client == the target principal name. The \sphinxstylestrong{\sphinxhyphen{}Z} option -provides the target user with a fresh target cache (no creds in the -cache). Note that for security reasons, when the source user is root -and target user is non\sphinxhyphen{}root, \sphinxstylestrong{\sphinxhyphen{}z} option is the default mode of -operation. - -\sphinxAtStartPar -While no authentication takes place if the source user is root or is -the same as the target user, additional tickets can still be obtained -for the target cache. If \sphinxstylestrong{\sphinxhyphen{}n} is specified and no credentials can -be copied to the target cache, the source user is prompted for a -Kerberos password (unless \sphinxstylestrong{\sphinxhyphen{}Z} specified or \sphinxstylestrong{GET\_TGT\_VIA\_PASSWD} -is undefined). If successful, a TGT is obtained from the Kerberos -server and stored in the target cache. Otherwise, if a password is -not provided (user hit return) ksu continues in a normal mode of -operation (the target cache will not contain the desired TGT). If the -wrong password is typed in, ksu fails. - -\begin{sphinxadmonition}{note}{Note:} -\sphinxAtStartPar -During authentication, only the tickets that could be -obtained without providing a password are cached in the -source cache. -\end{sphinxadmonition} - - -\subsection{OPTIONS} -\label{\detokenize{user/user_commands/ksu:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}n} \sphinxstyleemphasis{target\_principal\_name}} -\sphinxAtStartPar -Specify a Kerberos target principal name. Used in authentication -and authorization phases of ksu. - -\sphinxAtStartPar -If ksu is invoked without \sphinxstylestrong{\sphinxhyphen{}n}, a default principal name is -assigned via the following heuristic: -\begin{itemize} -\item {} -\sphinxAtStartPar -Case 1: source user is non\sphinxhyphen{}root. - -\sphinxAtStartPar -If the target user is the source user the default principal name -is set to the default principal of the source cache. If the -cache does not exist then the default principal name is set to -\sphinxcode{\sphinxupquote{target\_user@local\_realm}}. If the source and target users are -different and neither \sphinxcode{\sphinxupquote{\textasciitilde{}target\_user/.k5users}} nor -\sphinxcode{\sphinxupquote{\textasciitilde{}target\_user/.k5login}} exist then the default principal name -is \sphinxcode{\sphinxupquote{target\_user\_login\_name@local\_realm}}. Otherwise, starting -with the first principal listed below, ksu checks if the -principal is authorized to access the target account and whether -there is a legitimate ticket for that principal in the source -cache. If both conditions are met that principal becomes the -default target principal, otherwise go to the next principal. -\begin{enumerate} -\sphinxsetlistlabels{\alph}{enumi}{enumii}{}{)}% -\item {} -\sphinxAtStartPar -default principal of the source cache - -\item {} -\sphinxAtStartPar -target\_user@local\_realm - -\item {} -\sphinxAtStartPar -source\_user@local\_realm - -\end{enumerate} - -\sphinxAtStartPar -If a\sphinxhyphen{}c fails try any principal for which there is a ticket in -the source cache and that is authorized to access the target -account. If that fails select the first principal that is -authorized to access the target account from the above list. If -none are authorized and ksu is configured with -\sphinxstylestrong{PRINC\_LOOK\_AHEAD} turned on, select the default principal as -follows: - -\sphinxAtStartPar -For each candidate in the above list, select an authorized -principal that has the same realm name and first part of the -principal name equal to the prefix of the candidate. For -example if candidate a) is \sphinxcode{\sphinxupquote{jqpublic@ISI.EDU}} and -\sphinxcode{\sphinxupquote{jqpublic/secure@ISI.EDU}} is authorized to access the target -account then the default principal is set to -\sphinxcode{\sphinxupquote{jqpublic/secure@ISI.EDU}}. - -\item {} -\sphinxAtStartPar -Case 2: source user is root. - -\sphinxAtStartPar -If the target user is non\sphinxhyphen{}root then the default principal name -is \sphinxcode{\sphinxupquote{target\_user@local\_realm}}. Else, if the source cache -exists the default principal name is set to the default -principal of the source cache. If the source cache does not -exist, default principal name is set to \sphinxcode{\sphinxupquote{root\textbackslash{}@local\_realm}}. - -\end{itemize} - -\end{description} - -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{source\_cache\_name} -\begin{quote} - -\sphinxAtStartPar -Specify source cache name (e.g., \sphinxcode{\sphinxupquote{\sphinxhyphen{}c FILE:/tmp/my\_cache}}). If -\sphinxstylestrong{\sphinxhyphen{}c} option is not used then the name is obtained from -\sphinxstylestrong{KRB5CCNAME} environment variable. If \sphinxstylestrong{KRB5CCNAME} is not -defined the source cache name is set to \sphinxcode{\sphinxupquote{krb5cc\_\textless{}source uid\textgreater{}}}. -The target cache name is automatically set to \sphinxcode{\sphinxupquote{krb5cc\_\textless{}target -uid\textgreater{}.(gen\_sym())}}, where gen\_sym generates a new number such that -the resulting cache does not already exist. For example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{krb5cc\PYGZus{}1984}\PYG{l+m+mf}{.2} -\end{sphinxVerbatim} -\end{quote} -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k}} -\sphinxAtStartPar -Do not delete the target cache upon termination of the target -shell or a command (\sphinxstylestrong{\sphinxhyphen{}e} command). Without \sphinxstylestrong{\sphinxhyphen{}k}, ksu deletes -the target cache. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}z}} -\sphinxAtStartPar -Restrict the copy of tickets from the source cache to the target -cache to only the tickets where client == the target principal -name. Use the \sphinxstylestrong{\sphinxhyphen{}n} option if you want the tickets for other then -the default principal. Note that the \sphinxstylestrong{\sphinxhyphen{}z} option is mutually -exclusive with the \sphinxstylestrong{\sphinxhyphen{}Z} option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}Z}} -\sphinxAtStartPar -Don’t copy any tickets from the source cache to the target cache. -Just create a fresh target cache, where the default principal name -of the cache is initialized to the target principal name. Note -that the \sphinxstylestrong{\sphinxhyphen{}Z} option is mutually exclusive with the \sphinxstylestrong{\sphinxhyphen{}z} -option. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}q}} -\sphinxAtStartPar -Suppress the printing of status messages. - -\end{description} - -\sphinxAtStartPar -Ticket granting ticket options: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}l} \sphinxstyleemphasis{lifetime} \sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{time} \sphinxstylestrong{\sphinxhyphen{}p} \sphinxstylestrong{\sphinxhyphen{}P} \sphinxstylestrong{\sphinxhyphen{}f} \sphinxstylestrong{\sphinxhyphen{}F}} -\sphinxAtStartPar -The ticket granting ticket options only apply to the case where -there are no appropriate tickets in the cache to authenticate the -source user. In this case if ksu is configured to prompt users -for a Kerberos password (\sphinxstylestrong{GET\_TGT\_VIA\_PASSWD} is defined), the -ticket granting ticket options that are specified will be used -when getting a ticket granting ticket from the Kerberos server. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}l} \sphinxstyleemphasis{lifetime}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Specifies the lifetime to be requested -for the ticket; if this option is not specified, the default ticket -lifetime (12 hours) is used instead. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{time}} -\sphinxAtStartPar -(\DUrole{xref,std,std-ref}{duration} string.) Specifies that the \sphinxstylestrong{renewable} option -should be requested for the ticket, and specifies the desired -total lifetime of the ticket. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}p}} -\sphinxAtStartPar -specifies that the \sphinxstylestrong{proxiable} option should be requested for -the ticket. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}P}} -\sphinxAtStartPar -specifies that the \sphinxstylestrong{proxiable} option should not be requested -for the ticket, even if the default configuration is to ask for -proxiable tickets. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}f}} -\sphinxAtStartPar -option specifies that the \sphinxstylestrong{forwardable} option should be -requested for the ticket. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}F}} -\sphinxAtStartPar -option specifies that the \sphinxstylestrong{forwardable} option should not be -requested for the ticket, even if the default configuration is to -ask for forwardable tickets. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{command} {[}\sphinxstyleemphasis{args} …{]}} -\sphinxAtStartPar -ksu proceeds exactly the same as if it was invoked without the -\sphinxstylestrong{\sphinxhyphen{}e} option, except instead of executing the target shell, ksu -executes the specified command. Example of usage: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{ksu} \PYG{n}{bob} \PYG{o}{\PYGZhy{}}\PYG{n}{e} \PYG{n}{ls} \PYG{o}{\PYGZhy{}}\PYG{n}{lag} -\end{sphinxVerbatim} - -\sphinxAtStartPar -The authorization algorithm for \sphinxstylestrong{\sphinxhyphen{}e} is as follows: - -\sphinxAtStartPar -If the source user is root or source user == target user, no -authorization takes place and the command is executed. If source -user id != 0, and \sphinxcode{\sphinxupquote{\textasciitilde{}target\_user/.k5users}} file does not exist, -authorization fails. Otherwise, \sphinxcode{\sphinxupquote{\textasciitilde{}target\_user/.k5users}} file -must have an appropriate entry for target principal to get -authorized. - -\sphinxAtStartPar -The .k5users file format: - -\sphinxAtStartPar -A single principal entry on each line that may be followed by a -list of commands that the principal is authorized to execute. A -principal name followed by a \sphinxcode{\sphinxupquote{*}} means that the user is -authorized to execute any command. Thus, in the following -example: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{jqpublic}\PYG{n+nd}{@USC}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{ls} \PYG{n}{mail} \PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{/}\PYG{n}{klist} -\PYG{n}{jqpublic}\PYG{o}{/}\PYG{n}{secure}\PYG{n+nd}{@USC}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{*} -\PYG{n}{jqpublic}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@USC}\PYG{o}{.}\PYG{n}{EDU} -\end{sphinxVerbatim} - -\sphinxAtStartPar -\sphinxcode{\sphinxupquote{jqpublic@USC.EDU}} is only authorized to execute \sphinxcode{\sphinxupquote{ls}}, -\sphinxcode{\sphinxupquote{mail}} and \sphinxcode{\sphinxupquote{klist}} commands. \sphinxcode{\sphinxupquote{jqpublic/secure@USC.EDU}} is -authorized to execute any command. \sphinxcode{\sphinxupquote{jqpublic/admin@USC.EDU}} is -not authorized to execute any command. Note, that -\sphinxcode{\sphinxupquote{jqpublic/admin@USC.EDU}} is authorized to execute the target -shell (regular ksu, without the \sphinxstylestrong{\sphinxhyphen{}e} option) but -\sphinxcode{\sphinxupquote{jqpublic@USC.EDU}} is not. - -\sphinxAtStartPar -The commands listed after the principal name must be either a full -path names or just the program name. In the second case, -\sphinxstylestrong{CMD\_PATH} specifying the location of authorized programs must -be defined at the compilation time of ksu. Which command gets -executed? - -\sphinxAtStartPar -If the source user is root or the target user is the source user -or the user is authorized to execute any command (\sphinxcode{\sphinxupquote{*}} entry) -then command can be either a full or a relative path leading to -the target program. Otherwise, the user must specify either a -full path or just the program name. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}a} \sphinxstyleemphasis{args}} -\sphinxAtStartPar -Specify arguments to be passed to the target shell. Note that all -flags and parameters following \sphinxhyphen{}a will be passed to the shell, -thus all options intended for ksu must precede \sphinxstylestrong{\sphinxhyphen{}a}. - -\sphinxAtStartPar -The \sphinxstylestrong{\sphinxhyphen{}a} option can be used to simulate the \sphinxstylestrong{\sphinxhyphen{}e} option if -used as follows: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{o}{\PYGZhy{}}\PYG{n}{a} \PYG{o}{\PYGZhy{}}\PYG{n}{c} \PYG{p}{[}\PYG{n}{command} \PYG{p}{[}\PYG{n}{arguments}\PYG{p}{]}\PYG{p}{]}\PYG{o}{.} -\end{sphinxVerbatim} - -\sphinxAtStartPar -\sphinxstylestrong{\sphinxhyphen{}c} is interpreted by the c\sphinxhyphen{}shell to execute the command. - -\end{description} - - -\subsection{INSTALLATION INSTRUCTIONS} -\label{\detokenize{user/user_commands/ksu:installation-instructions}} -\sphinxAtStartPar -ksu can be compiled with the following four flags: -\begin{description} -\sphinxlineitem{\sphinxstylestrong{GET\_TGT\_VIA\_PASSWD}} -\sphinxAtStartPar -In case no appropriate tickets are found in the source cache, the -user will be prompted for a Kerberos password. The password is -then used to get a ticket granting ticket from the Kerberos -server. The danger of configuring ksu with this macro is if the -source user is logged in remotely and does not have a secure -channel, the password may get exposed. - -\sphinxlineitem{\sphinxstylestrong{PRINC\_LOOK\_AHEAD}} -\sphinxAtStartPar -During the resolution of the default principal name, -\sphinxstylestrong{PRINC\_LOOK\_AHEAD} enables ksu to find principal names in -the .k5users file as described in the OPTIONS section -(see \sphinxstylestrong{\sphinxhyphen{}n} option). - -\sphinxlineitem{\sphinxstylestrong{CMD\_PATH}} -\sphinxAtStartPar -Specifies a list of directories containing programs that users are -authorized to execute (via .k5users file). - -\sphinxlineitem{\sphinxstylestrong{HAVE\_GETUSERSHELL}} -\sphinxAtStartPar -If the source user is non\sphinxhyphen{}root, ksu insists that the target user’s -shell to be invoked is a “legal shell”. \sphinxstyleemphasis{getusershell(3)} is -called to obtain the names of “legal shells”. Note that the -target user’s shell is obtained from the passwd file. - -\end{description} - -\sphinxAtStartPar -Sample configuration: - -\begin{sphinxVerbatim}[commandchars=\\\{\}] -\PYG{n}{KSU\PYGZus{}OPTS} \PYG{o}{=} \PYG{o}{\PYGZhy{}}\PYG{n}{DGET\PYGZus{}TGT\PYGZus{}VIA\PYGZus{}PASSWD} \PYG{o}{\PYGZhy{}}\PYG{n}{DPRINC\PYGZus{}LOOK\PYGZus{}AHEAD} \PYG{o}{\PYGZhy{}}\PYG{n}{DCMD\PYGZus{}PATH}\PYG{o}{=}\PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{\PYGZdq{}}\PYG{l+s+s1}{/bin /usr/ucb /local/bin}\PYG{l+s+s1}{\PYGZdq{}} -\end{sphinxVerbatim} - -\sphinxAtStartPar -ksu should be owned by root and have the set user id bit turned on. - -\sphinxAtStartPar -ksu attempts to get a ticket for the end server just as Kerberized -telnet and rlogin. Thus, there must be an entry for the server in the -Kerberos database (e.g., \sphinxcode{\sphinxupquote{host/nii.isi.edu@ISI.EDU}}). The keytab -file must be in an appropriate location. - - -\subsection{SIDE EFFECTS} -\label{\detokenize{user/user_commands/ksu:side-effects}} -\sphinxAtStartPar -ksu deletes all expired tickets from the source cache. - - -\subsection{AUTHOR OF KSU} -\label{\detokenize{user/user_commands/ksu:author-of-ksu}} -\sphinxAtStartPar -GENNADY (ARI) MEDVINSKY - - -\subsection{ENVIRONMENT} -\label{\detokenize{user/user_commands/ksu:environment}} -\sphinxAtStartPar -See {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/ksu:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}}, {\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}} - -\sphinxstepscope - - -\section{kswitch} -\label{\detokenize{user/user_commands/kswitch:kswitch}}\label{\detokenize{user/user_commands/kswitch:kswitch-1}}\label{\detokenize{user/user_commands/kswitch::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/kswitch:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kswitch} -\{\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{cachename}|\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal}\} - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/kswitch:description}} -\sphinxAtStartPar -kswitch makes the specified credential cache the primary cache for the -collection, if a cache collection is available. - - -\subsection{OPTIONS} -\label{\detokenize{user/user_commands/kswitch:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{cachename}} -\sphinxAtStartPar -Directly specifies the credential cache to be made primary. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal}} -\sphinxAtStartPar -Causes the cache collection to be searched for a cache containing -credentials for \sphinxstyleemphasis{principal}. If one is found, that collection is -made primary. - -\end{description} - - -\subsection{ENVIRONMENT} -\label{\detokenize{user/user_commands/kswitch:environment}} -\sphinxAtStartPar -See {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} for a description of Kerberos environment -variables. - - -\subsection{FILES} -\label{\detokenize{user/user_commands/kswitch:files}}\begin{description} -\sphinxlineitem{\DUrole{xref,std,std-ref}{DEFCCNAME}} -\sphinxAtStartPar -Default location of Kerberos 5 credentials cache - -\end{description} - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/kswitch:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}}, {\hyperref[\detokenize{user/user_commands/kdestroy:kdestroy-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kdestroy}}}}, {\hyperref[\detokenize{user/user_commands/klist:klist-1}]{\sphinxcrossref{\DUrole{std,std-ref}{klist}}}}, -{\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} - -\sphinxstepscope - - -\section{kvno} -\label{\detokenize{user/user_commands/kvno:kvno}}\label{\detokenize{user/user_commands/kvno:kvno-1}}\label{\detokenize{user/user_commands/kvno::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/kvno:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{kvno} -{[}\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{ccache}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{etype}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{keytab}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}q}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}u} | \sphinxstylestrong{\sphinxhyphen{}S} \sphinxstyleemphasis{sname}{]} -{[}\sphinxstylestrong{\sphinxhyphen{}P}{]} -{[}\sphinxstylestrong{\textendash{}cached\sphinxhyphen{}only}{]} -{[}\sphinxstylestrong{\textendash{}no\sphinxhyphen{}store}{]} -{[}\sphinxstylestrong{\textendash{}out\sphinxhyphen{}cache} \sphinxstyleemphasis{cache}{]} -{[}{[}\{\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{cert\_file} | \{\sphinxstylestrong{\sphinxhyphen{}I} | \sphinxstylestrong{\sphinxhyphen{}U}\} \sphinxstyleemphasis{for\_user}\} {[}\sphinxstylestrong{\sphinxhyphen{}P}{]}{]} | \sphinxstylestrong{\textendash{}u2u} \sphinxstyleemphasis{ccache}{]} -\sphinxstyleemphasis{service1 service2} … - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/kvno:description}} -\sphinxAtStartPar -kvno acquires a service ticket for the specified Kerberos principals -and prints out the key version numbers of each. - - -\subsection{OPTIONS} -\label{\detokenize{user/user_commands/kvno:options}}\begin{description} -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{ccache}} -\sphinxAtStartPar -Specifies the name of a credentials cache to use (if not the -default) - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{etype}} -\sphinxAtStartPar -Specifies the enctype which will be requested for the session key -of all the services named on the command line. This is useful in -certain backward compatibility situations. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{keytab}} -\sphinxAtStartPar -Decrypt the acquired tickets using \sphinxstyleemphasis{keytab} to confirm their -validity. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}q}} -\sphinxAtStartPar -Suppress printing output when successful. If a service ticket -cannot be obtained, an error message will still be printed and -kvno will exit with nonzero status. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}u}} -\sphinxAtStartPar -Use the unknown name type in requested service principal names. -This option Cannot be used with \sphinxstyleemphasis{\sphinxhyphen{}S}. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}P}} -\sphinxAtStartPar -Specifies that the \sphinxstyleemphasis{service1 service2} … arguments are to be -treated as services for which credentials should be acquired using -constrained delegation. This option is only valid when used in -conjunction with protocol transition. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}S} \sphinxstyleemphasis{sname}} -\sphinxAtStartPar -Specifies that the \sphinxstyleemphasis{service1 service2} … arguments are -interpreted as hostnames, and the service principals are to be -constructed from those hostnames and the service name \sphinxstyleemphasis{sname}. -The service hostnames will be canonicalized according to the usual -rules for constructing service principals. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}I} \sphinxstyleemphasis{for\_user}} -\sphinxAtStartPar -Specifies that protocol transition (S4U2Self) is to be used to -acquire a ticket on behalf of \sphinxstyleemphasis{for\_user}. If constrained -delegation is not requested, the service name must match the -credentials cache client principal. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}U} \sphinxstyleemphasis{for\_user}} -\sphinxAtStartPar -Same as \sphinxhyphen{}I, but treats \sphinxstyleemphasis{for\_user} as an enterprise name. - -\sphinxlineitem{\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{cert\_file}} -\sphinxAtStartPar -Specifies that protocol transition is to be used, identifying the -client principal with the X.509 certificate in \sphinxstyleemphasis{cert\_file}. The -certificate file must be in PEM format. - -\sphinxlineitem{\sphinxstylestrong{\textendash{}cached\sphinxhyphen{}only}} -\sphinxAtStartPar -Only retrieve credentials already present in the cache, not from -the KDC. (Added in release 1.19.) - -\sphinxlineitem{\sphinxstylestrong{\textendash{}no\sphinxhyphen{}store}} -\sphinxAtStartPar -Do not store retrieved credentials in the cache. If -\sphinxstylestrong{\textendash{}out\sphinxhyphen{}cache} is also specified, credentials will still be -stored into the output credential cache. (Added in release 1.19.) - -\sphinxlineitem{\sphinxstylestrong{\textendash{}out\sphinxhyphen{}cache} \sphinxstyleemphasis{ccache}} -\sphinxAtStartPar -Initialize \sphinxstyleemphasis{ccache} and store all retrieved credentials into it. -Do not store acquired credentials in the input cache. (Added in -release 1.19.) - -\sphinxlineitem{\sphinxstylestrong{\textendash{}u2u} \sphinxstyleemphasis{ccache}} -\sphinxAtStartPar -Requests a user\sphinxhyphen{}to\sphinxhyphen{}user ticket. \sphinxstyleemphasis{ccache} must contain a local -krbtgt ticket for the server principal. The reported version -number will typically be 0, as the resulting ticket is not -encrypted in the server’s long\sphinxhyphen{}term key. - -\end{description} - - -\subsection{ENVIRONMENT} -\label{\detokenize{user/user_commands/kvno:environment}} -\sphinxAtStartPar -See {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} for a description of Kerberos environment -variables. - - -\subsection{FILES} -\label{\detokenize{user/user_commands/kvno:files}}\begin{description} -\sphinxlineitem{\DUrole{xref,std,std-ref}{DEFCCNAME}} -\sphinxAtStartPar -Default location of the credentials cache - -\end{description} - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/kvno:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}}, {\hyperref[\detokenize{user/user_commands/kdestroy:kdestroy-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kdestroy}}}}, {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} - -\sphinxstepscope - - -\section{sclient} -\label{\detokenize{user/user_commands/sclient:sclient}}\label{\detokenize{user/user_commands/sclient:sclient-1}}\label{\detokenize{user/user_commands/sclient::doc}} - -\subsection{SYNOPSIS} -\label{\detokenize{user/user_commands/sclient:synopsis}} -\sphinxAtStartPar -\sphinxstylestrong{sclient} \sphinxstyleemphasis{remotehost} - - -\subsection{DESCRIPTION} -\label{\detokenize{user/user_commands/sclient:description}} -\sphinxAtStartPar -sclient is a sample application, primarily useful for testing -purposes. It contacts a sample server \DUrole{xref,std,std-ref}{sserver(8)} and -authenticates to it using Kerberos version 5 tickets, then displays -the server’s response. - - -\subsection{ENVIRONMENT} -\label{\detokenize{user/user_commands/sclient:environment}} -\sphinxAtStartPar -See {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} for a description of Kerberos environment -variables. - - -\subsection{SEE ALSO} -\label{\detokenize{user/user_commands/sclient:see-also}} -\sphinxAtStartPar -{\hyperref[\detokenize{user/user_commands/kinit:kinit-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kinit}}}}, \DUrole{xref,std,std-ref}{sserver(8)}, {\hyperref[\detokenize{user/user_config/kerberos:kerberos-7}]{\sphinxcrossref{\DUrole{std,std-ref}{kerberos}}}} - - - -\renewcommand{\indexname}{Index} -\printindex -\end{document}
\ No newline at end of file |