doc/html/appdev/refs/api/krb5_rd_req.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   2   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   3
   4
   5 <html xmlns="http://www.w3.org/1999/xhtml">
   6   <head>
   7     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
   8
   9     <title>krb5_rd_req - Parse and decrypt a KRB_AP_REQ message. &mdash; MIT Kerberos Documentation</title>
  10
  11     <link rel="stylesheet" href="../../../_static/agogo.css" type="text/css" />
  12     <link rel="stylesheet" href="../../../_static/pygments.css" type="text/css" />
  13     <link rel="stylesheet" href="../../../_static/kerb.css" type="text/css" />
  14
  15     <script type="text/javascript">
  16       var DOCUMENTATION_OPTIONS = {
  17         URL_ROOT:    '../../../',
  18         VERSION:     '1.15.1',
  19         COLLAPSE_INDEX: false,
  20         FILE_SUFFIX: '.html',
  21         HAS_SOURCE:  true
  22       };
  23     </script>
  24     <script type="text/javascript" src="../../../_static/jquery.js"></script>
  25     <script type="text/javascript" src="../../../_static/underscore.js"></script>
  26     <script type="text/javascript" src="../../../_static/doctools.js"></script>
  27     <link rel="author" title="About these documents" href="../../../about.html" />
  28     <link rel="copyright" title="Copyright" href="../../../copyright.html" />
  29     <link rel="top" title="MIT Kerberos Documentation" href="../../../index.html" />
  30     <link rel="up" title="krb5 API" href="index.html" />
  31     <link rel="next" title="krb5_rd_safe - Process KRB-SAFE message." href="krb5_rd_safe.html" />
  32     <link rel="prev" title="krb5_rd_rep_dce - Parse and decrypt a KRB_AP_REP message for DCE RPC." href="krb5_rd_rep_dce.html" />
  33   </head>
  34   <body>
  35     <div class="header-wrapper">
  36         <div class="header">
  37
  38
  39             <h1><a href="../../../index.html">MIT Kerberos Documentation</a></h1>
  40
  41             <div class="rel">
  42
  43         <a href="../../../index.html" title="Full Table of Contents"
  44             accesskey="C">Contents</a> |
  45         <a href="krb5_rd_rep_dce.html" title="krb5_rd_rep_dce - Parse and decrypt a KRB_AP_REP message for DCE RPC."
  46             accesskey="P">previous</a> |
  47         <a href="krb5_rd_safe.html" title="krb5_rd_safe - Process KRB-SAFE message."
  48             accesskey="N">next</a> |
  49         <a href="../../../genindex.html" title="General Index"
  50             accesskey="I">index</a> |
  51         <a href="../../../search.html" title="Enter search criteria"
  52             accesskey="S">Search</a> |
  53     <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_rd_req -  Parse and decrypt a KRB_AP_REQ message.">feedback</a>
  54             </div>
  55         </div>
  56     </div>
  57
  58     <div class="content-wrapper">
  59       <div class="content">
  60         <div class="document">
  61
  62       <div class="documentwrapper">
  63         <div class="bodywrapper">
  64           <div class="body">
  65
  66   <div class="section" id="krb5-rd-req-parse-and-decrypt-a-krb-ap-req-message">
  67 <h1>krb5_rd_req -  Parse and decrypt a KRB_AP_REQ message.<a class="headerlink" href="#krb5-rd-req-parse-and-decrypt-a-krb-ap-req-message" title="Permalink to this headline">¶</a></h1>
  68 <dl class="function">
  69 <dt id="c.krb5_rd_req">
  70 <a class="reference internal" href="../types/krb5_error_code.html#c.krb5_error_code" title="krb5_error_code">krb5_error_code</a> <tt class="descname">krb5_rd_req</tt><big>(</big><a class="reference internal" href="../types/krb5_context.html#c.krb5_context" title="krb5_context">krb5_context</a><em>&nbsp;context</em>, <a class="reference internal" href="../types/krb5_auth_context.html#c.krb5_auth_context" title="krb5_auth_context">krb5_auth_context</a> *<em>&nbsp;auth_context</em>, const <a class="reference internal" href="../types/krb5_data.html#c.krb5_data" title="krb5_data">krb5_data</a> *<em>&nbsp;inbuf</em>, <a class="reference internal" href="../types/krb5_const_principal.html#c.krb5_const_principal" title="krb5_const_principal">krb5_const_principal</a><em>&nbsp;server</em>, <a class="reference internal" href="../types/krb5_keytab.html#c.krb5_keytab" title="krb5_keytab">krb5_keytab</a><em>&nbsp;keytab</em>, <a class="reference internal" href="../types/krb5_flags.html#c.krb5_flags" title="krb5_flags">krb5_flags</a> *<em>&nbsp;ap_req_options</em>, <a class="reference internal" href="../types/krb5_ticket.html#c.krb5_ticket" title="krb5_ticket">krb5_ticket</a> **<em>&nbsp;ticket</em><big>)</big><a class="headerlink" href="#c.krb5_rd_req" title="Permalink to this definition">¶</a></dt>
  71 <dd></dd></dl>
  72
  73 <table class="docutils field-list" frame="void" rules="none">
  74 <col class="field-name" />
  75 <col class="field-body" />
  76 <tbody valign="top">
  77 <tr class="field-odd field"><th class="field-name">param:</th><td class="field-body"><p class="first"><strong>[in]</strong> <strong>context</strong> - Library context</p>
  78 <p><strong>[inout]</strong> <strong>auth_context</strong> - Pre-existing or newly created auth context</p>
  79 <p><strong>[in]</strong> <strong>inbuf</strong> - AP-REQ message to be parsed</p>
  80 <p><strong>[in]</strong> <strong>server</strong> - Matching principal for server, or NULL to allow any principal in keytab</p>
  81 <p><strong>[in]</strong> <strong>keytab</strong> - Key table, or NULL to use the default</p>
  82 <p><strong>[out]</strong> <strong>ap_req_options</strong> - If non-null, the AP-REQ flags on output</p>
  83 <p class="last"><strong>[out]</strong> <strong>ticket</strong> - If non-null, ticket from the AP-REQ message</p>
  84 </td>
  85 </tr>
  86 </tbody>
  87 </table>
  88 <table class="docutils field-list" frame="void" rules="none">
  89 <col class="field-name" />
  90 <col class="field-body" />
  91 <tbody valign="top">
  92 <tr class="field-odd field"><th class="field-name">retval:</th><td class="field-body"><ul class="first last simple">
  93 <li>0   Success; otherwise - Kerberos error codes</li>
  94 </ul>
  95 </td>
  96 </tr>
  97 </tbody>
  98 </table>
  99 <p>This function parses, decrypts and verifies a AP-REQ message from <em>inbuf</em> and stores the authenticator in <em>auth_context</em> .</p>
 100 <p>If a keyblock was specified in <em>auth_context</em> using <a class="reference internal" href="krb5_auth_con_setuseruserkey.html#c.krb5_auth_con_setuseruserkey" title="krb5_auth_con_setuseruserkey"><tt class="xref c c-func docutils literal"><span class="pre">krb5_auth_con_setuseruserkey()</span></tt></a> , that key is used to decrypt the ticket in AP-REQ message and <em>keytab</em> is ignored. In this case, <em>server</em> should be specified as a complete principal name to allow for proper transited-path checking and replay cache selection.</p>
 101 <p>Otherwise, the decryption key is obtained from <em>keytab</em> , or from the default keytab if it is NULL. In this case, <em>server</em> may be a complete principal name, a matching principal (see <a class="reference internal" href="krb5_sname_match.html#c.krb5_sname_match" title="krb5_sname_match"><tt class="xref c c-func docutils literal"><span class="pre">krb5_sname_match()</span></tt></a> ), or NULL to match any principal name. The keys tried against the encrypted part of the ticket are determined as follows:</p>
 102 <blockquote>
 103 <div><ul class="simple">
 104 <li>If <em>server</em> is a complete principal name, then its entry in <em>keytab</em> is tried.</li>
 105 <li>Otherwise, if <em>keytab</em> is iterable, then all entries in <em>keytab</em> which match <em>server</em> are tried.</li>
 106 <li>Otherwise, the server principal in the ticket must match <em>server</em> , and its entry in <em>keytab</em> is tried.</li>
 107 </ul>
 108 </div></blockquote>
 109 <p>The client specified in the decrypted authenticator must match the client specified in the decrypted ticket.</p>
 110 <p>If the <em>remote_addr</em> field of <em>auth_context</em> is set, the request must come from that address.</p>
 111 <p>If a replay cache handle is provided in the <em>auth_context</em> , the authenticator and ticket are verified against it. If no conflict is found, the new authenticator is then stored in the replay cache of <em>auth_context</em> .</p>
 112 <p>Various other checks are performed on the decoded data, including cross-realm policy, clockskew, and ticket validation times.</p>
 113 <p>On success the authenticator, subkey, and remote sequence number of the request are stored in <em>auth_context</em> . If the <a class="reference internal" href="../macros/AP_OPTS_MUTUAL_REQUIRED.html#AP_OPTS_MUTUAL_REQUIRED" title="AP_OPTS_MUTUAL_REQUIRED"><tt class="xref py py-data docutils literal"><span class="pre">AP_OPTS_MUTUAL_REQUIRED</span></tt></a> bit is set, the local sequence number is XORed with the remote sequence number in the request.</p>
 114 <p>Use <a class="reference internal" href="krb5_free_ticket.html#c.krb5_free_ticket" title="krb5_free_ticket"><tt class="xref c c-func docutils literal"><span class="pre">krb5_free_ticket()</span></tt></a> to free <em>ticket</em> when it is no longer needed.</p>
 115 </div>
 116
 117
 118           </div>
 119         </div>
 120       </div>
 121         </div>
 122         <div class="sidebar">
 123     <h2>On this page</h2>
 124     <ul>
 125 <li><a class="reference internal" href="#">krb5_rd_req -  Parse and decrypt a KRB_AP_REQ message.</a></li>
 126 </ul>
 127
 128     <br/>
 129     <h2>Table of contents</h2>
 130     <ul class="current">
 131 <li class="toctree-l1"><a class="reference internal" href="../../../user/index.html">For users</a></li>
 132 <li class="toctree-l1"><a class="reference internal" href="../../../admin/index.html">For administrators</a></li>
 133 <li class="toctree-l1 current"><a class="reference internal" href="../../index.html">For application developers</a><ul class="current">
 134 <li class="toctree-l2"><a class="reference internal" href="../../gssapi.html">Developing with GSSAPI</a></li>
 135 <li class="toctree-l2"><a class="reference internal" href="../../h5l_mit_apidiff.html">Differences between Heimdal and MIT Kerberos API</a></li>
 136 <li class="toctree-l2"><a class="reference internal" href="../../init_creds.html">Initial credentials</a></li>
 137 <li class="toctree-l2"><a class="reference internal" href="../../princ_handle.html">Principal manipulation and parsing</a></li>
 138 <li class="toctree-l2 current"><a class="reference internal" href="../index.html">Complete reference - API and datatypes</a><ul class="current">
 139 <li class="toctree-l3 current"><a class="reference internal" href="index.html">krb5 API</a></li>
 140 <li class="toctree-l3"><a class="reference internal" href="../types/index.html">krb5 types and structures</a></li>
 141 <li class="toctree-l3"><a class="reference internal" href="../macros/index.html">krb5 simple macros</a></li>
 142 </ul>
 143 </li>
 144 </ul>
 145 </li>
 146 <li class="toctree-l1"><a class="reference internal" href="../../../plugindev/index.html">For plugin module developers</a></li>
 147 <li class="toctree-l1"><a class="reference internal" href="../../../build/index.html">Building Kerberos V5</a></li>
 148 <li class="toctree-l1"><a class="reference internal" href="../../../basic/index.html">Kerberos V5 concepts</a></li>
 149 <li class="toctree-l1"><a class="reference internal" href="../../../formats/index.html">Protocols and file formats</a></li>
 150 <li class="toctree-l1"><a class="reference internal" href="../../../mitK5features.html">MIT Kerberos features</a></li>
 151 <li class="toctree-l1"><a class="reference internal" href="../../../build_this.html">How to build this documentation from the source</a></li>
 152 <li class="toctree-l1"><a class="reference internal" href="../../../about.html">Contributing to the MIT Kerberos Documentation</a></li>
 153 <li class="toctree-l1"><a class="reference internal" href="../../../resources.html">Resources</a></li>
 154 </ul>
 155
 156     <br/>
 157     <h4><a href="../../../index.html">Full Table of Contents</a></h4>
 158     <h4>Search</h4>
 159     <form class="search" action="../../../search.html" method="get">
 160       <input type="text" name="q" size="18" />
 161       <input type="submit" value="Go" />
 162       <input type="hidden" name="check_keywords" value="yes" />
 163       <input type="hidden" name="area" value="default" />
 164     </form>
 165         </div>
 166         <div class="clearer"></div>
 167       </div>
 168     </div>
 169
 170     <div class="footer-wrapper">
 171         <div class="footer" >
 172             <div class="right" ><i>Release: 1.15.1</i><br />
 173                 &copy; <a href="../../../copyright.html">Copyright</a> 1985-2017, MIT.
 174             </div>
 175             <div class="left">
 176
 177         <a href="../../../index.html" title="Full Table of Contents"
 178             >Contents</a> |
 179         <a href="krb5_rd_rep_dce.html" title="krb5_rd_rep_dce - Parse and decrypt a KRB_AP_REP message for DCE RPC."
 180             >previous</a> |
 181         <a href="krb5_rd_safe.html" title="krb5_rd_safe - Process KRB-SAFE message."
 182             >next</a> |
 183         <a href="../../../genindex.html" title="General Index"
 184             >index</a> |
 185         <a href="../../../search.html" title="Enter search criteria"
 186             >Search</a> |
 187     <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__krb5_rd_req -  Parse and decrypt a KRB_AP_REQ message.">feedback</a>
 188             </div>
 189         </div>
 190     </div>
 191
 192   </body>
 193 </html>