LIBRARY

GSS-API Library (libgssapi, -lgssapi)

DESCRIPTION

The Generic Security Service Application Program Interface (GSS-API) provides security services to callers in a generic fashion, supportable with a range of underlying mechanisms and technologies and hence allowing source-level portability of applications to different environments.

The GSS-API implementation in Heimdal implements the Kerberos 5 and the SPNEGO GSS-API security mechanisms.

LIST OF FUNCTIONS

These functions constitute the gssapi library, libgssapi Declarations for these functions may be obtained from the include file gssapi.h

Name/Page

gss_accept_sec_context3

gss_acquire_cred3

gss_add_cred3

gss_add_oid_set_member3

gss_canonicalize_name3

gss_compare_name3

gss_context_time3

gss_create_empty_oid_set3

gss_delete_sec_context3

gss_display_name3

gss_display_status3

gss_duplicate_name3

gss_export_name3

gss_export_sec_context3

gss_get_mic3

gss_import_name3

gss_import_sec_context3

gss_indicate_mechs3

gss_init_sec_context3

gss_inquire_context3

gss_inquire_cred3

gss_inquire_cred_by_mech3

gss_inquire_mechs_for_name3

gss_inquire_names_for_mech3

gss_krb5_ccache_name3

gss_krb5_compat_des3_mic3

gss_krb5_copy_ccache3

gss_krb5_extract_authz_data_from_sec_context3

gss_krb5_import_ccache3

gss_process_context_token3

gss_release_buffer3

gss_release_cred3

gss_release_name3

gss_release_oid_set3

gss_seal3

gss_sign3

gss_test_oid_set_member3

gss_unseal3

gss_unwrap3

gss_verify3

gss_verify_mic3

gss_wrap3

gss_wrap_size_limit3

COMPATIBILITY

The Heimdal GSS-API implementation had a bug in releases before 0.6 that made it fail to inter-operate when using DES3 with other GSS-API implementations when using Fn gss_get_mic / Fn gss_verify_mic . It is possible to modify the behavior of the generator of the MIC with the krb5.conf configuration file so that old clients/servers will still work.

New clients/servers will try both the old and new MIC in Heimdal 0.6. In 0.7 it will check only if configured - the compatibility code will be removed in 0.8.

Heimdal 0.6 still generates by default the broken GSS-API DES3 mic, this will change in 0.7 to generate correct des3 mic.

To turn on compatibility with older clients and servers, change the [gssapi] broken_des3_mic in krb5.conf that contains a list of globbing expressions that will be matched against the server name. To turn off generation of the old (incompatible) mic of the MIC use [gssapi] correct_des3_mic

If a match for a entry is in both [gssapi] correct_des3_mic and [gssapi] broken_des3_mic the later will override.

This config option modifies behaviour for both clients and servers.

Microsoft implemented SPNEGO to Windows2000, however, they managed to get it wrong, their implementation didn't fill in the MechListMIC in the reply token with the right content. There is a work around for this problem, but not all implementation support it.

Heimdal defaults to correct SPNEGO when the the kerberos implementation uses CFX, or when it is configured by the user. To turn on compatibility with peers, use option [gssapi] require_mechlist_mic

EXAMPLES

[gssapi]
        broken_des3_mic = cvs/*@SU.SE
        broken_des3_mic = host/*@E.KTH.SE
        correct_des3_mic = host/*@SU.SE
        require_mechlist_mic = host/*@SU.SE