Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Credentials for an arbitrary user.

32 views
Skip to first unread message

Kevin Burton

unread,
Feb 3, 2004, 1:23:44 PM2/3/04
to
I am trying to interface with our Windows 2000 server using Kerberos. I
would like a client to obtain a credential handle for a given user with a
supplied password. Using GSSAPI this involves calling gss_init_sec_context
and instead of passing GSS_C_NO_CREDENTIAL I would like to pass the opaque
handle gss_cred_id_t which is obtained via gss_acquire_cred. The problem is
that gss_acquire_cred only has the option to specify a credential by name
(not password). So I am assuming that the way to go would be to look at what
kinit does and then the "name" of the credential is probably the prinicipal
name. I call the following:

krb5_init_context
krb5_cc_default
krb5_parse_name (passing the principal name name@domain)
krb5_unparse_name (because that is what kinit does)

Then I call krb5_get_init_creds_password and I get an error indicating the
my I/O flags are not appropriate. This is a Windows application so tty
settings and I/O setting are not really applicable. Is there another way to
get a set of credentials given a user name and password? Ideally I would
like a gss_cred_id_t handle of the credentials but right now I would take
anything.

Thank you for your suggestions.

Kevin


Sam Hartman

unread,
Feb 3, 2004, 2:59:43 PM2/3/04
to kerb...@mit.edu
You definitely want to be using krb5_get_init_creds_password. I think
the problem has to do with how you are setting up the credentials
cache, not with your tty configuration.

________________________________________________
Kerberos mailing list Kerb...@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

Wyllys Ingersoll

unread,
Feb 3, 2004, 3:01:49 PM2/3/04
to kerb...@mit.edu
Kevin Burton wrote:

>I am trying to interface with our Windows 2000 server using Kerberos. I
>would like a client to obtain a credential handle for a given user with a
>supplied password. Using GSSAPI this involves calling gss_init_sec_context
>and instead of passing GSS_C_NO_CREDENTIAL I would like to pass the opaque
>handle gss_cred_id_t which is obtained via gss_acquire_cred. The problem is
>that gss_acquire_cred only has the option to specify a credential by name
>(not password). So I am assuming that the way to go would be to look at what
>kinit does and then the "name" of the credential is probably the prinicipal
>name. I call the following:
>

GSSAPI does not have an API for getting initial credentials (i.e.
'kinit' functionality).
The user must establish their personal credentials external to the
GSSAPI application
(example: run kinit, then run the GSSAPI application).

>krb5_init_context
>krb5_cc_default
>krb5_parse_name (passing the principal name name@domain)
>krb5_unparse_name (because that is what kinit does)
>
>

Depending on where you put this code, you are likely violating the
abstraction
layer that GSSAPI was designed to provide. An application that calls
GSSAPI should never call an mechanism-specific API.

-Wyllys

>Then I call krb5_get_init_creds_password and I get an error indicating the
>my I/O flags are not appropriate. This is a Windows application so tty
>settings and I/O setting are not really applicable. Is there another way to
>get a set of credentials given a user name and password? Ideally I would
>like a gss_cred_id_t handle of the credentials but right now I would take
>anything.
>
>Thank you for your suggestions.
>
>Kevin
>
>

Douglas E. Engert

unread,
Feb 3, 2004, 3:37:30 PM2/3/04
to kerb...@mit.edu

Kevin Burton wrote:
>
> I am trying to interface with our Windows 2000 server using Kerberos. I
> would like a client to obtain a credential handle for a given user with a
> supplied password.

If the client is running on UNIX, you can setting KRB5CCNAME ....
then do a kinit then call your application. The gss_acquire_cred will use
the underlying implementations method to find the credential.

If the client is on Windows there are some other things you can do.

> Using GSSAPI this involves calling gss_init_sec_context
> and instead of passing GSS_C_NO_CREDENTIAL I would like to pass the opaque
> handle gss_cred_id_t which is obtained via gss_acquire_cred. The problem is
> that gss_acquire_cred only has the option to specify a credential by name

The name would be which credential in a credential cache. Its not what
you might think.

> (not password). So I am assuming that the way to go would be to look at what
> kinit does and then the "name" of the credential is probably the prinicipal
> name. I call the following:
>
> krb5_init_context
> krb5_cc_default
> krb5_parse_name (passing the principal name name@domain)
> krb5_unparse_name (because that is what kinit does)
>
> Then I call krb5_get_init_creds_password and I get an error indicating the
> my I/O flags are not appropriate. This is a Windows application so tty
> settings and I/O setting are not really applicable. Is there another way to
> get a set of credentials given a user name and password? Ideally I would
> like a gss_cred_id_t handle of the credentials but right now I would take
> anything.

(This is not tested:)
#!/bin/sh
KRB5CCNAME=FILE:/tmp/krb5_cc.appl.$$ i.e. make it unique
export KRB5CCNAME
kinit
application
kdestroy

If it has to be in the applicaiton how about something like:
setenv("KRB5CCNAME", somefilename);
system("kinit"); /* or call some krb5 routines */
gss_acquire_cred();

>
> Thank you for your suggestions.
>
> Kevin
>

> ________________________________________________
> Kerberos mailing list Kerb...@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos

--

Douglas E. Engert <DEEn...@anl.gov>
Argonne National Laboratory
9700 South Cass Avenue
Argonne, Illinois 60439
(630) 252-5444

Kevin Burton

unread,
Feb 3, 2004, 6:12:01 PM2/3/04
to
The client will more than likely be running on UNIX but I need to test it on
Windows. Right now I am using KfW 2.6 beta.

Kevin

""Douglas E. Engert"" <deen...@anl.gov> wrote in message
news:40200016...@anl.gov...

Kevin Burton

unread,
Feb 3, 2004, 6:10:43 PM2/3/04
to
I am taking this directly from the kinit source. I want this functionality
to be embedded in the app.

Kevin

"Wyllys Ingersoll" <wyllys.i...@sun.com> wrote in message
news:401FF4A3...@sun.com...

Kevin Burton

unread,
Feb 3, 2004, 8:06:32 PM2/3/04
to
I would welcom any suggestions but when I call com_err to lookup the return
from this function call I get "Inappropriate I/O control operation when
getting password". The sepcific code returned is 0x19.

Kevin

"Sam Hartman" <hart...@MIT.EDU> wrote in message
news:tslsmhs...@konishi-polis.mit.edu...

Sam Hartman

unread,
Feb 4, 2004, 12:54:17 PM2/4/04
to kerb...@mit.edu
Are you using krb5_prompter_posix? If so, this does not really work
on Windows outside of console mode. You probably want to write your
own prompter function.

Kevin Burton

unread,
Feb 5, 2004, 2:25:17 PM2/5/04
to
Do you have any suggestions as to how to do that?

"Sam Hartman" <hart...@MIT.EDU> wrote in message

news:tslvfmm...@konishi-polis.mit.edu...

Jeffrey Altman

unread,
Feb 5, 2004, 2:48:32 PM2/5/04
to
A prompter function is simply a function which is used to
allow the Kerberos library to ask your application to prompt
the user for necessary information. The implementation of
the prompter function is therefore 100% dependent on the
application which is calling krb5_get_init_creds_password().

Jeffrey Altman

0 new messages