add krb5_keytab.3, from <lha@stacken.kth.se>
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@9640 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Assar Westerlund
@@ -147,7 +147,8 @@ man_MANS = \
|
|||||||
verify_krb5_conf.8 \
|
verify_krb5_conf.8 \
|
||||||
krb5_auth_context.3 \
|
krb5_auth_context.3 \
|
||||||
krb5_context.3 \
|
krb5_context.3 \
|
||||||
krb5_init_context.3
|
krb5_init_context.3 \
|
||||||
|
krb5_keytab.3
|
||||||
|
|
||||||
include_HEADERS = krb5.h krb5-protos.h krb5-private.h krb5_err.h heim_err.h
|
include_HEADERS = krb5.h krb5-protos.h krb5-private.h krb5_err.h heim_err.h
|
||||||
|
|
||||||
|
|||||||
358
lib/krb5/krb5_keytab.3
Normal file
358
lib/krb5/krb5_keytab.3
Normal file
@@ -0,0 +1,358 @@
|
|||||||
|
.\" Copyright (c) 2001 Kungliga Tekniska H<>gskolan
|
||||||
|
.\" $Id$
|
||||||
|
.Dd Feb 5, 2001
|
||||||
|
.Dt KRB5_KEYTAB 3
|
||||||
|
.Os HEIMDAL
|
||||||
|
.Sh NAME
|
||||||
|
.Nm krb5_kt_ops,
|
||||||
|
.Nm krb5_keytab_entry ,
|
||||||
|
.Nm krb5_kt_cursor ,
|
||||||
|
.Nm krb5_kt_add_entry ,
|
||||||
|
.Nm krb5_kt_close ,
|
||||||
|
.Nm krb5_kt_compare ,
|
||||||
|
.Nm krb5_kt_copy_entry_contents ,
|
||||||
|
.Nm krb5_kt_default ,
|
||||||
|
.Nm krb5_kt_default_name ,
|
||||||
|
.Nm krb5_kt_end_seq_get ,
|
||||||
|
.Nm krb5_kt_free_entry ,
|
||||||
|
.Nm krb5_kt_get_entry ,
|
||||||
|
.Nm krb5_kt_get_name ,
|
||||||
|
.Nm krb5_kt_next_entry ,
|
||||||
|
.Nm krb5_kt_read_service_key ,
|
||||||
|
.Nm krb5_kt_register ,
|
||||||
|
.Nm krb5_kt_remove_entry ,
|
||||||
|
.Nm krb5_kt_resolve ,
|
||||||
|
.Nm krb5_kt_start_seq_get
|
||||||
|
.Nd manage keytab (key storage) files
|
||||||
|
.Sh SYNOPSIS
|
||||||
|
.Fd #include <krb5.h>
|
||||||
|
.Pp
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_add_entry
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab id"
|
||||||
|
.Fa "krb5_keytab_entry *entry"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_close
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab id"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_boolean
|
||||||
|
.Fo krb5_kt_compare
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab_entry *entry"
|
||||||
|
.Fa "krb5_const_principal principal"
|
||||||
|
.Fa "krb5_kvno vno"
|
||||||
|
.Fa "krb5_enctype enctype"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_copy_entry_contents
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "const krb5_keytab_entry *in"
|
||||||
|
.Fa "krb5_keytab_entry *out"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_default
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab *id"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_default_name
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "char *name"
|
||||||
|
.Fa "size_t namesize"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_end_seq_get
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab id"
|
||||||
|
.Fa "krb5_kt_cursor *cursor"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_free_entry
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab_entry *entry"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_get_entry
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab id"
|
||||||
|
.Fa "krb5_const_principal principal"
|
||||||
|
.Fa "krb5_kvno kvno"
|
||||||
|
.Fa "krb5_enctype enctype"
|
||||||
|
.Fa "krb5_keytab_entry *entry"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_get_name
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab keytab"
|
||||||
|
.Fa "char *name"
|
||||||
|
.Fa "size_t namesize"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_next_entry
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab id"
|
||||||
|
.Fa "krb5_keytab_entry *entry"
|
||||||
|
.Fa "krb5_kt_cursor *cursor"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_read_service_key
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_pointer keyprocarg"
|
||||||
|
.Fa "krb5_principal principal"
|
||||||
|
.Fa "krb5_kvno vno"
|
||||||
|
.Fa "krb5_enctype enctype"
|
||||||
|
.Fa "krb5_keyblock **key"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_register
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "const krb5_kt_ops *ops"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_remove_entry
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab id"
|
||||||
|
.Fa "krb5_keytab_entry *entry"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_resolve
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "const char *name"
|
||||||
|
.Fa "krb5_keytab *id"
|
||||||
|
.Fc
|
||||||
|
.Ft krb5_error_code
|
||||||
|
.Fo krb5_kt_start_seq_get
|
||||||
|
.Fa "krb5_context context"
|
||||||
|
.Fa "krb5_keytab id"
|
||||||
|
.Fa "krb5_kt_cursor *cursor"
|
||||||
|
.Fc
|
||||||
|
.Sh DESCRIPTION
|
||||||
|
A keytab name is on the form
|
||||||
|
.Li type:residual .
|
||||||
|
The
|
||||||
|
.Li residual
|
||||||
|
part is specific to each keytab-type.
|
||||||
|
.Pp
|
||||||
|
When a keytab-name is resolved, the type is matched with an interal
|
||||||
|
list of keytab types. If there is no matching keytab type,
|
||||||
|
the default keytab is used. The current default type is
|
||||||
|
.Nm file .
|
||||||
|
The default value can be changed in the configuration file
|
||||||
|
.Pa /etc/krb5.conf
|
||||||
|
by setting the variable
|
||||||
|
.Li [defaults]default_keytab_name .
|
||||||
|
.Pp
|
||||||
|
The keytab types that are implemented in Heimdal
|
||||||
|
are:
|
||||||
|
.Bl -tag -width Ds
|
||||||
|
.It Nm file
|
||||||
|
store the keytab in a file, the type's name is
|
||||||
|
.Li KEYFILE .
|
||||||
|
The residual part is a filename.
|
||||||
|
.It Nm keyfile
|
||||||
|
store the keytab in a
|
||||||
|
.Li AFS
|
||||||
|
keyfile (usually
|
||||||
|
.Pa /usr/afs/etc/KeyFile ) ,
|
||||||
|
the type's name is
|
||||||
|
.Li AFSKEYFILE .
|
||||||
|
The residual part is a filename.
|
||||||
|
.It Nm krb4
|
||||||
|
the keytab is a Kerberos 4
|
||||||
|
.Pa srvtab
|
||||||
|
that is on-the-fly converted to a keytab. The type's name is
|
||||||
|
.Li krb4 .
|
||||||
|
The residual part is a filename.
|
||||||
|
.It Nm memory
|
||||||
|
The keytab is stored in a memory segment. This allows sensitive and/or
|
||||||
|
temporary data not to be stored on disk. The type's name is
|
||||||
|
.Li MEMORY .
|
||||||
|
There are no residual part, the only pointer back to the keytab is the
|
||||||
|
.Fa id
|
||||||
|
returned by
|
||||||
|
.Fn krb5_kt_resolve .
|
||||||
|
.El
|
||||||
|
.Pp
|
||||||
|
.Nm krb5_keytab_entry
|
||||||
|
holds all data for an entry in a keytab file, like principal name,
|
||||||
|
key-type, key, key-version number, etc.
|
||||||
|
.Nm krb5_kt_cursor
|
||||||
|
holds the current position that is used when iterating through a
|
||||||
|
keytab entry with
|
||||||
|
.Fn krb5_kt_start_seq_get ,
|
||||||
|
.Fn krb5_kt_next_entry ,
|
||||||
|
and
|
||||||
|
.Fn krb5_kt_end_seq_get .
|
||||||
|
.Pp
|
||||||
|
.Nm krb5_kt_ops
|
||||||
|
contains the different operations that can be done to a keytab. This
|
||||||
|
structure is normally only used when doing a new keytab-type
|
||||||
|
implementation.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_resolve
|
||||||
|
is the equvalent of an
|
||||||
|
.Xr open 2
|
||||||
|
on keytab. Resolve the keytab name in
|
||||||
|
.Fa name
|
||||||
|
into a keytab in
|
||||||
|
.Fa id .
|
||||||
|
Returns 0 or an error. The opposite of
|
||||||
|
.Fn krb5_kt_resolve
|
||||||
|
is
|
||||||
|
.Fn krb5_kt_close .
|
||||||
|
.Fn krb5_kt_close
|
||||||
|
frees all resources allocated to the keytab.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_default
|
||||||
|
sets the argument
|
||||||
|
.Fa id
|
||||||
|
to the default keytab.
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_default_name
|
||||||
|
copy the name of the default keytab into
|
||||||
|
.Fa name .
|
||||||
|
Return 0 or KRB5_CONFIG_NOTENUFSPACE if
|
||||||
|
.Fa namesize
|
||||||
|
is too short.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_add_entry
|
||||||
|
Add a new
|
||||||
|
.Fa entry
|
||||||
|
to the keytab
|
||||||
|
.Fa id .
|
||||||
|
.Li KRB5_KT_NOWRITE
|
||||||
|
is returned if the keytab is a readonly keytab.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_compare
|
||||||
|
compares the passed in
|
||||||
|
.Fa entry
|
||||||
|
against
|
||||||
|
.Fa principal ,
|
||||||
|
.Fa vno ,
|
||||||
|
and
|
||||||
|
.Fa enctype .
|
||||||
|
Any of
|
||||||
|
.Fa principal ,
|
||||||
|
.Fa vno
|
||||||
|
or
|
||||||
|
.Fa enctype
|
||||||
|
might be 0 which acts as a wildcard. Return TRUE if they compare the
|
||||||
|
same, FALSE otherwise.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_copy_entry_contents
|
||||||
|
copies the contents of
|
||||||
|
.Fa in
|
||||||
|
into
|
||||||
|
.Fa out .
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_get_name
|
||||||
|
retrieves the name of the keytab
|
||||||
|
.Fa keytab
|
||||||
|
into
|
||||||
|
.Fa name ,
|
||||||
|
.Fa namesize .
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_free_entry
|
||||||
|
frees the contents of
|
||||||
|
.Fa entry .
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_start_seq_get
|
||||||
|
sets
|
||||||
|
.Fa cursor
|
||||||
|
to point at the beginning of
|
||||||
|
.Fa id.
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_next_entry
|
||||||
|
gets the next entry from
|
||||||
|
.Fa id
|
||||||
|
pointed to by
|
||||||
|
.Fa cursor
|
||||||
|
and advance the
|
||||||
|
.Fa cursor .
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_end_seq_get
|
||||||
|
releases all resources associated with
|
||||||
|
.Fa cursor .
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_get_entry
|
||||||
|
retrieves the keytab entry for
|
||||||
|
.Fa principal,
|
||||||
|
.Fa kvno,
|
||||||
|
.Fa enctype
|
||||||
|
into
|
||||||
|
.Fa entry
|
||||||
|
from the keytab
|
||||||
|
.Fa id .
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_read_service_key
|
||||||
|
reads the key identified by
|
||||||
|
.Ns ( Fa principal ,
|
||||||
|
.Fa vno ,
|
||||||
|
.Fa enctype )
|
||||||
|
from the keytab in
|
||||||
|
.Fa keyprocarg
|
||||||
|
(the default if == NULL) into
|
||||||
|
.Fa *key .
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_remove_entry
|
||||||
|
removes the entry
|
||||||
|
.Fa entry
|
||||||
|
from the keytab
|
||||||
|
.Fa id .
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Pp
|
||||||
|
.Fn krb5_kt_register
|
||||||
|
registers a new keytab type
|
||||||
|
.Fa ops .
|
||||||
|
Returns 0 or an error.
|
||||||
|
.Sh EXAMPLE
|
||||||
|
This is a minimalistic version of
|
||||||
|
.Nm ktutil .
|
||||||
|
.Pp
|
||||||
|
.Bd -literal
|
||||||
|
int
|
||||||
|
main (int argc, char **argv)
|
||||||
|
{
|
||||||
|
krb5_context context;
|
||||||
|
krb5_keytab keytab;
|
||||||
|
krb5_kt_cursor cursor;
|
||||||
|
krb5_keytab_entry entry;
|
||||||
|
krb5_error_code ret;
|
||||||
|
char *principal;
|
||||||
|
|
||||||
|
if (krb5_init_context (&context) != 0)
|
||||||
|
errx(1, "krb5_context");
|
||||||
|
|
||||||
|
ret = krb5_kt_default (context, &keytab);
|
||||||
|
if (ret)
|
||||||
|
krb5_err(context, 1, ret, "krb5_kt_default");
|
||||||
|
|
||||||
|
ret = krb5_kt_start_seq_get(context, keytab, &cursor);
|
||||||
|
if (ret)
|
||||||
|
krb5_err(context, 1, ret, "krb5_kt_start_seq_get");
|
||||||
|
while((ret = krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0){
|
||||||
|
krb5_unparse_name_short(context, entry.principal, &principal);
|
||||||
|
printf("principal: %s\\n", principal);
|
||||||
|
free(principal);
|
||||||
|
krb5_kt_free_entry(context, &entry);
|
||||||
|
}
|
||||||
|
ret = krb5_kt_end_seq_get(context, keytab, &cursor);
|
||||||
|
if (ret)
|
||||||
|
krb5_err(context, 1, ret, "krb5_kt_end_seq_get");
|
||||||
|
krb5_free_context(context);
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
.Ed
|
||||||
|
.Sh SEE ALSO
|
||||||
|
.Xr kerberos 8 ,
|
||||||
|
.Xr krb5.conf 5
|
||||||
Reference in New Issue
Block a user