krb5_get_in_tkt_with_password()--Get Initial Ticket Using Text Password


  Syntax 
 #include <krb5.h>

 krb5_error_code krb5_get_in_tkt_with_password(  
     krb5_context                 context,
     krb5_const krb5_flags        options,
     krb5_address * krb5_const *  addrs,
     krb5_enctype *               enctypes,
     krb5_preauthtype *           pre_auth_types,
     krb5_const char *            password,
     krb5_ccache                  ccache,
     krb5_creds *                 creds,
     krb5_kdc_rep **              ret_as_reply);
  Service Program Name: QSYS/QKRBGSS

  Default Public Authority: *USE

  Threadsafe: Yes

The krb5_get_in_tkt_with_password() function obtains an initial ticket-granting ticket from the Kerberos Key Distribution Center (KDC) server using a text password. This initial ticket can then be used to obtain service tickets. The client must be in the same realm as the KDC to be able to obtain an initial ticket from the KDC. The initial ticket can be used to obtain tickets in the same realm or in different realms as long as the proper inter-realm trust relationships have been established.


Authorities



Parameters

context  (Input)
The Kerberos context.

options  (Input)
The KDC options as follows:


addrs  (Input)
The addresses to be placed in the ticket. If NULL is specified for this parameter, the local system addresses are used. The address list is an array of krb5_address pointers. The end of the array is indicated by a NULL pointer. No addresses are included in the initial ticket if the address array consists of a single NULL entry. The ticket addresses determine which host systems can generate requests that use the ticket.

enctypes  (Input)
An array of encryption types to be used. The last entry in the array must be ENCTYPE_NULL (x'00000000'). If NULL is specified for this parameter, the default encryption types are used. The following encryption types may be specified:


pre_auth_types  (Input)
An array of preauthentication types to be used. The last entry in the array must be KRB5_PADATA_NONE (x'00000000'). If NULL is specified for this parameter, no preauthentication is done unless required by KDC policy. If multiple preauthentication types are specified, the KDC is supposed to accept the request as long as it recognizes at least one of the preauthentication types. Early implementations of the KDC did not follow this rule and will fail the request if the first preauthentication type is not recognized. The following preauthentication type may be specified:


password  (Input)
The password string. This string is converted to a Kerberos key value using the rules for the first encryption type specified by the enctypes parameter. The user is prompted to enter the password if NULL is specified for this parameter.

ccache  (Input)
The credentials cache handle. The initial ticket is stored in the credentials cache for later use by the application. The credentials are not stored if NULL is specified for this parameter.

creds  (Input/Output)
The credentials that are used to obtain the initial ticket. The client and server fields must be set. The endtime field may be set to explicitly specify the ticket lifetime or it may be set to zero to use the default ticket lifetime. The renew_till field must be set if a renewable ticket is being requested. The starttime field must be set if a postdated ticket is being requested.

Upon completion of the request, creds are updated with the initial ticket, the session key, and the client address list. The krb5_free_cred_contents() or krb5_free_creds() routine should be called to release the credentials when they are no longer needed.

ret_as_reply  (Output)
The KDC reply. Specify NULL for this parameter if the KDC reply is not needed. The krb5_free_kdc_rep() routine should be called to release the reply when it is no longer needed.

Return Value

If no errors occur, the return value is 0. Otherwise, a Kerberos error code is returned.


Error Messages



API introduced: V5R1

[ Back to top | Security APIs | UNIX-Type APIs | APIs by category ]