Kerberos 5 Library (libkrb5, -lkrb5)

krb5_context context krb5_get_init_creds_opt **opt krb5_get_init_creds_opt *opt krb5_get_init_creds_opt *opt krb5_get_init_creds_opt *opt krb5_addresses *addresses krb5_get_init_creds_opt *opt int anonymous krb5_context context const char *appname krb5_const_realm realm krb5_get_init_creds_opt *opt krb5_get_init_creds_opt *opt krb5_enctype *etype_list int etype_list_length" krb5_get_init_creds_opt *opt int forwardable krb5_context context krb5_get_init_creds_opt *opt const char *password krb5_s2k_proc key_proc krb5_context context krb5_get_init_creds_opt *opt krb5_boolean req_pac krb5_context context krb5_get_init_creds_opt *opt const char *cert_file const char *key_file const char *x509_anchors int flags char *password krb5_get_init_creds_opt *opt krb5_preauthtype *preauth_list int preauth_list_length krb5_get_init_creds_opt *opt int proxiable krb5_get_init_creds_opt *opt krb5_deltat renew_life krb5_get_init_creds_opt *opt krb5_data *salt krb5_get_init_creds_opt *opt krb5_deltat tkt_life krb5_context context krb5_creds *creds krb5_principal client krb5_prompter_fct prompter void *prompter_data krb5_deltat start_time const char *in_tkt_service krb5_get_init_creds_opt *options krb5_context context krb5_creds *creds krb5_principal client const char *password krb5_prompter_fct prompter void *prompter_data krb5_deltat start_time const char *in_tkt_service krb5_get_init_creds_opt *in_options krb5_context context krb5_creds *creds krb5_principal client krb5_keytab keytab krb5_deltat start_time const char *in_tkt_service krb5_get_init_creds_opt *options krb5_context context void *data const char *name const char *banner int num_prompts krb5_prompt prompts[]

Getting initial credential ticket for a principal. That may include changing an expired password, and doing preauthentication. This interface that replaces the deprecated krb5_in_tkt and krb5_in_cred functions.

If you only to verify a user and password, consider using krb5_verify_user() instead, since it also verifies that initial credentials with using a keytab to make sure the response was from the KDC.

First a krb5_get_init_creds_opt structure is initialized with krb5_get_init_creds_opt_alloc or krb5_get_init_creds_opt_init . krb5_get_init_creds_opt_alloc allocates a extendible structures that needs to be freed with krb5_get_init_creds_opt_free . The structure modified by the any of the krb5_get_init_creds_opt_set functions to change request parameters and authentication information.

If the caller want to use the default options, NULL can be passed instead.

The the actual request to the KDC is done by any of the krb5_get_init_creds , krb5_get_init_creds_password , or krb5_get_init_creds_keytab functions. krb5_get_init_creds is the least specialized function and can, with the right in data, behave like the later two. The later two are there for compatibly with older releases and that they are slightly easier to use.

krb5_prompt is a structure containing the following elements: typedef struct { const char *prompt; int hidden; krb5_data *reply; krb5_prompt_type type } krb5_prompt;

prompt is the prompt that should shown to the user If hidden is set, the prompter function shouldn't echo the output to the display device. reply must be preallocated, it will not be allocated in by the prompter function. Possible values for the type element are:

KRB5_PROMPT_TYPE_PASSWORD

KRB5_PROMPT_TYPE_NEW_PASSWORD

KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN

KRB5_PROMPT_TYPE_PREAUTH

krb5_prompter_posix is a the default prompter function in a posix environment. It matches the krb5_prompter_fct and can be used in the krb5_get_init_creds functions. krb5_prompter_posix doesn't require prompter_data.

If the start_time is zero, then the requested ticket will be valid beginning immediately. Otherwise, the start_time indicates how far in the future the ticket should be postdated.

If the in_tkt_service name is non-NULL , that principal name will be used as the server name for the initial ticket request. The realm of the name specified will be ignored and will be set to the realm of the client name. If no in_tkt_service name is specified, krbtgt/CLIENT-REALM@CLIENT-REALM will be used.

For the rest of arguments, a configuration or library default will be used if no value is specified in the options structure.

krb5_get_init_creds_opt_set_address_list sets the list of addresses that is should be stored in the ticket.

krb5_get_init_creds_opt_set_anonymous make the request anonymous if the anonymous parameter is non-zero.

krb5_get_init_creds_opt_set_default_flags sets the default flags using the configuration file.

krb5_get_init_creds_opt_set_etype_list set a list of enctypes that the client is willing to support in the request.

krb5_get_init_creds_opt_set_forwardable request a forwardable ticket.

krb5_get_init_creds_opt_set_pa_password set the password and key_proc that is going to be used to get a new ticket. password or key_proc can be NULL if the caller what to use the default values. If the password is unset and needed, the use will be prompted for it.

krb5_get_init_creds_opt_set_paq_request sets the password that is going to be used to get a new ticket.

krb5_get_init_creds_opt_set_preauth_list sets the list of client supported preauth types.

krb5_get_init_creds_opt_set_proxiable makes the request proxiable.

krb5_get_init_creds_opt_set_rewew_life sets the requested renewable lifetime.

krb5_get_init_creds_opt_set_salt sets that that is going to be used in the request.

krb5_get_init_creds_opt_set_tkt_life sets requested ticket lifetime.