krb5: Import MIT 1.21.3 - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
committer	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
commit	8f7d3ef26dec89a92ec0665de84a5936310a5574 (patch)
tree	9a465418bd4056bf0d369751320a414eaed29fa4 /doc/html/basic/ccache_def.html
parent	1a79b20663ca26acc2998b90ea2ff2aefd8af5b1 (diff)

Diffstat (limited to 'doc/html/basic/ccache_def.html')

-rw-r--r--

doc/html/basic/ccache_def.html

136

1 files changed, 63 insertions, 73 deletions

diff --git a/doc/html/basic/ccache_def.html b/doc/html/basic/ccache_def.html
index c26b3f54a539..9728a8b550db 100644
--- a/doc/html/basic/ccache_def.html
+++ b/doc/html/basic/ccache_def.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>Credential cache — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../_static/jquery.js"></script>

- <script type="text/javascript" src="../_static/underscore.js"></script>

- <script type="text/javascript" src="../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../_static/kerb.css" />

+ <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>

+ <script src="../_static/jquery.js"></script>

+ <script src="../_static/underscore.js"></script>

+ <script src="../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,7 +52,7 @@

- <div class="section" id="credential-cache">

+ <section id="credential-cache">

<span id="ccache-definition"></span><h1>Credential cache<a class="headerlink" href="#credential-cache" title="Permalink to this headline">¶</a></h1>

<p>A credential cache (or “ccache”) holds Kerberos credentials while they

remain valid and, generally, while the user’s session lasts, so that

@@ -82,7 +73,7 @@ principal name (which, in some ccache types, need not be the same as

the default), lifetime information, and flags, along with the

credential itself. There are also other entries, indicated by special

names, that store additional information.</p>

-<div class="section" id="ccache-types">

+<section id="ccache-types">

<h2>ccache types<a class="headerlink" href="#ccache-types" title="Permalink to this headline">¶</a></h2>

<p>The credential cache interface, like the <a class="reference internal" href="keytab_def.html#keytab-definition"><span class="std std-ref">keytab</span></a> and

<a class="reference internal" href="rcache_def.html#rcache-definition"><span class="std std-ref">replay cache</span></a> interfaces, uses <cite>TYPE:value</cite> strings to

@@ -93,11 +84,10 @@ Kerberos library. Not all are supported on every platform. In most

cases, it should be correct to use the default type built into the

library.</p>

-<li><p class="first"><strong>API</strong> is only implemented on Windows. It communicates with a

+<li><p><strong>API</strong> is only implemented on Windows. It communicates with a

server process that holds the credentials in memory for the user,

-rather than writing them to disk.</p>

-</li>

-<li><p class="first"><strong>DIR</strong> points to the storage location of the collection of the

+rather than writing them to disk.</p></li>

+<li><p><strong>DIR</strong> points to the storage location of the collection of the

credential caches in <em>FILE:</em> format. It is most useful when dealing

with multiple Kerberos realms and KDCs. For release 1.10 the

directory must already exist. In post-1.10 releases the

@@ -106,20 +96,19 @@ process must have permissions to create the directory if it does

not exist. See <a class="reference internal" href="#col-ccache"><span class="std std-ref">Collections of caches</span></a> for details. New in release 1.10.

The following residual forms are supported:</p>

-<li>DIR:dirname</li>

-<li>DIR::dirpath/filename - a single cache within the directory</li>

+<li><p>DIR:dirname</p></li>

+<li><p>DIR::dirpath/filename - a single cache within the directory</p></li>

</ul>

<p>Switching to a ccache of the latter type causes it to become the

primary for the directory.</p>

</li>

-<li><p class="first"><strong>FILE</strong> caches are the simplest and most portable. A simple flat

+<li><p><strong>FILE</strong> caches are the simplest and most portable. A simple flat

file format is used to store one credential after another. This is

-the default ccache type if no type is specified in a ccache name.</p>

-</li>

-<li><p class="first"><strong>KCM</strong> caches work by contacting a daemon process called <code class="docutils literal"><span class="pre">kcm</span></code>

-to perform cache operations. If the cache name is just <code class="docutils literal"><span class="pre">KCM:</span></code>,

+the default ccache type if no type is specified in a ccache name.</p></li>

+<li><p><strong>KCM</strong> caches work by contacting a daemon process called <code class="docutils literal notranslate"><span class="pre">kcm</span></code>

+to perform cache operations. If the cache name is just <code class="docutils literal notranslate"><span class="pre">KCM:</span></code>,

the default cache as determined by the KCM daemon will be used.

-Newly created caches must generally be named <code class="docutils literal"><span class="pre">KCM:uid:name</span></code>,

+Newly created caches must generally be named <code class="docutils literal notranslate"><span class="pre">KCM:uid:name</span></code>,

where <em>uid</em> is the effective user ID of the running process.</p>

<p>KCM client support is new in release 1.13. A KCM daemon has not

yet been implemented in MIT krb5, but the client will interoperate

@@ -128,41 +117,39 @@ provides a KCM daemon as part of the operating system, and the

<strong>KCM</strong> cache type is used as the default cache on that platform in

a default build.</p>

</li>

-<li><p class="first"><strong>KEYRING</strong> is Linux-specific, and uses the kernel keyring support

+<li><p><strong>KEYRING</strong> is Linux-specific, and uses the kernel keyring support

to store credential data in unswappable kernel memory where only

the current user should be able to access it. The following

residual forms are supported:</p>

-<li>KEYRING:name</li>

-<li>KEYRING:process:name - process keyring</li>

-<li>KEYRING:thread:name - thread keyring</li>

+<li><p>KEYRING:name</p></li>

+<li><p>KEYRING:process:name - process keyring</p></li>

+<li><p>KEYRING:thread:name - thread keyring</p></li>

</ul>

<p>Starting with release 1.12 the <em>KEYRING</em> type supports collections.

The following new residual forms were added:</p>

-<li>KEYRING:session:name - session keyring</li>

-<li>KEYRING:user:name - user keyring</li>

-<li>KEYRING:persistent:uidnumber - persistent per-UID collection.

+<li><p>KEYRING:session:name - session keyring</p></li>

+<li><p>KEYRING:user:name - user keyring</p></li>

+<li><p>KEYRING:persistent:uidnumber - persistent per-UID collection.

Unlike the user keyring, this collection survives after the user

logs out, until the cache credentials expire. This type of

ccache requires support from the kernel; otherwise, it will fall

-back to the user keyring.</li>

+back to the user keyring.</p></li>

</ul>

<p>See <a class="reference internal" href="#col-ccache"><span class="std std-ref">Collections of caches</span></a> for details.</p>

</li>

-<li><p class="first"><strong>MEMORY</strong> caches are for storage of credentials that don’t need to

+<li><p><strong>MEMORY</strong> caches are for storage of credentials that don’t need to

be made available outside of the current process. For example, a

memory ccache is used by <a class="reference internal" href="../admin/admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> to store the

administrative ticket used to contact the admin server. Memory

ccaches are faster than file ccaches and are automatically

-destroyed when the process exits.</p>

-</li>

-<li><p class="first"><strong>MSLSA</strong> is a Windows-specific cache type that accesses the

-Windows credential store.</p>

-</li>

+destroyed when the process exits.</p></li>

+<li><p><strong>MSLSA</strong> is a Windows-specific cache type that accesses the

+Windows credential store.</p></li>

</ol>

-</div>

-<div class="section" id="collections-of-caches">

+</section>

+<section id="collections-of-caches">

<span id="col-ccache"></span><h2>Collections of caches<a class="headerlink" href="#collections-of-caches" title="Permalink to this headline">¶</a></h2>

<p>Some credential cache types can support collections of multiple

caches. One of the caches in the collection is designated as the

@@ -176,43 +163,45 @@ the target service realm.</p>

from the <strong>DIR</strong> and <strong>API</strong> ccache types. Starting in release 1.12,

collections are also supported by the <strong>KEYRING</strong> ccache type.

Collections are supported by the <strong>KCM</strong> ccache type in release 1.13.</p>

-<div class="section" id="tool-alterations-to-use-cache-collection">

+<section id="tool-alterations-to-use-cache-collection">

<h3>Tool alterations to use cache collection<a class="headerlink" href="#tool-alterations-to-use-cache-collection" title="Permalink to this headline">¶</a></h3>

-<li><a class="reference internal" href="../user/user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a> <em>-A</em> will destroy all caches in the collection.</li>

-<li>If the default cache type supports switching, <a class="reference internal" href="../user/user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>

+<li><p><a class="reference internal" href="../user/user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a> <em>-A</em> will destroy all caches in the collection.</p></li>

+<li><p>If the default cache type supports switching, <a class="reference internal" href="../user/user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>

<em>princname</em> will search the collection for a matching cache and

store credentials there, or will store credentials in a new unique

cache of the default type if no existing cache for the principal

-exists. Either way, kinit will switch to the selected cache.</li>

-<li><a class="reference internal" href="../user/user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a> <em>-l</em> will list the caches in the collection.</li>

-<li><a class="reference internal" href="../user/user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a> <em>-A</em> will show the content of all caches in the

-collection.</li>

-<li><a class="reference internal" href="../user/user_commands/kswitch.html#kswitch-1"><span class="std std-ref">kswitch</span></a> <em>-p princname</em> will search the collection for a

-matching cache and switch to it.</li>

-<li><a class="reference internal" href="../user/user_commands/kswitch.html#kswitch-1"><span class="std std-ref">kswitch</span></a> <em>-c cachename</em> will switch to a specified cache.</li>

+exists. Either way, kinit will switch to the selected cache.</p></li>

+<li><p><a class="reference internal" href="../user/user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a> <em>-l</em> will list the caches in the collection.</p></li>

+<li><p><a class="reference internal" href="../user/user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a> <em>-A</em> will show the content of all caches in the

+collection.</p></li>

+<li><p><a class="reference internal" href="../user/user_commands/kswitch.html#kswitch-1"><span class="std std-ref">kswitch</span></a> <em>-p princname</em> will search the collection for a

+matching cache and switch to it.</p></li>

+<li><p><a class="reference internal" href="../user/user_commands/kswitch.html#kswitch-1"><span class="std std-ref">kswitch</span></a> <em>-c cachename</em> will switch to a specified cache.</p></li>

</ul>

-</div>

-<div class="section" id="default-ccache-name">

+</section>

+<section id="default-ccache-name">

<h2>Default ccache name<a class="headerlink" href="#default-ccache-name" title="Permalink to this headline">¶</a></h2>

<p>The default credential cache name is determined by the following, in

descending order of priority:</p>

-<li>The <strong>KRB5CCNAME</strong> environment variable. For example,

-<code class="docutils literal"><span class="pre">KRB5CCNAME=DIR:/mydir/</span></code>.</li>

-<li>The <strong>default_ccache_name</strong> profile variable in <a class="reference internal" href="../admin/conf_files/krb5_conf.html#libdefaults"><span class="std std-ref">[libdefaults]</span></a>.</li>

-<li>The hardcoded default, <a class="reference internal" href="../mitK5defaults.html#paths"><span class="std std-ref">DEFCCNAME</span></a>.</li>

+<li><p>The <strong>KRB5CCNAME</strong> environment variable. For example,

+<code class="docutils literal notranslate"><span class="pre">KRB5CCNAME=DIR:/mydir/</span></code>.</p></li>

+<li><p>The <strong>default_ccache_name</strong> profile variable in <a class="reference internal" href="../admin/conf_files/krb5_conf.html#libdefaults"><span class="std std-ref">[libdefaults]</span></a>.</p></li>

+<li><p>The hardcoded default, <a class="reference internal" href="../mitK5defaults.html#paths"><span class="std std-ref">DEFCCNAME</span></a>.</p></li>

</ol>

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">Credential cache</a><ul>

@@ -258,6 +247,7 @@ descending order of priority:</p>

</form>

</div>

</div>

@@ -265,8 +255,8 @@ descending order of priority:</p>

- <div class="right" ><i>Release: 1.21.2</i><br />

+ <div class="right" ><i>Release: 1.21.3</i><br />

</div>