aboutsummaryrefslogtreecommitdiff
path: root/lib/gssapi/gssapi.cat3
diff options
context:
space:
mode:
authorCy Schubert <cy@FreeBSD.org>2023-01-06 20:48:22 +0000
committerCy Schubert <cy@FreeBSD.org>2023-01-06 20:48:22 +0000
commit6f4e10db3298f6d65e1e646fe52aaafc3682b788 (patch)
tree0a8de0ec1173c00886bcde1c3b18e0963e5f2b83 /lib/gssapi/gssapi.cat3
parentd5d1e8b157da7410fe13e6302f8e1bee81320bb5 (diff)
Diffstat (limited to 'lib/gssapi/gssapi.cat3')
-rw-r--r--lib/gssapi/gssapi.cat355
1 files changed, 27 insertions, 28 deletions
diff --git a/lib/gssapi/gssapi.cat3 b/lib/gssapi/gssapi.cat3
index 82901ad0efbd..701dd4264c0a 100644
--- a/lib/gssapi/gssapi.cat3
+++ b/lib/gssapi/gssapi.cat3
@@ -1,13 +1,12 @@
-
GSSAPI(3) BSD Library Functions Manual GSSAPI(3)
-NNAAMMEE
- ggssssaappii -- Generic Security Service Application Program Interface library
+NAME
+ gssapi -- Generic Security Service Application Program Interface library
-LLIIBBRRAARRYY
+LIBRARY
GSS-API Library (libgssapi, -lgssapi)
-DDEESSCCRRIIPPTTIIOONN
+DESCRIPTION
The Generic Security Service Application Program Interface (GSS-API) pro-
vides security services to callers in a generic fashion, supportable with
a range of underlying mechanisms and technologies and hence allowing
@@ -16,10 +15,10 @@ DDEESSCCRRIIPPTTIIOONN
The GSS-API implementation in Heimdal implements the Kerberos 5 and the
SPNEGO GSS-API security mechanisms.
-LLIISSTT OOFF FFUUNNCCTTIIOONNSS
- These functions constitute the gssapi library, _l_i_b_g_s_s_a_p_i. Declarations
- for these functions may be obtained from the include file _g_s_s_a_p_i_._h.
- NNaammee//PPaaggee
+LIST OF FUNCTIONS
+ These functions constitute the gssapi library, libgssapi. Declarations
+ for these functions may be obtained from the include file gssapi.h.
+ Name/Page
gss_accept_sec_context(3)
gss_acquire_cred(3)
gss_add_cred(3)
@@ -64,52 +63,52 @@ LLIISSTT OOFF FFUUNNCCTTIIOONNSS
gss_wrap(3)
gss_wrap_size_limit(3)
-CCOOMMPPAATTIIBBIILLIITTYY
- The HHeeiimmddaall GSS-API implementation had a bug in releases before 0.6 that
+COMPATIBILITY
+ The Heimdal GSS-API implementation had a bug in releases before 0.6 that
made it fail to inter-operate when using DES3 with other GSS-API imple-
- mentations when using ggssss__ggeett__mmiicc() / ggssss__vveerriiffyy__mmiicc(). It is possible
- to modify the behavior of the generator of the MIC with the _k_r_b_5_._c_o_n_f
+ mentations when using gss_get_mic() / gss_verify_mic(). It is possible
+ to modify the behavior of the generator of the MIC with the krb5.conf
configuration file so that old clients/servers will still work.
New clients/servers will try both the old and new MIC in Heimdal 0.6. In
- 0.7 it will check only if configured - the compatibility code will be
- removed in 0.8.
+ 0.7 it will check only if configured - the compatibility code will be re-
+ moved in 0.8.
Heimdal 0.6 still generates by default the broken GSS-API DES3 mic, this
will change in 0.7 to generate correct des3 mic.
To turn on compatibility with older clients and servers, change the
- [[ggssssaappii]] _b_r_o_k_e_n___d_e_s_3___m_i_c in _k_r_b_5_._c_o_n_f that contains a list of globbing
+ [gssapi] broken_des3_mic in krb5.conf that contains a list of globbing
expressions that will be matched against the server name. To turn off
- generation of the old (incompatible) mic of the MIC use [[ggssssaappii]]
- _c_o_r_r_e_c_t___d_e_s_3___m_i_c.
+ generation of the old (incompatible) mic of the MIC use [gssapi]
+ correct_des3_mic.
- If a match for a entry is in both [[ggssssaappii]] _c_o_r_r_e_c_t___d_e_s_3___m_i_c and [[ggssssaappii]]
- _b_r_o_k_e_n___d_e_s_3___m_i_c, the later will override.
+ If a match for a entry is in both [gssapi] correct_des3_mic and [gssapi]
+ broken_des3_mic, the later will override.
This config option modifies behaviour for both clients and servers.
Microsoft implemented SPNEGO to Windows2000, however, they managed to get
- it wrong, their implementation didn't fill in the MechListMIC in the
- reply token with the right content. There is a work around for this
- problem, but not all implementation support it.
+ it wrong, their implementation didn't fill in the MechListMIC in the re-
+ ply token with the right content. There is a work around for this prob-
+ lem, but not all implementation support it.
Heimdal defaults to correct SPNEGO when the the kerberos implementation
uses CFX, or when it is configured by the user. To turn on compatibility
- with peers, use option [[ggssssaappii]] _r_e_q_u_i_r_e___m_e_c_h_l_i_s_t___m_i_c.
+ with peers, use option [gssapi] require_mechlist_mic.
-EEXXAAMMPPLLEESS
+EXAMPLES
[gssapi]
broken_des3_mic = cvs/*@SU.SE
broken_des3_mic = host/*@E.KTH.SE
correct_des3_mic = host/*@SU.SE
require_mechlist_mic = host/*@SU.SE
-BBUUGGSS
- All of 0.5.x versions of hheeiimmddaall had broken token delegations in the
+BUGS
+ All of 0.5.x versions of heimdal had broken token delegations in the
client side, the server side was correct.
-SSEEEE AALLSSOO
+SEE ALSO
krb5(3), krb5.conf(5), kerberos(8)
BSD April 20, 2005 BSD