diff options
Diffstat (limited to 'lib/gssapi/gssapi.cat3')
| -rw-r--r-- | lib/gssapi/gssapi.cat3 | 55 |
1 files changed, 27 insertions, 28 deletions
diff --git a/lib/gssapi/gssapi.cat3 b/lib/gssapi/gssapi.cat3 index 82901ad0efbd..701dd4264c0a 100644 --- a/lib/gssapi/gssapi.cat3 +++ b/lib/gssapi/gssapi.cat3 @@ -1,13 +1,12 @@ - GSSAPI(3) BSD Library Functions Manual GSSAPI(3) -NNAAMMEE - ggssssaappii -- Generic Security Service Application Program Interface library +[1mNAME[0m + [1mgssapi [22m-- Generic Security Service Application Program Interface library -LLIIBBRRAARRYY +[1mLIBRARY[0m GSS-API Library (libgssapi, -lgssapi) -DDEESSCCRRIIPPTTIIOONN +[1mDESCRIPTION[0m The Generic Security Service Application Program Interface (GSS-API) pro- vides security services to callers in a generic fashion, supportable with a range of underlying mechanisms and technologies and hence allowing @@ -16,10 +15,10 @@ DDEESSCCRRIIPPTTIIOONN The GSS-API implementation in Heimdal implements the Kerberos 5 and the SPNEGO GSS-API security mechanisms. -LLIISSTT OOFF FFUUNNCCTTIIOONNSS - These functions constitute the gssapi library, _l_i_b_g_s_s_a_p_i. Declarations - for these functions may be obtained from the include file _g_s_s_a_p_i_._h. - NNaammee//PPaaggee +[1mLIST OF FUNCTIONS[0m + These functions constitute the gssapi library, [4mlibgssapi[24m. Declarations + for these functions may be obtained from the include file [4mgssapi.h[24m. + [1mName/Page[0m gss_accept_sec_context(3) gss_acquire_cred(3) gss_add_cred(3) @@ -64,52 +63,52 @@ LLIISSTT OOFF FFUUNNCCTTIIOONNSS gss_wrap(3) gss_wrap_size_limit(3) -CCOOMMPPAATTIIBBIILLIITTYY - The HHeeiimmddaall GSS-API implementation had a bug in releases before 0.6 that +[1mCOMPATIBILITY[0m + The [1mHeimdal [22mGSS-API implementation had a bug in releases before 0.6 that made it fail to inter-operate when using DES3 with other GSS-API imple- - mentations when using ggssss__ggeett__mmiicc() / ggssss__vveerriiffyy__mmiicc(). It is possible - to modify the behavior of the generator of the MIC with the _k_r_b_5_._c_o_n_f + mentations when using [1mgss_get_mic[22m() / [1mgss_verify_mic[22m(). It is possible + to modify the behavior of the generator of the MIC with the [4mkrb5.conf[0m configuration file so that old clients/servers will still work. New clients/servers will try both the old and new MIC in Heimdal 0.6. In - 0.7 it will check only if configured - the compatibility code will be - removed in 0.8. + 0.7 it will check only if configured - the compatibility code will be re- + moved in 0.8. Heimdal 0.6 still generates by default the broken GSS-API DES3 mic, this will change in 0.7 to generate correct des3 mic. To turn on compatibility with older clients and servers, change the - [[ggssssaappii]] _b_r_o_k_e_n___d_e_s_3___m_i_c in _k_r_b_5_._c_o_n_f that contains a list of globbing + [1m[gssapi] [4m[22mbroken_des3_mic[24m in [4mkrb5.conf[24m that contains a list of globbing expressions that will be matched against the server name. To turn off - generation of the old (incompatible) mic of the MIC use [[ggssssaappii]] - _c_o_r_r_e_c_t___d_e_s_3___m_i_c. + generation of the old (incompatible) mic of the MIC use [1m[gssapi][0m + [4mcorrect_des3_mic[24m. - If a match for a entry is in both [[ggssssaappii]] _c_o_r_r_e_c_t___d_e_s_3___m_i_c and [[ggssssaappii]] - _b_r_o_k_e_n___d_e_s_3___m_i_c, the later will override. + If a match for a entry is in both [1m[gssapi] [4m[22mcorrect_des3_mic[24m and [1m[gssapi][0m + [4mbroken_des3_mic[24m, the later will override. This config option modifies behaviour for both clients and servers. Microsoft implemented SPNEGO to Windows2000, however, they managed to get - it wrong, their implementation didn't fill in the MechListMIC in the - reply token with the right content. There is a work around for this - problem, but not all implementation support it. + it wrong, their implementation didn't fill in the MechListMIC in the re- + ply token with the right content. There is a work around for this prob- + lem, but not all implementation support it. Heimdal defaults to correct SPNEGO when the the kerberos implementation uses CFX, or when it is configured by the user. To turn on compatibility - with peers, use option [[ggssssaappii]] _r_e_q_u_i_r_e___m_e_c_h_l_i_s_t___m_i_c. + with peers, use option [1m[gssapi] [4m[22mrequire_mechlist_mic[24m. -EEXXAAMMPPLLEESS +[1mEXAMPLES[0m [gssapi] broken_des3_mic = cvs/*@SU.SE broken_des3_mic = host/*@E.KTH.SE correct_des3_mic = host/*@SU.SE require_mechlist_mic = host/*@SU.SE -BBUUGGSS - All of 0.5.x versions of hheeiimmddaall had broken token delegations in the +[1mBUGS[0m + All of 0.5.x versions of [1mheimdal [22mhad broken token delegations in the client side, the server side was correct. -SSEEEE AALLSSOO +[1mSEE ALSO[0m krb5(3), krb5.conf(5), kerberos(8) BSD April 20, 2005 BSD |