| Skip Navigation Links | |
| Exit Print View | |
|
Developer's Guide to Oracle Solaris 11 Security Oracle Solaris 11.1 Information Library |
| Skip Navigation Links | |
| Exit Print View | |
|
|
Developer's Guide to Oracle Solaris 11 Security Oracle Solaris 11.1 Information Library |
1. Oracle Solaris Security for Developers (Overview)
2. Developing Privileged Applications
3. Writing PAM Applications and Services
4. Writing Applications That Use GSS-API
GSSAPI Server Example: main() Function
Signing and Returning the Message
Using the test_import_export_context() Function
Cleanup in the GSSAPI Server Example
7. Writing Applications That Use SASL
8. Introduction to the Oracle Solaris Cryptographic Framework
9. Writing User-Level Cryptographic Applications
10. Introduction to the Oracle Solaris Key Management Framework
A. Secure Coding Guidelines for Developers
B. Sample C-Based GSS-API Programs
The sample server-side program gss-server works in conjunction with gss-client, which is described in the previous chapter. The basic purpose of gss-server is to receive, sign, and return the wrapped message from gssapi-client.
The following sections provide a step-by-step description of how gss-server works. Because gss-server is a sample program for demonstrating GSSAPI functionality, only relevant parts of the program are discussed in detail. The complete source code for the two applications appears in the appendix and can be downloaded from the Oracle download center. See http://www.oracle.com/technetwork/indexes/downloads/sdlc-decommission-333274.html.
The gss-structure application performs the following steps:
Parses the command line.
If a mechanism is specified, translates the mechanism name to internal format.
Acquires credentials for the caller.
Checks to see whether the user has specified using the inetd daemon for connecting.
Makes a connection with the client.
Receives the data from the client.
Signs and returns the data.
Releases namespaces and exits.
gss-server takes this form on the command line
gss-server [-port port] [-verbose] [-inetd] [-once] [-logfile file] \
[-mech mechanism] service-name
port is the port number to listen on. If no port is specified, the program uses port 4444 as the default.
-verbose causes messages to be displayed as gss-server runs.
-inetd indicates that the program should use the inetd daemon to listen to a port. -inetd uses stdin and stdout to connect to the client.
-once indicates a single-instance connection only.
mechanism is the name of a security mechanism to use, such as Kerberos v5. If no mechanism is specified, the GSS-API uses a default mechanism.
service-name is the name of the network service that is requested by the client, such as telnet, ftp, or login service.
A typical command line might look like the following example:
% gss-server -port 8080 -once -mech kerberos_v5 erebos.eng nfs "hello"
|