Skip Navigation Links | |
Exit Print View | |
Developer's Guide to Oracle Solaris 11 Security Oracle Solaris 11.1 Information Library |
1. Oracle Solaris Security for Developers (Overview)
2. Developing Privileged Applications
3. Writing PAM Applications and Services
4. Writing Applications That Use GSS-API
7. Writing Applications That Use SASL
8. Introduction to the Oracle Solaris Cryptographic Framework
9. Writing User-Level Cryptographic Applications
10. Introduction to the Oracle Solaris Key Management Framework
A. Secure Coding Guidelines for Developers
B. Sample C-Based GSS-API Programs
Functions From Previous Versions of GSS-API
Functions for Manipulating OIDs
GSS-API Major Status Code Values
Implementation-Specific Features in GSS-API
Oracle Solaris-Specific Functions
Implementations of Selected Data Types
Deletion of Contexts and Stored Data
Protection of Channel-Binding Information
Context Exportation and Interprocess Tokens
Types of Credentials Supported
Wrap Size Limits and QOP Values
Messages Returned in Kerberos v5 for Status Code 1
Messages Returned in Kerberos v5 for Status Code 2
Messages Returned in Kerberos v5 for Status Code 3
Messages Returned in Kerberos v5 for Status Code 4
Messages Returned in Kerberos v5 for Status Code 5
Messages Returned in Kerberos v5 for Status Code 6
Messages Returned in Kerberos v5 for Status Code 7
This section describes various types of GSS-API data types and values. Some data types, such as gss_cred_id_t or gss_name_t, are opaque to the user. These data types do not need to be discussed. This section explains the following topics:
Basic GSS-API Data Types – Shows the definitions of the OM_uint32, gss_buffer_desc, gss_OID_desc, gss_OID_set_desc_struct, and gss_channel_bindings_struct data types.
Name Types – Shows the various name formats recognized by the GSS-API for specifying names.
Address Types for Channel Bindings – Shows the various values that can be used as the initiator_addrtype and acceptor_addrtype fields of the gss_channel_bindings_t structure.
This section describes data types that are used by GSS-API.
The OM_uint32 is a platform-independent 32–bit unsigned integer.
The definition of the gss_buffer_desc with the gss_buffer_t pointer takes the following form:
typedef struct gss_buffer_desc_struct { size_t length; void *value; } gss_buffer_desc, *gss_buffer_t;
The definition of the gss_OID_desc with the gss_OID pointer takes the following form:
typedef struct gss_OID_desc_struct { OM_uint32 length; void*elements; } gss_OID_desc, *gss_OID;
The definition of the gss_OID_set_desc with the gss_OID_set pointer takes the following form:
typedef struct gss_OID_set_desc_struct { size_t count; gss_OID elements; } gss_OID_set_desc, *gss_OID_set;
The definition of the gss_channel_bindings_struct structure and the gss_channel_bindings_t pointer has the following form:
typedef struct gss_channel_bindings_struct { OM_uint32 initiator_addrtype; gss_buffer_desc initiator_address; OM_uint32 acceptor_addrtype; gss_buffer_desc acceptor_address; gss_buffer_desc application_data; } *gss_channel_bindings_t;
A name type indicates the format of the associated name. See Names in GSS-API and GSS-API OIDs for more on names and name types. The GSS-API supports the gss_OID name types in the following table.
The symbolic name GSS_C_NO_NAME is recommended as a parameter value to indicate that no value is supplied in the transfer of names.
This value corresponds to a null input value instead of an actual object identifier. Where specified, the value indicates interpretation of an associated name that is based on a mechanism-specific default printable syntax.
A means to identify anonymous names. This value can be compared with to determine in a mechanism-independent fashion whether a name refers to an anonymous principal.
A name that has been exported with the gss_export_name() function.
Used to represent services that are associated with host computers. This name form is constructed using two elements, service and hostname, as follows: service@hostname.
Used to indicate a numeric user identifier corresponding to a user on a local system. The interpretation of this value is OS-specific. The gss_import_name() function resolves this UID into a user name, which is then treated as the User Name Form.
Used to indicate a string of digits that represents the numeric user identifier of a user on a local system. The interpretation of this value is OS-specific. This name type is similar to the Machine UID Form, except that the buffer contains a string that represents the user ID.
A named user on a local system. The interpretation of this value is OS-specific. The value takes the form: username.
The following table shows the possible values for the initiator_addrtype and acceptor_addrtype fields of the gss_channel_bindings_struct structure. These fields indicate the format that a name can take, for example, ARPAnet IMP address or AppleTalk address. Channel bindings are discussed in Using Channel Bindings in GSS-API.
Table C-4 Channel Binding Address Types
|