Projects/Export import cred - Revision history

Ghudson at 23:30, 17 September 2012

2012-09-17T23:30:51Z

Ghudson at 16:36, 3 September 2012

2012-09-03T16:36:57Z

Ghudson at 16:20, 3 September 2012

2012-09-03T16:20:35Z

Ghudson at 16:18, 3 September 2012

2012-09-03T16:18:58Z

Ghudson at 12:33, 6 July 2012

2012-07-06T12:33:03Z

Ghudson: /* Token format */

2012-05-31T15:58:10Z

‎Token format

Ghudson: New page: {{project-early}} This project is to add gss_export_cred and gss_import_cred extensions. == Requirements == The [https://fedorahosted.org/gss-proxy GSS-Proxy project] allows GSS operati...

2012-05-25T17:25:40Z

New page: {{project-early}} This project is to add gss_export_cred and gss_import_cred extensions. == Requirements == The [https://fedorahosted.org/gss-proxy GSS-Proxy project] allows GSS operati...

New page

{{project-early}}

This project is to add gss_export_cred and gss_import_cred extensions.

== Requirements ==

The [https://fedorahosted.org/gss-proxy GSS-Proxy project] allows GSS operations to be proxied through a daemon. The proxy daemon can be much more robust if it is stateless. To achieve statelessness, the daemon must be able to respond to a caller's gss_acquire_cred() call with an object containing the actual credential information (or a reference to its on-disk representation). For this, we need a way to serialize and deserialize a GSS credential object.

There are two pieces of prior work in this area: an expired internet draft from 2003(draft-engert-ggf-gss-extensions-00) and a Heimdal implementation. The Heimdal API signatures do not match the draft's proposal (Heimdal's signatures are much simpler). We will follow Heimdal's API rather than the draft's. However, we are not required to match Heimdal's token format.

== API extensions ==

The GSS extensions to be implemented are:

OM_uint32 gss_export_cred(OM_uint32 *minor_status, gss_cred_id_t cred_handle,
gss_buffer_t token);

OM_uint32 gss_import_cred(OM_uint32 *minor_status, gss_buffer_t token,
gss_cred_id_t *cred_handle);

A mechglue credential containing multiple mech credentials exports to a token containing all of the serialized mech credentials, each tagged so that it can be imported by the proper mechanism. If any of the mechanisms cannot export its mech credential, exporting the mechglue credential fails.

== Token format ==

TODO:

1. Specify mechglue token format

2. Specify SPNEGO token format as mechglue token format

3. Specify krb5 token format

NOTES:

* Heimdal's mechglue token format is <mech oid><mech token> repeated for each mech, where the mech oid and mech token are each represented as a four-byte length followed by the content.

* Heimdal's krb5 token format begins with a four-byte tag which is 0 for a memory ccache and 1 for anything else. If the tag is 0, it is followed by a serialization of the TGT from the cache (the serialization is performed by krb5_store_creds() and krb5_ret_creds()). If the tag is 1, it is followed by the full name of the ccache, which is assumed to be in external storage.

== Design ==

TODO: outline code alterations

== Testing ==

== Documentation ==

== Release notes ==

← Older revision		Revision as of 23:30, 17 September 2012
Line 1:		Line 1:
−	{{project-~~review~~\|~~2012-09-14~~}}	+	{{project-rel\|1.11}}
−	{{project-target\|1.11}}

	This project is to add gss_export_cred and gss_import_cred extensions.		This project is to add gss_export_cred and gss_import_cred extensions.

← Older revision		Revision as of 16:36, 3 September 2012
Line 70:		Line 70:

	gssapi.rst will be amended to document the new extension.		gssapi.rst will be amended to document the new extension.
		+
		+	== Mailing list discussions ==
		+
		+	* http://mailman.mit.edu/pipermail/krbdev/2012-May/010859.html
		+	* http://mailman.mit.edu/pipermail/krbdev/2012-September/011216.html

	== Release notes ==		== Release notes ==

← Older revision		Revision as of 16:20, 3 September 2012
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-review\|2012-09-14}}
	{{project-target\|1.11}}		{{project-target\|1.11}}

← Older revision		Revision as of 12:33, 6 July 2012
Line 1:		Line 1:
	{{project-early}}		{{project-early}}
		+	{{project-target\|1.11}}

	This project is to add gss_export_cred and gss_import_cred extensions.		This project is to add gss_export_cred and gss_import_cred extensions.

@@ Line 24: / Line 24: @@
 == Token format ==
-. Specify SPNEGO token format as mechglue token format
+A SPNEGO mechanism token will be the mechglue token for SPNEGO's underlying mechglue cred.
 == Design ==
 == Testing ==
 == Documentation ==
 == Release notes ==

@@ Line 35: / Line 35: @@
 * Heimdal's mechglue token format is <mech oid><mech token> repeated for each mech, where the mech oid and mech token are each represented as a four-byte length followed by the content.
-* Heimdal's krb5 token format begins with a four-byte tag which is 0 for a memory ccache and 1 for anything else.  If the tag is 0, it is followed by a serialization of the TGT from the cache (the serialization is performed by krb5_store_creds() and krb5_ret_creds()).  If the tag is 1, it is followed by the full name of the ccache, which is assumed to be in external storage.
+* Heimdal's krb5 token format begins with a four-byte tag which is 0 for a memory ccache and 1 for anything else.  If the tag is 0, it is followed by a serialization of the TGT from the cache (the serialization is performed by krb5_store_creds() and krb5_ret_creds()).  If the tag is 1, it is followed by the full name of the ccache, which is assumed to be in external storage.  Only initiator creds are supported.
 == Design ==