KRB5_MK_REQ(3)

KRB5_MK_REQ(3) | Library Functions Manual | KRB5_MK_REQ(3)

# NAME

`krb5_mk_req`, `krb5_mk_req_exact`, `krb5_mk_req_extended`, `krb5_rd_req`, `krb5_rd_req_with_keyblock`, `krb5_mk_rep`, `krb5_mk_rep_exact`, `krb5_mk_rep_extended`, `krb5_rd_rep`, `krb5_build_ap_req`, `krb5_verify_ap_req` —
create and read application authentication request

# LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

# SYNOPSIS

`#include <krb5/krb5.h>`

krb5_error_code
`krb5_mk_req`(krb5_context context, krb5_auth_context *auth_context, const krb5_flags ap_req_options, const char *service, const char *hostname, krb5_data *in_data, krb5_ccache ccache, krb5_data *outbuf);

krb5_error_code
`krb5_mk_req_extended`(krb5_context context, krb5_auth_context *auth_context, const krb5_flags ap_req_options, krb5_data *in_data, krb5_creds *in_creds, krb5_data *outbuf);

krb5_error_code
`krb5_rd_req`(krb5_context context, krb5_auth_context *auth_context, const krb5_data *inbuf, krb5_const_principal server, krb5_keytab keytab, krb5_flags *ap_req_options, krb5_ticket **ticket);

krb5_error_code
`krb5_build_ap_req`(krb5_context context, krb5_enctype enctype, krb5_creds *cred, krb5_flags ap_options, krb5_data authenticator, krb5_data *retdata);

krb5_error_code
`krb5_verify_ap_req`(krb5_context context, krb5_auth_context *auth_context, krb5_ap_req *ap_req, krb5_const_principal server, krb5_keyblock *keyblock, krb5_flags flags, krb5_flags *ap_req_options, krb5_ticket **ticket);

# DESCRIPTION

The functions documented in this manual page document the functions that facilitates the exchange between a Kerberos client and server. They are the core functions used in the authentication exchange between the client and the server.

The `krb5_mk_req` and `krb5_mk_req_extended` creates the Kerberos message `KRB_AP_REQ` that is sent from the client to the server as the first packet in a client/server exchange. The result that should be sent to server is stored in outbuf.

auth_context should be allocated with `krb5_auth_con_init`() or `NULL` passed in, in that case, it will be allocated and freed internally.

The input data in_data will have a checksum calculated over it and checksum will be transported in the message to the server.

ap_req_options can be set to one or more of the following flags:

`AP_OPTS_USE_SESSION_KEY`
  Use the session key when creating the request, used for user to user authentication.
`AP_OPTS_MUTUAL_REQUIRED`
  Mark the request as mutual authenticate required so that the receiver returns a mutual authentication packet.

The `krb5_rd_req` read the AP_REQ in inbuf and verify and extract the content. If server is specified, that server will be fetched from the keytab and used unconditionally. If server is `NULL`, the keytab will be search for a matching principal.

The keytab argument specifies what keytab to search for receiving principals. The arguments ap_req_options and ticket returns the content.

When the AS-REQ is a user to user request, neither of keytab or principal are used, instead `krb5_rd_req`() expects the session key to be set in auth_context.

The `krb5_verify_ap_req` and `krb5_build_ap_req` both constructs and verify the AP_REQ message, should not be used by external code.

# SEE ALSO

krb5(3), krb5.conf(5)

August 27, 2005 | NetBSD 9.0