All,
Request for help, i'm using gssapi client API to initiate sec context
using kerberos tickets in file cache.
1) import client principal
//buffer.sprintf("leema\@pcsqalab....@pcsqalab.net");
//gss_buffer_desc gssBuffer = { buffer.len(), (void*)buffer.str() };
* gss_import_name
(&m_minor,&gssBuffer,GSS_C_NT_USER_NAME,&m_gssUser);*
2)Import service principal
//gssBuffer -> h...@parent-2k16.pcsqalab.net
*gss_import_name(&m_minor,&gssBuffer,GSS_C_NT_HOSTBASED_SERVICE,&m_gssSvc);*
3)acquire client credential handle.
m_major = gss_acquire_cred(&m_minor, m_gssUser, GSS_C_INDEFINITE,
GSS_C_NO_OID_SET, GSS_C_INITIATE,&m_gssUserCred,&oidSet, &m_timeRec);
4) m_major =
gss_acquire_cred(&m_minor,m_gssSvc,GSS_C_INDEFINITE,g_oidSet,GSS_C_INITIATE,
&m_gssSvcCred, &oidSet, &m_timeRec);
5)m_major = gss_init_sec_context(&m_minor, m_gssUserCred, &m_gssContext,
m_gssSvc, &g_spnego_mechanism_desc,
flags,0,GSS_C_NO_CHANNEL_BINDINGS,&gssInput, NULL,&gssOutput,NULL, NULL);
In step 3) I'm getting GSS_S_CREDENTIALS_EXPIRED , the tickets lifetime is
valid.
Please note i'm migrating heimdal gssapi with MIT gssapi. Do i need to
register plugin/call backs , to look for tickets?
tried replacing g_spnego_mechanism_desc, with GSS_C_NO_OID_SET, but didn't
work, what should i do?
Below is the Ticket cache: FILE:/tmp/krb5cc_36073
Default principal: host/pxe-dev.pcsqalab....@pcsqalab.net
Service principals:
krbtgt/pcsqalab....@pcsqalab.net
host/pxeddev.pcsqalab....@pcsqalab.net for client leema\@
pcsqalab....@pcsqalab.net
http/parent-2k16.pcsqalab....@pcsqalab.net for client leema\@
pcsqalab....@pcsqalab.net
Thanks
Santosh
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
