On this page
Table of contents
- For users
- For administrators
- For application developers
- Developing with GSSAPI
- Differences between Heimdal and MIT Kerberos API
- Principal manipulation and parsing
- Complete reference - API and datatypes
- krb5 API
- krb5 types and structures
- krb5 simple macros
- ADDRTYPE_ADDRPORT
- ADDRTYPE_CHAOS
- ADDRTYPE_DDP
- ADDRTYPE_INET
- ADDRTYPE_INET6
- ADDRTYPE_IPPORT
- ADDRTYPE_ISO
- ADDRTYPE_IS_LOCAL
- ADDRTYPE_NETBIOS
- ADDRTYPE_XNS
- AD_TYPE_EXTERNAL
- AD_TYPE_FIELD_TYPE_MASK
- AD_TYPE_REGISTERED
- AD_TYPE_RESERVED
- AP_OPTS_ETYPE_NEGOTIATION
- AP_OPTS_MUTUAL_REQUIRED - Perform a mutual authentication exchange.
- AP_OPTS_RESERVED
- AP_OPTS_USE_SESSION_KEY - Use session key.
- AP_OPTS_USE_SUBKEY - Generate a subsession key from the current session key obtained from the credentials.
- AP_OPTS_WIRE_MASK
- CKSUMTYPE_CRC32
- CKSUMTYPE_DESCBC
- CKSUMTYPE_HMAC_MD5_ARCFOUR
- CKSUMTYPE_HMAC_SHA1_96_AES128 - RFC 3962.
- CKSUMTYPE_HMAC_SHA1_96_AES256 - RFC 3962.
- CKSUMTYPE_HMAC_SHA1_DES3
- CKSUMTYPE_MD5_HMAC_ARCFOUR
- CKSUMTYPE_NIST_SHA
- CKSUMTYPE_RSA_MD4
- CKSUMTYPE_RSA_MD4_DES
- CKSUMTYPE_RSA_MD5
- CKSUMTYPE_RSA_MD5_DES
- ENCTYPE_AES128_CTS_HMAC_SHA1_96 - RFC 3962.
- ENCTYPE_AES256_CTS_HMAC_SHA1_96 - RFC 3962.
- ENCTYPE_ARCFOUR_HMAC
- ENCTYPE_ARCFOUR_HMAC_EXP
- ENCTYPE_DES3_CBC_ENV - DES-3 cbc mode, CMS enveloped data.
- ENCTYPE_DES3_CBC_RAW
- ENCTYPE_DES3_CBC_SHA
- ENCTYPE_DES3_CBC_SHA1
- ENCTYPE_DES_CBC_CRC - DES cbc mode with CRC-32.
- ENCTYPE_DES_CBC_MD4 - DES cbc mode with RSA-MD4.
- ENCTYPE_DES_CBC_MD5 - DES cbc mode with RSA-MD5.
- ENCTYPE_DES_CBC_RAW
- ENCTYPE_DES_HMAC_SHA1
- ENCTYPE_DSA_SHA1_CMS - DSA with SHA1, CMS signature.
- ENCTYPE_MD5_RSA_CMS - MD5 with RSA, CMS signature.
- ENCTYPE_NULL
- ENCTYPE_RC2_CBC_ENV - RC2 cbc mode, CMS enveloped data.
- ENCTYPE_RSA_ENV - RSA encryption, CMS enveloped data.
- ENCTYPE_RSA_ES_OAEP_ENV - RSA w/OEAP encryption, CMS enveloped data.
- ENCTYPE_SHA1_RSA_CMS - SHA1 with RSA, CMS signature.
- ENCTYPE_UNKNOWN
- KDC_OPT_ALLOW_POSTDATE
- KDC_OPT_CANONICALIZE
- KDC_OPT_CNAME_IN_ADDL_TKT
- KDC_OPT_DISABLE_TRANSITED_CHECK
- KDC_OPT_ENC_TKT_IN_SKEY
- KDC_OPT_FORWARDABLE
- KDC_OPT_FORWARDED
- KDC_OPT_POSTDATED
- KDC_OPT_PROXIABLE
- KDC_OPT_PROXY
- KDC_OPT_RENEW
- KDC_OPT_RENEWABLE
- KDC_OPT_RENEWABLE_OK
- KDC_OPT_REQUEST_ANONYMOUS
- KDC_OPT_VALIDATE
- KDC_TKT_COMMON_MASK
- KRB5_ALTAUTH_ATT_CHALLENGE_RESPONSE - alternate authentication types
- KRB5_ANONYMOUS_PRINCSTR - Anonymous principal name.
- KRB5_ANONYMOUS_REALMSTR - Anonymous realm.
- KRB5_AP_REP - Response to mutual AP request.
- KRB5_AP_REQ - Auth req to application server.
- KRB5_AS_REP - Response to AS request.
- KRB5_AS_REQ - Initial authentication request.
- KRB5_AUTHDATA_AND_OR
- KRB5_AUTHDATA_ETYPE_NEGOTIATION
- KRB5_AUTHDATA_FX_ARMOR
- KRB5_AUTHDATA_IF_RELEVANT
- KRB5_AUTHDATA_INITIAL_VERIFIED_CAS
- KRB5_AUTHDATA_KDC_ISSUED
- KRB5_AUTHDATA_MANDATORY_FOR_KDC
- KRB5_AUTHDATA_OSF_DCE
- KRB5_AUTHDATA_SESAME
- KRB5_AUTHDATA_SIGNTICKET - formerly 142 in krb5 1.8
- KRB5_AUTHDATA_WIN2K_PAC
- KRB5_AUTH_CONTEXT_DO_SEQUENCE - Prevent replays with sequence numbers.
- KRB5_AUTH_CONTEXT_DO_TIME - Prevent replays with timestamps and replay cache.
- KRB5_AUTH_CONTEXT_GENERATE_LOCAL_ADDR - Generate the local network address.
- KRB5_AUTH_CONTEXT_GENERATE_LOCAL_FULL_ADDR - Generate the local network address and the local port.
- KRB5_AUTH_CONTEXT_GENERATE_REMOTE_ADDR - Generate the remote network address.
- KRB5_AUTH_CONTEXT_GENERATE_REMOTE_FULL_ADDR - Generate the remote network address and the remote port.
- KRB5_AUTH_CONTEXT_PERMIT_ALL
- KRB5_AUTH_CONTEXT_RET_SEQUENCE - Save sequence numbers for application.
- KRB5_AUTH_CONTEXT_RET_TIME - Save timestamps for application.
- KRB5_AUTH_CONTEXT_USE_SUBKEY
- KRB5_CRED - Cred forwarding message.
- KRB5_CRYPTO_TYPE_CHECKSUM - [out] checksum for MIC
- KRB5_CRYPTO_TYPE_DATA - [in, out] plaintext
- KRB5_CRYPTO_TYPE_EMPTY - [in] ignored
- KRB5_CRYPTO_TYPE_HEADER - [out] header
- KRB5_CRYPTO_TYPE_PADDING - [out] padding
- KRB5_CRYPTO_TYPE_SIGN_ONLY - [in] associated data
- KRB5_CRYPTO_TYPE_STREAM - [in] entire message without decomposing the structure into header, data and trailer buffers
- KRB5_CRYPTO_TYPE_TRAILER - [out] checksum for encrypt
- KRB5_CYBERSAFE_SECUREID - Cybersafe.
- KRB5_DOMAIN_X500_COMPRESS - Transited encoding types.
- KRB5_ENCPADATA_REQ_ENC_PA_REP
- KRB5_ERROR - Error response.
- KRB5_FAST_REQUIRED - Require KDC to support FAST.
- KRB5_GC_CACHED - Want cached ticket only.
- KRB5_GC_CANONICALIZE - Set canonicalize KDC option.
- KRB5_GC_CONSTRAINED_DELEGATION - Constrained delegation.
- KRB5_GC_FORWARDABLE - Acquire forwardable tickets.
- KRB5_GC_NO_STORE - Do not store in credential cache.
- KRB5_GC_NO_TRANSIT_CHECK - Disable transited check.
- KRB5_GC_USER_USER - Want user-user ticket.
- KRB5_GET_INIT_CREDS_OPT_ADDRESS_LIST
- KRB5_GET_INIT_CREDS_OPT_ANONYMOUS
- KRB5_GET_INIT_CREDS_OPT_CANONICALIZE
- KRB5_GET_INIT_CREDS_OPT_CHG_PWD_PRMPT
- KRB5_GET_INIT_CREDS_OPT_ETYPE_LIST
- KRB5_GET_INIT_CREDS_OPT_FORWARDABLE
- KRB5_GET_INIT_CREDS_OPT_PREAUTH_LIST
- KRB5_GET_INIT_CREDS_OPT_PROXIABLE
- KRB5_GET_INIT_CREDS_OPT_RENEW_LIFE
- KRB5_GET_INIT_CREDS_OPT_SALT
- KRB5_GET_INIT_CREDS_OPT_TKT_LIFE
- KRB5_INIT_CONTEXT_SECURE - Use secure context configuration.
- KRB5_INIT_CONTEXT_KDC - Use KDC configuration if available.
- KRB5_INIT_CREDS_STEP_FLAG_CONTINUE - More responses needed.
- KRB5_INT16_MAX
- KRB5_INT16_MIN
- KRB5_INT32_MAX
- KRB5_INT32_MIN
- KRB5_KEYUSAGE_AD_ITE
- KRB5_KEYUSAGE_AD_KDCISSUED_CKSUM
- KRB5_KEYUSAGE_AD_MTE
- KRB5_KEYUSAGE_AD_SIGNEDPATH
- KRB5_KEYUSAGE_APP_DATA_CKSUM
- KRB5_KEYUSAGE_APP_DATA_ENCRYPT
- KRB5_KEYUSAGE_AP_REP_ENCPART
- KRB5_KEYUSAGE_AP_REQ_AUTH
- KRB5_KEYUSAGE_AP_REQ_AUTH_CKSUM
- KRB5_KEYUSAGE_AS_REP_ENCPART
- KRB5_KEYUSAGE_AS_REQ
- KRB5_KEYUSAGE_AS_REQ_PA_ENC_TS
- KRB5_KEYUSAGE_ENC_CHALLENGE_CLIENT
- KRB5_KEYUSAGE_ENC_CHALLENGE_KDC
- KRB5_KEYUSAGE_FAST_ENC
- KRB5_KEYUSAGE_FAST_FINISHED
- KRB5_KEYUSAGE_FAST_REP
- KRB5_KEYUSAGE_FAST_REQ_CHKSUM
- KRB5_KEYUSAGE_GSS_TOK_MIC
- KRB5_KEYUSAGE_GSS_TOK_WRAP_INTEG
- KRB5_KEYUSAGE_GSS_TOK_WRAP_PRIV
- KRB5_KEYUSAGE_IAKERB_FINISHED
- KRB5_KEYUSAGE_KDC_REP_TICKET
- KRB5_KEYUSAGE_KRB_CRED_ENCPART
- KRB5_KEYUSAGE_KRB_ERROR_CKSUM
- KRB5_KEYUSAGE_KRB_PRIV_ENCPART
- KRB5_KEYUSAGE_KRB_SAFE_CKSUM
- KRB5_KEYUSAGE_PA_PKINIT_KX
- KRB5_KEYUSAGE_PA_REFERRAL
- KRB5_KEYUSAGE_PA_S4U_X509_USER_REPLY
- KRB5_KEYUSAGE_PA_S4U_X509_USER_REQUEST
- KRB5_KEYUSAGE_PA_SAM_CHALLENGE_CKSUM
- KRB5_KEYUSAGE_PA_SAM_CHALLENGE_TRACKID
- KRB5_KEYUSAGE_PA_SAM_RESPONSE
- KRB5_KEYUSAGE_TGS_REP_ENCPART_SESSKEY
- KRB5_KEYUSAGE_TGS_REP_ENCPART_SUBKEY
- KRB5_KEYUSAGE_TGS_REQ_AD_SESSKEY
- KRB5_KEYUSAGE_TGS_REQ_AD_SUBKEY
- KRB5_KEYUSAGE_TGS_REQ_AUTH
- KRB5_KEYUSAGE_TGS_REQ_AUTH_CKSUM
- KRB5_KPASSWD_ACCESSDENIED
- KRB5_KPASSWD_AUTHERROR - Authentication error.
- KRB5_KPASSWD_BAD_VERSION
- KRB5_KPASSWD_HARDERROR - Server error.
- KRB5_KPASSWD_INITIAL_FLAG_NEEDED
- KRB5_KPASSWD_MALFORMED - Malformed request.
- KRB5_KPASSWD_SOFTERROR - Password change rejected.
- KRB5_KPASSWD_SUCCESS - Success.
- KRB5_LRQ_ALL_ACCT_EXPTIME
- KRB5_LRQ_ALL_LAST_INITIAL
- KRB5_LRQ_ALL_LAST_RENEWAL
- KRB5_LRQ_ALL_LAST_REQ
- KRB5_LRQ_ALL_LAST_TGT
- KRB5_LRQ_ALL_LAST_TGT_ISSUED
- KRB5_LRQ_ALL_PW_EXPTIME
- KRB5_LRQ_NONE
- KRB5_LRQ_ONE_ACCT_EXPTIME
- KRB5_LRQ_ONE_LAST_INITIAL
- KRB5_LRQ_ONE_LAST_RENEWAL
- KRB5_LRQ_ONE_LAST_REQ
- KRB5_LRQ_ONE_LAST_TGT
- KRB5_LRQ_ONE_LAST_TGT_ISSUED
- KRB5_LRQ_ONE_PW_EXPTIME
- KRB5_NT_ENTERPRISE_PRINCIPAL - Windows 2000 UPN.
- KRB5_NT_ENT_PRINCIPAL_AND_ID - NT 4 style name and SID.
- KRB5_NT_MS_PRINCIPAL - Windows 2000 UPN and SID.
- KRB5_NT_MS_PRINCIPAL_AND_ID - NT 4 style name.
- KRB5_NT_PRINCIPAL - Just the name of the principal as in DCE, or for users.
- KRB5_NT_SMTP_NAME - Name in form of SMTP email name.
- KRB5_NT_SRV_HST - Service with host name as instance (telnet, rcommands)
- KRB5_NT_SRV_INST - Service and other unique instance (krbtgt)
- KRB5_NT_SRV_XHST - Service with host as remaining components.
- KRB5_NT_UID - Unique ID.
- KRB5_NT_UNKNOWN - Name type not known.
- KRB5_NT_WELLKNOWN - Well-known (special) principal.
- KRB5_NT_X500_PRINCIPAL - PKINIT.
- KRB5_OLD_CRYPTO
- KRB5_PAC_CLIENT_INFO - Client name and ticket info.
- KRB5_PAC_CREDENTIALS_INFO - Credentials information.
- KRB5_PAC_DELEGATION_INFO - Constrained delegation info.
- KRB5_PAC_LOGON_INFO - Logon information.
- KRB5_PAC_PRIVSVR_CHECKSUM - KDC checksum.
- KRB5_PAC_SERVER_CHECKSUM - Server checksum.
- KRB5_PAC_UPN_DNS_INFO - User principal name and DNS info.
- KRB5_PADATA_AFS3_SALT - Cygnus.
- KRB5_PADATA_AP_REQ
- KRB5_PADATA_ENCRYPTED_CHALLENGE
- KRB5_PADATA_ENC_SANDIA_SECURID - SecurId passcode.
- KRB5_PADATA_ENC_TIMESTAMP
- KRB5_PADATA_ENC_UNIX_TIME - timestamp encrypted in key
- KRB5_PADATA_ETYPE_INFO - Etype info for preauth.
- KRB5_PADATA_ETYPE_INFO2
- KRB5_PADATA_FOR_USER - username protocol transition request
- KRB5_PADATA_FX_COOKIE
- KRB5_PADATA_FX_ERROR
- KRB5_PADATA_FX_FAST
- KRB5_PADATA_GET_FROM_TYPED_DATA
- KRB5_PADATA_NONE
- KRB5_PADATA_OSF_DCE - OSF DCE.
- KRB5_PADATA_PAC_REQUEST - include Windows PAC
- KRB5_PADATA_PKINIT_KX
- KRB5_PADATA_PK_AS_REP - PKINIT.
- KRB5_PADATA_PK_AS_REP_OLD - PKINIT.
- KRB5_PADATA_PK_AS_REQ - PKINIT.
- KRB5_PADATA_PK_AS_REQ_OLD - PKINIT.
- KRB5_PADATA_PW_SALT
- KRB5_PADATA_REFERRAL - draft referral system
- KRB5_PADATA_S4U_X509_USER - certificate protocol transition request
- KRB5_PADATA_SAM_CHALLENGE - draft challenge system
- KRB5_PADATA_SAM_CHALLENGE_2 - draft challenge system, updated
- KRB5_PADATA_SAM_REDIRECT
- KRB5_PADATA_SAM_RESPONSE - draft challenge system response
- KRB5_PADATA_SAM_RESPONSE_2 - draft challenge system, updated
- KRB5_PADATA_SESAME - Sesame project.
- KRB5_PADATA_SVR_REFERRAL_INFO - Windows 2000 referrals.
- KRB5_PADATA_TGS_REQ
- KRB5_PADATA_USE_SPECIFIED_KVNO
- KRB5_PRINCIPAL_COMPARE_CASEFOLD - case-insensitive
- KRB5_PRINCIPAL_COMPARE_ENTERPRISE - UPNs as real principals.
- KRB5_PRINCIPAL_COMPARE_IGNORE_REALM - ignore realm component
- KRB5_PRINCIPAL_COMPARE_UTF8 - treat principals as UTF-8
- KRB5_PRINCIPAL_PARSE_ENTERPRISE - Create single-component enterprise principle.
- KRB5_PRINCIPAL_PARSE_NO_REALM - Error if realm is present.
- KRB5_PRINCIPAL_PARSE_REQUIRE_REALM - Error if realm is not present.
- KRB5_PRINCIPAL_UNPARSE_DISPLAY - Don’t escape special characters.
- KRB5_PRINCIPAL_UNPARSE_NO_REALM - Omit realm always.
- KRB5_PRINCIPAL_UNPARSE_SHORT - Omit realm if it is the local realm.
- KRB5_PRIV - Private application message.
- KRB5_PROMPT_TYPE_NEW_PASSWORD - Prompt for new password (during password change)
- KRB5_PROMPT_TYPE_NEW_PASSWORD_AGAIN - Prompt for new password again.
- KRB5_PROMPT_TYPE_PASSWORD - Prompt for password.
- KRB5_PROMPT_TYPE_PREAUTH - Prompt for preauthentication data (such as an OTP value)
- KRB5_PVNO - Protocol version number.
- KRB5_REALM_BRANCH_CHAR
- KRB5_RECVAUTH_BADAUTHVERS
- KRB5_RECVAUTH_SKIP_VERSION
- KRB5_REFERRAL_REALM - Constant for realm referrals.
- KRB5_SAFE - Safe application message.
- KRB5_SAM_MUST_PK_ENCRYPT_SAD
- KRB5_SAM_SEND_ENCRYPTED_SAD
- KRB5_SAM_USE_SAD_AS_KEY
- KRB5_TC_MATCH_2ND_TKT - The second ticket must match.
- KRB5_TC_MATCH_AUTHDATA - The authorization data must match.
- KRB5_TC_MATCH_FLAGS - All the flags set in the match credentials must be set.
- KRB5_TC_MATCH_FLAGS_EXACT - All the flags must match exactly.
- KRB5_TC_MATCH_IS_SKEY - The is_skey field must match exactly.
- KRB5_TC_MATCH_KTYPE - The encryption key type must match.
- KRB5_TC_MATCH_SRV_NAMEONLY - Only the name portion of the principal name must match.
- KRB5_TC_MATCH_TIMES - The requested lifetime must be at least as great as the time specified.
- KRB5_TC_MATCH_TIMES_EXACT - All the time fields must match exactly.
- KRB5_TC_NOTICKET
- KRB5_TC_OPENCLOSE - Open and close the file for each cache operation.
- KRB5_TC_SUPPORTED_KTYPES - The supported key types must match.
- KRB5_TGS_NAME
- KRB5_TGS_NAME_SIZE
- KRB5_TGS_REP - Response to TGS request.
- KRB5_TGS_REQ - Ticket granting server request.
- KRB5_TKT_CREDS_STEP_FLAG_CONTINUE - More responses needed.
- KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL
- KRB5_WELLKNOWN_NAMESTR - First component of NT_WELLKNOWN principals.
- LR_TYPE_INTERPRETATION_MASK
- LR_TYPE_THIS_SERVER_ONLY
- MAX_KEYTAB_NAME_LEN
- MSEC_DIRBIT
- MSEC_VAL_MASK
- SALT_TYPE_AFS_LENGTH
- SALT_TYPE_NO_LENGTH
- THREEPARAMOPEN
- TKT_FLG_ANONYMOUS
- TKT_FLG_ENC_PA_REP
- TKT_FLG_FORWARDABLE
- TKT_FLG_FORWARDED
- TKT_FLG_HW_AUTH
- TKT_FLG_INITIAL
- TKT_FLG_INVALID
- TKT_FLG_MAY_POSTDATE
- TKT_FLG_OK_AS_DELEGATE
- TKT_FLG_POSTDATED
- TKT_FLG_PRE_AUTH
- TKT_FLG_PROXIABLE
- TKT_FLG_PROXY
- TKT_FLG_RENEWABLE
- TKT_FLG_TRANSIT_POLICY_CHECKED
- VALID_INT_BITS
- VALID_UINT_BITS
- krb5_const
- krb5_princ_component
- krb5_princ_name
- krb5_princ_realm
- krb5_princ_set_realm
- krb5_princ_set_realm_data
- krb5_princ_set_realm_length
- krb5_princ_size
- krb5_princ_type
- krb5_roundup
- krb5_x
- krb5_xc
- krb524_convert_creds_kdc
- krb524_init_ets
- For plugin module developers
- Building Kerberos V5
- Basic Kerberos V5 concepts
- MIT Kerberos Features
- About this project
- Resources