Query, Need help for using GSSAPI client API using fetched tickets in cache.

[Santosh Kumar]

All,

 Request for help, i'm using gssapi client API to initiate sec context
using kerberos tickets in file cache.


1) import client principal

         //buffer.sprintf("leema\@PCSQALAB.NET at PCSQALAB.NET");
//gss_buffer_desc gssBuffer = { buffer.len(), (void*)buffer.str() };

*         gss_import_name
(&m_minor,&gssBuffer,GSS_C_NT_USER_NAME,&m_gssUser);*


2)Import service principal

//gssBuffer -> HTTP at Parent-2K16.pcsqalab.net

*gss_import_name(&m_minor,&gssBuffer,GSS_C_NT_HOSTBASED_SERVICE,&m_gssSvc);*


3)acquire client credential handle.

m_major = gss_acquire_cred(&m_minor, m_gssUser, GSS_C_INDEFINITE,
GSS_C_NO_OID_SET, GSS_C_INITIATE,&m_gssUserCred,&oidSet, &m_timeRec);


4) m_major =
gss_acquire_cred(&m_minor,m_gssSvc,GSS_C_INDEFINITE,g_oidSet,GSS_C_INITIATE,
&m_gssSvcCred, &oidSet, &m_timeRec);

5)m_major = gss_init_sec_context(&m_minor, m_gssUserCred, &m_gssContext,
m_gssSvc, &g_spnego_mechanism_desc,
flags,0,GSS_C_NO_CHANNEL_BINDINGS,&gssInput, NULL,&gssOutput,NULL, NULL);



In step 3) I'm getting GSS_S_CREDENTIALS_EXPIRED , the tickets lifetime is
valid.


Please note i'm migrating heimdal gssapi with MIT gssapi.    Do i need to
register plugin/call backs , to look for tickets?

tried replacing g_spnego_mechanism_desc, with GSS_C_NO_OID_SET, but didn't
work, what should i do?


Below is the Ticket cache: FILE:/tmp/krb5cc_36073

Default principal: host/PXE-DEV.PCSQALAB.NET at PCSQALAB.NET

Service principals:

krbtgt/PCSQALAB.NET at PCSQALAB.NET

host/PXEDDEV.PCSQALAB.NET at PCSQALAB.NET for client leema\@
PCSQALAB.NET at PCSQALAB.NET

http/Parent-2K16.PCSQALAB.NET at PCSQALAB.NET for client leema\@
PCSQALAB.NET at PCSQALAB.NET


Thanks

Santosh