appl/simple/client/sim_client.c uses internal APIs

Sam Hartman hartmans at debian.org
Thu Feb 23 12:34:52 EST 2023


>>>>> "Simo" == Simo Sorce <simo at redhat.com> writes:

    Simo> Wherever possible you should recommend people use GSSAPI and
    Simo> not krb5 APIs directly, unless they are building tools
    Simo> specifically to manage aspects of krb5 (acquiring tickets,
    Simo> managing ccaches, etc.)

I agree with the above.
I also think that the simple client referred to in the subject has a
bunch of anti-patterns.
As an example, I don't think it integrity protects or encrypts its
exchanges; I think it's too simple to actually be useful in today's
world.

That said,  it looks like krb5_auth_con_genaddrs is probably the API you
want to use instead of krb5_gen_portaddr.  It takes an auth context and
a socet FD and extracts addresses from the socket FD.

I suspect that the auth context machinery will generate the replay cache
name for you, and again,  you don't need that API either.
But please use GSS-API instead:-)


More information about the Kerberos mailing list