Module `Krb_internal_public.Credentials`Source

Sourcetype t

krb5_creds

A ticket that allows one to connect as a particular client principal to a particular server principal for a given time using a particular session key whenever encryption is needed for client/server communication.

Sourceval sexp_of_t : t -> Sexplib0.Sexp.t

Source

val create : 
  ?ticket:string ->
  ?second_ticket:string ->
  client:Principal.t ->
  server:Principal.t ->
  unit ->
  t Async.Deferred.Or_error.t

From RFC 4120, a ticket is:

"A record that helps a client authenticate itself to a server; it contains the client's identity, a session key, a timestamp, and other information, all sealed using the server's secret key. It only serves to authenticate a client when presented along with a fresh Authenticator."

Ultimately, it's some bytes that are used in authentication and come from a ticket request to the KDC.

The odd thing regarding this type is that it is both used to represent a request for credentials (no tickets specified) and as the retrieved credentials (contains a ticket).

As for second_ticket, it's a special ticket that is used in user-to-user authentication. It is set to the TGT of the server when requesting credentials from the KDC.

You should only need to use this function if you're doing something low-level manually.

Source

val of_password : 
  ?options:Get_init_creds_opts.t ->
  ?tkt_service:string ->
  Principal.t ->
  string ->
  t Async.Deferred.Or_error.t

of_password and of_keytab request tickets from the KDC.

options is used to override default lifetimes and flags for the returned ticket.

tkt_service specifies what ticket to acquire. If not specified, it defaults to the KDC's ticket granting service (i.e. the returned ticket is a TGT).

principal is the requesting principal.

Source

val of_keytab : 
  ?options:Get_init_creds_opts.t ->
  ?tkt_service:string ->
  Principal.t ->
  Keytab.t ->
  t Async.Deferred.Or_error.t

Source

val check_password : 
  Principal.t ->
  password:string ->
  unit Async.Deferred.Or_error.t

check_password principal ~password checks with the KDC that principal's password is password

Sourceval client : t -> Principal.t

Sourceval server : t -> Principal.t

Sourceval is_skey : t -> bool

is_skey t iff the server should decrypt the ticket with the session key of its tgt (user-to-user)

Sourceval ticket : t -> Ticket.t Async.Deferred.Or_error.t

Sourceval ticket_string : t -> string

Sourceval second_ticket : t -> string

Sourceval starttime : t -> Core.Time_float.t

Sourceval endtime : t -> Core.Time_float.t

valid until this time

Sourceval renew_until : t -> Core.Time_float.t

Sourceval keyblock : t -> Keyblock.t Async.Deferred.Or_error.t

the session key

Sourcemodule Flags : sig ... end

Sourceval flags : t -> Flags.t

Sourcemodule Raw : sig ... end

Sourceval to_raw : t -> Raw.t

Sourceval of_raw : Raw.t -> t Async.Deferred.Or_error.t

Sourcemodule Expert : sig ... end

Install

Dune Dependency

Authors

Maintainers

Sources

doc/krb.internal/Krb_internal_public/Credentials/index.html

Module `Krb_internal_public.Credentials`Source

package krb

Install

Dune Dependency

Authors

Maintainers

Sources

doc/krb.internal/Krb_internal_public/Credentials/index.html

Module Krb_internal_public.CredentialsSource

Module `Krb_internal_public.Credentials`Source