kim_options_overview.html [plain text]
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html><head><meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
<title>Kerberos Identity Management: KIM Options Overview</title>
<link href="doxygen.css" rel="stylesheet" type="text/css">
<link href="tabs.css" rel="stylesheet" type="text/css">
</head><body>
<!-- Generated by Doxygen 1.5.3 -->
<h1><a class="anchor" name="kim_options_overview">KIM Options Overview</a></h1><h2><a class="anchor" name="kim_options_introduction">
Introduction</a></h2>
Kerberos Identity Management Options (kim_options_t) allows you to control how the Kerberos library obtains credentials. When the options structure is initialized with <a class="el" href="group__kim__options__reference.html#ge36eb288b38f18491e4c903f008b1379" title="Create new options with default values.">kim_options_create()</a>, each option is filled in with a default value which can then be modified with the kim_options_set_*() APIs. If you only want to use the default values, you may pass <a class="el" href="group__kim__types__reference.html#ge0384d3f6d9108e3ec84e322c61235a7">KIM_OPTIONS_DEFAULT</a> into any KIM function that takes a kim_options_t.<p>
KIM options fall into two major categories: options for controlling how credentials are acquired and options for controlling what properties the newly acquired credentials will have:<h2><a class="anchor" name="kim_options_credential_properties">
Options for Controlling Credential Properties</a></h2>
Kerberos credentials have a number of different properties which can be requested when credentials are acquired. These properties control when and for how long the credentials are valid and what you can do with them.<p>
Note that setting these properties in the KIM options only changes what the Kerberos libraries <em>request</em> from the KDC. The KDC itself may choose not to honor your requested properties if they violate the site security policy. For example, most sites place an upper bound on how long credentials may be valid. If you request a credential lifetime longer than this upper bound, the KDC may return credentials with a shorter lifetime than you requested.<h3><a class="anchor" name="kim_options_lifetimes">
Credential Lifetime</a></h3>
Kerberos credentials have start time and a lifetime during which they are valid. Once the lifetime has passed, credentials "expire" and can no longer be used.<p>
The requested credential start time can be set with <a class="el" href="group__kim__options__reference.html#gf7f6a8a82fedc547c8502ce09a419f91" title="Set the date when a credential should become valid.">kim_options_set_start_time()</a> and examined with <a class="el" href="group__kim__options__reference.html#gca63b972b41530c52bbe83bd974e6f9b" title="Get the date when a credential should become valid.">kim_options_get_start_time()</a>. The requested credential lifetime can be set with <a class="el" href="group__kim__options__reference.html#g392369e80bea0ea9c920d6de55e080ed" title="Set the duration during which a credential should be valid.">kim_options_set_lifetime()</a> and examined with <a class="el" href="group__kim__options__reference.html#gd7a886d6c0a33d0d872bf40420023ee2" title="Get the duration during which an acquired credential should be valid.">kim_options_get_lifetime()</a>.<h3><a class="anchor" name="kim_options_renewable">
Renewable Credentials</a></h3>
Credentials with very long lifetimes are more convenient since the user does not have authenticate as often. Unfortunately they are also a higher security risk: if credentials are stolen they can be used until they expire. Credential renewal exists to compromise between these two conflicting goals.<p>
Renewable credentials are TGT credentials which can be used to obtain new TGT credentials without reauthenticating. By regularly renewing credentials the KDC has an opportunity to check to see if the client's credentials have been reported stolen and refuse to renew them. Renewable credentials have a "renewal lifetime" during which credentials can be renewed. This lifetime is relative to the original credential start time. If credentials are renewed shortly before the end of the renewal lifetime, their lifetime will be capped to the end of the renewal lifetime.<p>
Note that credentials must be valid to be renewed and therefore may not be an appropriate solution for all use cases. Sites which use renewable credentials often create helper processes running as the user which will automatically renew the user's credentials when they get close to expiration.<p>
Use <a class="el" href="group__kim__options__reference.html#gcfa20d97d1643714a62b81077c1722ba" title="Set whether or not to request a renewable credential.">kim_options_set_renewable()</a> to change whether or not the Kerberos libraries request renewable credentials and <a class="el" href="group__kim__options__reference.html#g073245936d6086da6f1d3572872ecfe6" title="Get whether or not to request a renewable credential.">kim_options_get_renewable()</a> to find out the current setting. Use <a class="el" href="group__kim__options__reference.html#g604ed101fa538a6f042fe612d74b5ed2" title="Set the duration during which a valid credential should be renewable.">kim_options_set_renewal_lifetime()</a> to change the requested renewal lifetime and <a class="el" href="group__kim__options__reference.html#g34bcb26ba38f691c6f5d48ec97a49392" title="Get the duration during which a valid credential should be renewable.">kim_options_get_renewal_lifetime()</a> to find out the current value.<h3><a class="anchor" name="kim_options_addressless">
Addressless Credentials</a></h3>
Traditionally Kerberos used the host's IP address as a mechanism to restrict the user's credentials to a specific host, thus making it harder to use stolen credentials. When authenticating to a remote service with credentials containing addresses, the remote service verifies that the client's IP address is one of the addresses listed in the credential. Unfortunately, modern network technologies such as NAT rewrite the IP address in transit, making it difficult to use credentials with addresses in them. As a result, most Kerberos sites now obtain addressless credentials.<p>
Use <a class="el" href="group__kim__options__reference.html#g4706fb2cc57109b8593f0b030218261a" title="Set whether or not to request an addressless credential.">kim_options_set_addressless()</a> to change whether or not the Kerberos libraries request addressless credentials. Use <a class="el" href="group__kim__options__reference.html#g50495f13e53c49a11729904038e7cdf9" title="Get whether or not to request an addressless credential.">kim_options_get_addressless()</a> to find out the current setting.<h3><a class="anchor" name="kim_options_forwardable">
Forwardable Credentials</a></h3>
Forwardable credentials are TGT credentials which can be forwarded to a service you have authenticated to. If the credentials contain IP addresses, the addresses are changed to reflect the service's IP address. Credential forwarding is most commonly used for Kerberos-authenticated remote login services. By forwarding TGT credentials through the remote login service, the user's credentials will appear on the remote host when the user logs in.<p>
The forwardable flag only applies to TGT credentials.<p>
Use <a class="el" href="group__kim__options__reference.html#gc787d6b18febc22c86299d2668818513" title="Set whether or not to request a forwardable credential.">kim_options_set_forwardable()</a> to change whether or not the Kerberos libraries request forwardable credentials. Use <a class="el" href="group__kim__options__reference.html#g649b9ded186ec13915196a6f8ded7565" title="Get whether or not to request a forwardable credential.">kim_options_get_forwardable()</a> to find out the current setting.<h3><a class="anchor" name="kim_options_proxiable">
Proxiable Credentials</a></h3>
Proxiable credentials are similar to forwardable credentials except that instead of forwarding the a TGT credential itself, a service credential is forwarded instead. Using proxiable credentials, a user can permit a service to perform a specific task as the user using one of the user's service credentials.<p>
Like forwardability, the proxiable flag only applies to TGT credentials. Unlike forwarded credentials, the IP address of proxiable credentials are not modified for the service when being proxied. This can be solved by also requesting addressless credentials.<p>
Use <a class="el" href="group__kim__options__reference.html#g15ffe61f06334f4071e5b1ea6be62117" title="Set whether or not to request a proxiable credential.">kim_options_set_proxiable()</a> to change whether or not the Kerberos libraries request proxiable credentials. Use <a class="el" href="group__kim__options__reference.html#g0193dda96349a6e8d98d6154540a364e" title="Get whether or not to request a proxiable credential.">kim_options_get_proxiable()</a> to find out the current setting.<h3><a class="anchor" name="kim_options_service_name">
Service Name</a></h3>
Normally users acquire TGT credentials (ie "ticket granting tickets") and then use those credentials to acquire service credentials. This allows Kerberos to provide single sign-on while still providing mutual authentication to services. However, sometimes you just want an initial credential for a service. KIM options allows you to set the service name with <a class="el" href="group__kim__options__reference.html#g6e31c69a65efe32a5860125083d0b803" title="Set the service name to request a credential for.">kim_options_set_service_name()</a> and query it with <a class="el" href="group__kim__options__reference.html#gdf70addbc8221c252b1223b5e99dfa94" title="Get the service name to request a credential for.">kim_options_get_service_name()</a>.<p>
See <a class="el" href="group__kim__options__reference.html">KIM Options Reference Documentation</a> for information on specific APIs. <hr size="1"><address style="text-align: right;"><small>Generated on Mon Nov 3 17:45:44 2008 for Kerberos Identity Management by
<a href="http://www.doxygen.org/index.html">
<img src="doxygen.png" alt="doxygen" align="middle" border="0"></a> 1.5.3 </small></address>
</body>
</html>