krb5_ccache(3)

📦

version 7.8.0 · 3 versions

7.8.0 · alpine 3.22, alpine 3.23, alpine 3.24, epel 10, epel 9, fedora 43, fedora 44 (latest)
14.5 · freebsd 14.5, nixpkgs unstable
11.0 · nixpkgs unstable

, in alpine 3.22, alpine 3.23, alpine 3.24, epel 10, epel 9, fedora 43, fedora 44

🌸 krb5_ccache — Heimdal Kerberos 5 credential cache functions 💖

okay bestie, sit DOWN, because we're about to get into the Heimdal Kerberos 5 credential cache functions, aka krb5_ccache — this is the manual page from the Heimdal Kerberos 5 library, and it's giving main character energy for your credential caches fr fr. ✨

💅 NAME 💅

krb5_ccache — Heimdal Kerberos 5 credential cache functions

🎀 SYNOPSIS 🎀

🦋 Functions 🦋

no cap, this is the whole roster, every single one, we are NOT skipping anybody:

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_register(krb5_context context, const krb5_cc_ops *ops, krb5_boolean override)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_resolve(krb5_context context, const char *name, krb5_ccache *id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_new_unique(krb5_context context, const char *type, const char *hint, krb5_ccache *id)
KRB5_LIB_FUNCTION const char *KRB5_LIB_CALL krb5_cc_get_name(krb5_context context, krb5_ccache id)
KRB5_LIB_FUNCTION const char *KRB5_LIB_CALL krb5_cc_get_type(krb5_context context, krb5_ccache id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_get_full_name(krb5_context context, krb5_ccache id, char **str)
KRB5_LIB_FUNCTION const krb5_cc_ops *KRB5_LIB_CALL krb5_cc_get_ops(krb5_context context, krb5_ccache id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_switch(krb5_context context, krb5_ccache id)
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_cc_support_switch(krb5_context context, const char *type)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_set_default_name(krb5_context context, const char *name)
KRB5_LIB_FUNCTION const char *KRB5_LIB_CALL krb5_cc_default_name(krb5_context context)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_default(krb5_context context, krb5_ccache *id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_initialize(krb5_context context, krb5_ccache id, krb5_principal primary_principal)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_destroy(krb5_context context, krb5_ccache id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_close(krb5_context context, krb5_ccache id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_store_cred(krb5_context context, krb5_ccache id, krb5_creds *creds)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_retrieve_cred(krb5_context context, krb5_ccache id, krb5_flags whichfields, const krb5_creds *mcreds, krb5_creds *creds)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_get_principal(krb5_context context, krb5_ccache id, krb5_principal *principal)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_start_seq_get(krb5_context context, const krb5_ccache id, krb5_cc_cursor *cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_next_cred(krb5_context context, const krb5_ccache id, krb5_cc_cursor *cursor, krb5_creds *creds)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_end_seq_get(krb5_context context, const krb5_ccache id, krb5_cc_cursor *cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_remove_cred(krb5_context context, krb5_ccache id, krb5_flags which, krb5_creds *cred)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_set_flags(krb5_context context, krb5_ccache id, krb5_flags flags)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_get_flags(krb5_context context, krb5_ccache id, krb5_flags *flags)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_copy_match_f(krb5_context context, const krb5_ccache from, krb5_ccache to, krb5_boolean(*match)(krb5_context, void *, const krb5_creds *), void *matchctx, unsigned int *matched)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_copy_cache(krb5_context context, const krb5_ccache from, krb5_ccache to)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_get_version(krb5_context context, const krb5_ccache id)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_cc_clear_mcred(krb5_creds *mcred)
KRB5_LIB_FUNCTION const krb5_cc_ops *KRB5_LIB_CALL krb5_cc_get_prefix_ops(krb5_context context, const char *prefix)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_cache_get_first(krb5_context context, const char *type, krb5_cc_cache_cursor *cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_cache_next(krb5_context context, krb5_cc_cache_cursor cursor, krb5_ccache *id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_cache_end_seq_get(krb5_context context, krb5_cc_cache_cursor cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_cache_match(krb5_context context, krb5_principal client, krb5_ccache *id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_move(krb5_context context, krb5_ccache from, krb5_ccache to)
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_is_config_principal(krb5_context context, krb5_const_principal principal)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_set_config(krb5_context context, krb5_ccache id, krb5_const_principal principal, const char *name, krb5_data *data)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_get_config(krb5_context context, krb5_ccache id, krb5_const_principal principal, const char *name, krb5_data *data)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cccol_cursor_new(krb5_context context, krb5_cccol_cursor *cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cccol_cursor_next(krb5_context context, krb5_cccol_cursor cursor, krb5_ccache *cache)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cccol_cursor_free(krb5_context context, krb5_cccol_cursor *cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_last_change_time(krb5_context context, krb5_ccache id, krb5_timestamp *mtime)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cccol_last_change_time(krb5_context context, const char *type, krb5_timestamp *mtime)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_get_friendly_name(krb5_context context, krb5_ccache id, char **name)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_set_friendly_name(krb5_context context, krb5_ccache id, const char *name)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_get_lifetime(krb5_context context, krb5_ccache id, time_t *t)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_set_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat offset)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_get_kdc_offset(krb5_context context, krb5_ccache id, krb5_deltat *offset)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_gen_new(krb5_context context, const krb5_cc_ops *ops, krb5_ccache *id)
KRB5_DEPRECATED_FUNCTION('Use X instead')
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_copy_creds(krb5_context context, const krb5_ccache from, krb5_ccache to)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_validated_creds(krb5_context context, krb5_creds *creds, krb5_principal client, krb5_ccache ccache, char *service)

🚩 okay so real talk: krb5_cc_gen_new comes with KRB5_DEPRECATED_FUNCTION('Use X instead') attached to it. That's the page telling you it's deprecated, bestie — yes, the 'Use X instead' is literally what's written there, no tea, no shade, that's just what it says. 💀

🎀 Variables 🎀

these four icons of the credential cache world:

KRB5_LIB_VARIABLE const krb5_cc_ops krb5_acc_ops
KRB5_LIB_VARIABLE const krb5_cc_ops krb5_dcc_ops
KRB5_LIB_VARIABLE const krb5_cc_ops krb5_fcc_ops
KRB5_LIB_VARIABLE const krb5_cc_ops krb5_mcc_ops

🌈 Detailed Description 🌈

bestie. there is genuinely nothing here. the section exists, the section has a heading, and the section is empty. it's giving mysterious. it's giving "the plot is the vibes". moving on. 🦋

👑 Function Documentation 👑

✨ `krb5_cc_cache_end_seq_get` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_cache_end_seq_get(krb5_context context, krb5_cc_cache_cursor cursor)

Destroy the cursor cursor. that's it. that's the whole thing. clean up after yourself, queen. 💅

Returns

Return an error code or 0, see krb5_get_error_message().

✨ `krb5_cc_cache_get_first` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_cache_get_first(krb5_context context, const char *type, krb5_cc_cache_cursor *cursor)

Start iterating over all caches of specified type. See also krb5_cccol_cursor_new().

Parameters

context — A Kerberos 5 context
type — optional type to iterate over, if NULL, the default cache is used.
cursor — cursor should be freed with krb5_cc_cache_end_seq_get().

Returns

Return an error code or 0, see krb5_get_error_message().

✨ `krb5_cc_cache_match` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_cache_match(krb5_context context, krb5_principal client, krb5_ccache *id)

Search for a matching credential cache that have the principal as the default principal. On success, id needs to be freed with krb5_cc_close() or krb5_cc_destroy().

Parameters

context — A Kerberos 5 context
client — The principal to search for
id — the returned credential cache

Returns

On failure, error code is returned and id is set to NULL.

✨ `krb5_cc_cache_next` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_cache_next(krb5_context context, krb5_cc_cache_cursor cursor, krb5_ccache *id)

Retrieve the next cache pointed to by (cursor) in id and advance cursor. one by one, we go, no skipping. 🫶

Parameters

context — A Kerberos 5 context
cursor — the iterator cursor, returned by krb5_cc_cache_get_first()
id — next ccache

Returns

Return 0 or an error code. Returns KRB5_CC_END when the end of caches is reached, see krb5_get_error_message().

✨ `krb5_cc_clear_mcred` ✨

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_cc_clear_mcred(krb5_creds *mcred)

Clear mcreds so it can be used with krb5_cc_retrieve_cred. (yes, the parameter is mcred in the signature and mcreds in the sentence, that's just how the page says it, and we respect it 💜)

✨ `krb5_cc_close` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_close(krb5_context context, krb5_ccache id)

Stop using the ccache id and free the related resources. polite exit, we love to see it. 🎀

Returns

Return an error code or 0, see krb5_get_error_message().

✨ `krb5_cc_copy_cache` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_copy_cache(krb5_context context, const krb5_ccache from, krb5_ccache to)

Just like krb5_cc_copy_match_f(), but copy everything. all of it. the whole cache. no filter, no pickiness, we're taking it all. 🔥

@

🙈 and yes, that lone @ is literally sitting there in the page right after this description. it's iconic in a cursed way. not me noticing it. (no, I will not explain it, the page doesn't either.)

✨ `krb5_cc_copy_creds` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_copy_creds(krb5_context context, const krb5_ccache from, krb5_ccache to)

MIT compat glue. that's the whole description, bestie, short and real. 🍓

✨ `krb5_cc_copy_match_f` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_copy_match_f(krb5_context context, const krb5_ccache from, krb5_ccache to, krb5_boolean(*)(krb5_context, void *, const krb5_creds *) match, void *matchctx, unsigned int *matched)

Copy the contents of from to to if the given match function return true. it's giving curated vibes only. ✨

Parameters

context — A Kerberos 5 context.
from — the cache to copy data from.
to — the cache to copy data to.
match — a match function that should return TRUE if cred argument should be copied, if NULL, all credentials are copied.
matchctx — context passed to match function.
matched — set to true if there was a credential that matched, may be NULL.

Returns

Return an error code or 0, see krb5_get_error_message().

✨ `krb5_cc_default` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_default(krb5_context context, krb5_ccache *id)

Open the default ccache in id. the default one. the one everybody reaches for. 💅

Returns

Return an error code or 0, see krb5_get_error_message().

`krb5_cc_default_name()`

KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_cc_default_name(krb5_context context)

Bestie, this one hands you a pointer to a context-static string holding the default ccache name. Not a copy, okay? It's the string, living its best life inside the context. 💖

Returns: the string with the default credential cache name. That's it, that's the whole vibe.

`krb5_cc_destroy()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_destroy(krb5_context context, krb5_ccache id)

Straight-up removes the ccache id. Poof, gone, no cap. 💀

Returns: an error code or 0 — peep krb5_get_error_message() when things go sideways.

`krb5_cc_end_seq_get()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_end_seq_get(krb5_context context, const krb5_ccache id,
                    krb5_cc_cursor * cursor)

Destroys the cursor cursor. Like, that cursor's arc is OVER. 🎀

`krb5_cc_gen_new()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_gen_new(krb5_context context, const krb5_cc_ops * ops,
                krb5_ccache * id)

Generates a brand-new ccache of type ops, and drops it into id. Fresh out the box ✨

Deprecated: please use krb5_cc_new_unique() instead, bestie. This one is giving old-money legacy energy.

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_get_config()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_config(krb5_context context, krb5_ccache id,
                   krb5_const_principal principal, const char * name,
                   krb5_data * data)

Grabs some configuration for the credential cache that's stored right there in the cache. It's all in the vault, iykyk. 🔐

Parameters

context — a Kerberos context
id — the credential cache to store the data for
principal — configuration for a specific principal; if it's NULL, it's global for the whole entire cache
name — the name the configuration is stored under
data — the data being fetched; free it with krb5_data_free()

`krb5_cc_get_flags()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_flags(krb5_context context, krb5_ccache id, krb5_flags * flags)

Gets the flags of id and parks them in flags. Stored, tracked, accounted for. 💅

`krb5_cc_get_friendly_name()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_friendly_name(krb5_context context, krb5_ccache id, char ** name)

Returns a friendly name for the credential cache — like the nickname, the pet name, the cute lil handle. Free the result with krb5_xfree(), don't leave it hanging. 🌸

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_get_full_name()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_full_name(krb5_context context, krb5_ccache id, char ** str)

Returns the complete, resolvable name of the cache. The whole government name, not the nickname. 👑

Parameters

context — a Kerberos context
id — return pointer to a found credential cache
str — the returned name of a credential cache; free it with krb5_xfree()

Returns: returns 0 or an error (and when it errors out, *str is set to NULL).

`krb5_cc_get_kdc_offset()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_kdc_offset(krb5_context context, krb5_ccache id,
                       krb5_deltat * offset)

Gets the time offset between the client and the KDC. Clock drift? Not on our watch. ⏰

If the backend doesn't support KDC offset, it falls back to the context global setting.

Parameters

context — a Kerberos 5 context.
id — a credential cache
offset — the offset in seconds

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_get_lifetime()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_lifetime(krb5_context context, krb5_ccache id, time_t * t)

Gets the lifetime of the initial ticket in the cache. And heads up — if the initial ticket wasn't found, you get the error code KRB5_CC_END back. 😭

Parameters

context — a Kerberos 5 context.
id — a credential cache
t — the relative lifetime of the initial ticket

Returns: an error code or 0, see krb5_get_error_message().

The way this works, fr: if we find the start krbtgt in the cache, we use that as the lifespan. 🫶

And if there was no krbtgt, we use the shortest lifetime of service tickets that have yet to expire. But if all credentials are expired, krb5_cc_get_lifetime() will fail. Periodt. 💀

`krb5_cc_get_name()`

KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_cc_get_name(krb5_context context, krb5_ccache id)

Returns the name of the ccache id. Simple, iconic, no notes. ✨

`krb5_cc_get_ops()`

KRB5_LIB_FUNCTION const krb5_cc_ops* KRB5_LIB_CALL
krb5_cc_get_ops(krb5_context context, krb5_ccache id)

Returns the krb5_cc_ops of the ccache id. The operations, the lore, the whole toolkit. 🔥

`krb5_cc_get_prefix_ops()`

KRB5_LIB_FUNCTION const krb5_cc_ops* KRB5_LIB_CALL
krb5_cc_get_prefix_ops(krb5_context context, const char * prefix)

Gets the cc ops that's registered in context to handle the prefix. Here's the tea: prefix can be a complete credential cache name or just a prefix — the function will only use the part up to the first colon (:) if there is one. And if the prefix argument is NULL, you get the default ccache implementation back. 🎀

Returns: returns NULL if the ops isn't found.

`krb5_cc_get_principal()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_principal(krb5_context context, krb5_ccache id,
                      krb5_principal * principal)

Returns the principal of id and puts it in principal. Main character identified. 👑

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_get_type()`

KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL
krb5_cc_get_type(krb5_context context, krb5_ccache id)

Returns the type of the ccache id. Like FILE, or whatever it's identifying as today. 💅

`krb5_cc_get_version()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_get_version(krb5_context context, const krb5_ccache id)

Returns the version of id. Old-school or new-school, we're checking the label. 🌈

`krb5_cc_initialize()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_initialize(krb5_context context, krb5_ccache id,
                   krb5_principal primary_principal)

Creates a new ccache in id for primary_principal. Fresh start, new era, we love a glow-up. ✨

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_last_change_time()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_last_change_time(krb5_context context, krb5_ccache id,
                         krb5_timestamp * mtime)

Returns the last time the credential cache was modified. Basically the cache's last-active timestamp. 🕐

Parameters

context — a Kerberos 5 context
id — the credential cache to probe
mtime — the last modification time, set to 0 on error.

Returns: returns 0 or an error. See krb5_get_error_message().

`krb5_cc_move()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_move(krb5_context context, krb5_ccache from, krb5_ccache to)

Moves the content from one credential cache to another. And the operation is an atomic switch — all or nothing, no half-moved mess, we don't do chaos here. 🔥

Parameters

context — a Kerberos context
from — the credential cache to move the content from
to — the credential cache to move the content to

Returns: on success, from is freed. On failure, an error code is returned and from and to are both still allocated. See krb5_get_error_message().

`krb5_cc_new_unique()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_new_unique(krb5_context context, const char * type, const char * hint,
                   krb5_ccache * id)

Generates a new unique ccache of type in id. And if type is NULL, the library picks the default credential cache type for you — king behavior, honestly. 👑

The supplied hint (which can be NULL) is a string that the credential cache type can use to base the name of the credential on — it's there to make it easier for the user to differentiate the credentials. Cute and functional. 🎀

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_next_cred()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_next_cred(krb5_context context, const krb5_ccache id,
                  krb5_cc_cursor * cursor, krb5_creds * creds)

Retrieves the next cred pointed to by (id, cursor) into creds, and advances cursor. One at a time, next next next — we're scrolling the feed of credentials. 📜

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_register()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_register(krb5_context context, const krb5_cc_ops * ops,
                 krb5_boolean override)

Adds a new ccache type with operations ops, and it overwrites any existing one if override. New ops just dropped. 💅

Parameters

context — a Kerberos context
ops — type of plugin symbol
override — flag to select if the registration is to override an existing ops with the same name.

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_remove_cred()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_remove_cred(krb5_context context, krb5_ccache id, krb5_flags which,
                    krb5_creds * cred)

Removes the credential identified by cred and which from id. Uninvited from the party, effective immediately. 🚫

`krb5_cc_resolve()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_resolve(krb5_context context, const char * name, krb5_ccache * id)

Finds and allocates a ccache in id from the specification in residual. And listen: if the ccache name doesn't contain any colon, it gets interpreted as a file name. 🗂️

Parameters

context — a Kerberos context.
name — string name of a credential cache.
id — return pointer to a found credential cache.

Returns: returns 0 or an error code. In case of an error, id is set to NULL. See krb5_get_error_message().

`krb5_cc_retrieve_cred()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_retrieve_cred(krb5_context context, krb5_ccache id,
                      krb5_flags whichfields, const krb5_creds * mcreds,
                      krb5_creds * creds)

Retrieves the credential identified by mcreds (and whichfields) from id into creds. And important, bestie: creds must be freed by the caller using krb5_free_cred_contents. Don't forget or it's a leak situation. 😭

Parameters

context — a Kerberos 5 context
id — a Kerberos 5 credential cache
whichfields — what fields to use for matching credentials, same flags as whichfields in krb5_compare_creds()
mcreds — template credential to use for comparing
creds — returned credential, free with krb5_free_cred_contents()

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_set_config()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_config(krb5_context context, krb5_ccache id,
                   krb5_const_principal principal, const char * name,
                   krb5_data * data)

Stores some configuration for the credential cache right in the cache. And heads up — existing configuration under the same name gets over-written. No merge, just replace. 💅

Parameters

context — a Kerberos context
id — the credential cache to store the data for
principal — configuration for a specific principal; if NULL, it's global for the whole cache.
name — name under which the configuration is stored.
data — data to store; if NULL, the configuration is removed.

`krb5_cc_set_default_name()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_default_name(krb5_context context, const char * name)

Sets the default cc name for context to name. Renaming the main character. 👑

`krb5_cc_set_flags()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_flags(krb5_context context, krb5_ccache id, krb5_flags flags)

Sets the flags of id to flags. Flipping the switches, setting the mood. ✨

`krb5_cc_set_friendly_name()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_friendly_name(krb5_context context, krb5_ccache id,
                          const char * name)

Sets the friendly name on the credential cache. Giving it a nickname, a whole identity. 🎀

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_set_kdc_offset()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_set_kdc_offset(krb5_context context, krb5_ccache id,
                       krb5_deltat offset)

Sets the time offset between the client and the KDC. Syncing the clocks, harmonizing the vibes. ⏰

If the backend doesn't support KDC offset, it uses the context global setting.

Parameters

context — a Kerberos 5 context.
id — a credential cache
offset — the offset in seconds

Returns: an error code or 0, see krb5_get_error_message().

`krb5_cc_start_seq_get()`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
krb5_cc_start_seq_get(krb5_context context, const krb5_ccache id,
                      krb5_cc_cursor * cursor)

Starts iterating over id, and cursor is initialized to the beginning. The caller must free the cursor with krb5_cc_end_seq_get(). No leaving it behind, bestie. 🫶

`krb5_cc_store_cred`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_store_cred
    (krb5_context context, krb5_ccache id, krb5_creds * creds)

Okay so this one is literally the "put it in the vault" move 💖 — it stores creds inside the ccache id. That's it. That's the whole job.

Returns

Gives you back an error code, or 0 if everything slayed. Peep krb5_get_error_message() for the tea.

`krb5_cc_support_switch`

KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_cc_support_switch
    (krb5_context context, const char * type)

Returns true if the default credential cache support switch ✨

`krb5_cc_switch`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cc_switch (krb5_context
    context, krb5_ccache id)

Switches the default default credential cache for a specific credcache type (and, for some implementations, the name too). Yeah bestie, "default default" — I said what I said 🫶

Returns

An error code, or 0. krb5_get_error_message() is right there if you need the deets.

`krb5_cccol_cursor_free`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cccol_cursor_free
    (krb5_context context, krb5_cccol_cursor * cursor)

Ends an iteration and frees all the resources. And no, you don't have to wait till the end to call it — you can bail early, it's giving main character energy 🔥

Parameters

context — a Kerberos 5 context
cursor — the iteration cursor to be freed

Returns

Returns 0 or an error, and KRB5_CC_END gets returned at the end of iteration. krb5_get_error_message() has your back.

`krb5_cccol_cursor_new`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cccol_cursor_new
    (krb5_context context, krb5_cccol_cursor * cursor)

Gets you a brand new cache iteration cursor 🦋 and this one is the social butterfly — it iterates over all credential caches, independent of type. No gatekeeping, we love to see it.

Parameters

context — a Kerberos context
cursor — pass it into krb5_cccol_cursor_next() and free it with krb5_cccol_cursor_free()

Returns

Returns 0 or an error code, hmu at krb5_get_error_message().

`krb5_cccol_cursor_next`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cccol_cursor_next
    (krb5_context context, krb5_cccol_cursor cursor, krb5_ccache * cache)

Gets the next credential cache from the iteration. One at a time, bestie, we're going in order 💅

Parameters

context — a Kerberos 5 context
cursor — the iteration cursor
cache — the returned cursor. The pointer is set to NULL on failure and to a cache on success. That returned cache needs to be freed with krb5_cc_close() or destroyed with krb5_cc_destroy(). Also important lore: MIT Kerberos behaves slightly different and sets cache to NULL when all caches are iterated over and returns 0. So like, watch out for that 🙈

Returns

Returns 0 or an error, and KRB5_CC_END is returned at the end of iteration. See krb5_get_error_message().

`krb5_cccol_last_change_time`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_cccol_last_change_time
    (krb5_context context, const char * type, krb5_timestamp * mtime)

Returns the last modification time for a cache collection. You can also limit the query to one specific cache type if you're feeling picky. And heads up: if the function returns 0 and mtime is 0, that means there were no credentials in the caches. Ghost town 👻

Parameters

context — a Kerberos 5 context
type — the credential cache to probe. If it's NULL, all types get traversed.
mtime — the last modification time, set to 0 on error

Returns

Returns 0 or an error. See krb5_get_error_message().

`krb5_get_validated_creds`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_validated_creds
    (krb5_context context, krb5_creds * creds, krb5_principal client,
    krb5_ccache ccache, char * service)

Validates the newly fetched credential. Also check out krb5_verify_init_creds(), they're besties 🫶

Parameters

context — a Kerberos 5 context
creds — the credentials to verify
client — the client name to match up
ccache — the credential cache to use
service — a service name to use, used with krb5_sname_to_principal() to build a hostname to use to verify

`krb5_is_config_principal`

KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_is_config_principal
    (krb5_context context, krb5_const_principal principal)

Returns TRUE (non zero) if the principal is a configuration principal (the generated part of krb5_cc_set_config()). Returns FALSE (zero) if it's not a configuration principal. Simple vibe check ✅

Parameters

context — a Kerberos context
principal — principal to check if it a configuration principal

🌈 Variable Documentation 🌈

`krb5_acc_ops`

KRB5_LIB_VARIABLE const krb5_cc_ops krb5_acc_ops

Initial value:

= {
    KRB5_CC_OPS_VERSION,
    "API",
    acc_get_name,
    acc_resolve,
    acc_gen_new,
    acc_initialize,
    acc_destroy,
    acc_close,
    acc_store_cred,
    NULL,
    acc_get_principal,
    acc_get_first,
    acc_get_next,
    acc_end_get,
    acc_remove_cred,
    acc_set_flags,
    acc_get_version,
    acc_get_cache_first,
    acc_get_cache_next,
    acc_end_cache_get,
    acc_move,
    acc_get_default_name,
    acc_set_default,
    acc_lastchange,
    NULL,
    NULL,
}

Variable containing the API based credential cache implemention. ✨

`krb5_dcc_ops`

KRB5_LIB_VARIABLE const krb5_cc_ops krb5_dcc_ops

Initial value:

= {
    KRB5_CC_OPS_VERSION,
    "DIR",
    dcc_get_name,
    dcc_resolve,
    dcc_gen_new,
    dcc_initialize,
    dcc_destroy,
    dcc_close,
    dcc_store_cred,
    NULL,
    dcc_get_principal,
    dcc_get_first,
    dcc_get_next,
    dcc_end_get,
    dcc_remove_cred,
    dcc_set_flags,
    dcc_get_version,
    dcc_get_cache_first,
    dcc_get_cache_next,
    dcc_end_cache_get,
    dcc_move,
    dcc_get_default_name,
    dcc_set_default,
    dcc_lastchange,
    dcc_set_kdc_offset,
    dcc_get_kdc_offset
}

Variable containing the DIR based credential cache implemention. 💅

`krb5_fcc_ops`

KRB5_LIB_VARIABLE const krb5_cc_ops krb5_fcc_ops

Initial value:

= {
    KRB5_CC_OPS_VERSION,
    "FILE",
    fcc_get_name,
    fcc_resolve,
    fcc_gen_new,
    fcc_initialize,
    fcc_destroy,
    fcc_close,
    fcc_store_cred,
    NULL,
    fcc_get_principal,
    fcc_get_first,
    fcc_get_next,
    fcc_end_get,
    fcc_remove_cred,
    fcc_set_flags,
    fcc_get_version,
    fcc_get_cache_first,
    fcc_get_cache_next,
    fcc_end_cache_get,
    fcc_move,
    fcc_get_default_name,
    NULL,
    fcc_lastchange,
    fcc_set_kdc_offset,
    fcc_get_kdc_offset
}

Variable containing the FILE based credential cache implemention. 🎀

`krb5_mcc_ops`

KRB5_LIB_VARIABLE const krb5_cc_ops krb5_mcc_ops

Initial value:

= {
    KRB5_CC_OPS_VERSION,
    "MEMORY",
    mcc_get_name,
    mcc_resolve,
    mcc_gen_new,
    mcc_initialize,
    mcc_destroy,
    mcc_close,
    mcc_store_cred,
    NULL,
    mcc_get_principal,
    mcc_get_first,
    mcc_get_next,
    mcc_end_get,
    mcc_remove_cred,
    mcc_set_flags,
    NULL,
    mcc_get_cache_first,
    mcc_get_cache_next,
    mcc_end_cache_get,
    mcc_move,
    mcc_default_name,
    NULL,
    mcc_lastchange,
    mcc_set_kdc_offset,
    mcc_get_kdc_offset
}

Variable containing the MEMORY based credential cache implemention. 🧠✨

🫶 Author 🫶

Generated automatically by Doxygen for Heimdal Kerberos 5 library from the source code. Not me writing my own autobiography, the robots did it 💀

And that's a wrap on part 3, bestie!! This whole page is from Heimdal Kerberos 5 library, version 7.8.0, dated Tue Nov 15 2022 — go forth and cache responsibly, krb5_ccache(3) out 🦋💖

📦 where this page comes from

alpine 3.22: heimdal-doc 7.8.0-r4 · BSD-3-Clause
alpine 3.23: heimdal-doc 7.8.0-r5 · BSD-3-Clause
alpine 3.24: heimdal-doc 7.8.0-r5 · BSD-3-Clause
epel 10: heimdal-devel 7.8.0-26.el10_2 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
epel 9: heimdal-devel 7.8.0-5.el9 · BSD and MIT
fedora 43: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 43: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-28.fc44 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-28.fc44 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms

krb5_ccache(3)

🌸 krb5_ccache — Heimdal Kerberos 5 credential cache functions 💖

💅 NAME 💅

🎀 SYNOPSIS 🎀

🦋 Functions 🦋

🎀 Variables 🎀

🌈 Detailed Description 🌈

👑 Function Documentation 👑

✨ krb5_cc_cache_end_seq_get ✨

✨ krb5_cc_cache_get_first ✨

✨ krb5_cc_cache_match ✨

✨ krb5_cc_cache_next ✨

✨ krb5_cc_clear_mcred ✨

✨ krb5_cc_close ✨

✨ krb5_cc_copy_cache ✨

✨ krb5_cc_copy_creds ✨

✨ krb5_cc_copy_match_f ✨

✨ krb5_cc_default ✨

krb5_cc_default_name()

krb5_cc_destroy()

krb5_cc_end_seq_get()

krb5_cc_gen_new()

krb5_cc_get_config()

krb5_cc_get_flags()

krb5_cc_get_friendly_name()

krb5_cc_get_full_name()

krb5_cc_get_kdc_offset()

krb5_cc_get_lifetime()

krb5_cc_get_name()

krb5_cc_get_ops()

krb5_cc_get_prefix_ops()

krb5_cc_get_principal()

krb5_cc_get_type()

krb5_cc_get_version()

krb5_cc_initialize()

krb5_cc_last_change_time()

krb5_cc_move()

krb5_cc_new_unique()

krb5_cc_next_cred()

krb5_cc_register()

krb5_cc_remove_cred()

krb5_cc_resolve()

krb5_cc_retrieve_cred()

krb5_cc_set_config()

krb5_cc_set_default_name()

krb5_cc_set_flags()

krb5_cc_set_friendly_name()

krb5_cc_set_kdc_offset()

krb5_cc_start_seq_get()

krb5_cc_store_cred

krb5_cc_support_switch

krb5_cc_switch

krb5_cccol_cursor_free

krb5_cccol_cursor_new

krb5_cccol_cursor_next

krb5_cccol_last_change_time

krb5_get_validated_creds

krb5_is_config_principal

🌈 Variable Documentation 🌈

krb5_acc_ops

krb5_dcc_ops

krb5_fcc_ops

krb5_mcc_ops

🫶 Author 🫶

✨ `krb5_cc_cache_end_seq_get` ✨

✨ `krb5_cc_cache_get_first` ✨

✨ `krb5_cc_cache_match` ✨

✨ `krb5_cc_cache_next` ✨

✨ `krb5_cc_clear_mcred` ✨

✨ `krb5_cc_close` ✨

✨ `krb5_cc_copy_cache` ✨

✨ `krb5_cc_copy_creds` ✨

✨ `krb5_cc_copy_match_f` ✨

✨ `krb5_cc_default` ✨

`krb5_cc_default_name()`

`krb5_cc_destroy()`

`krb5_cc_end_seq_get()`

`krb5_cc_gen_new()`

`krb5_cc_get_config()`

`krb5_cc_get_flags()`

`krb5_cc_get_friendly_name()`

`krb5_cc_get_full_name()`

`krb5_cc_get_kdc_offset()`

`krb5_cc_get_lifetime()`

`krb5_cc_get_name()`

`krb5_cc_get_ops()`

`krb5_cc_get_prefix_ops()`

`krb5_cc_get_principal()`

`krb5_cc_get_type()`

`krb5_cc_get_version()`

`krb5_cc_initialize()`

`krb5_cc_last_change_time()`

`krb5_cc_move()`

`krb5_cc_new_unique()`

`krb5_cc_next_cred()`

`krb5_cc_register()`

`krb5_cc_remove_cred()`

`krb5_cc_resolve()`

`krb5_cc_retrieve_cred()`

`krb5_cc_set_config()`

`krb5_cc_set_default_name()`

`krb5_cc_set_flags()`

`krb5_cc_set_friendly_name()`

`krb5_cc_set_kdc_offset()`

`krb5_cc_start_seq_get()`

`krb5_cc_store_cred`

`krb5_cc_support_switch`

`krb5_cc_switch`

`krb5_cccol_cursor_free`

`krb5_cccol_cursor_new`

`krb5_cccol_cursor_next`

`krb5_cccol_last_change_time`

`krb5_get_validated_creds`

`krb5_is_config_principal`

`krb5_acc_ops`

`krb5_dcc_ops`

`krb5_fcc_ops`

`krb5_mcc_ops`