krb5(3)

📦

version 7.8.0 · 3 versions

7.8.0 · alpine 3.22, alpine 3.23, alpine 3.24, epel 10, epel 9, fedora 43, fedora 44 (latest)
14.5 · freebsd 14.5, nixpkgs unstable
11.0 · nixpkgs unstable

, in alpine 3.22, alpine 3.23, alpine 3.24, epel 10, epel 9, fedora 43, fedora 44

💖 NAME 💖

okay bestie, welcome to krb5(3) — this is the manual page for the Heimdal Kerberos 5 library, and it is a lot, but we're gonna get through it together. 🫶

✨ SYNOPSIS ✨

🎀 Functions 🎀

here's the whole entire lineup of functions this page covers — every single one, no skipping, no "etc." energy, all of them fr fr:

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_add_et_list (krb5_context context, void(*func)(struct et_list **))
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_password (krb5_context context, krb5_creds *creds, const char *newpw, krb5_principal targprinc, int *result_code, krb5_data *result_code_string, krb5_data *result_string)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_init_context (krb5_context *context)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_context (krb5_context context, krb5_context *out)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_free_context (krb5_context context)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_config_files (krb5_context context, char **filenames)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_prepend_config_files_default (const char *filelist, char ***pfilenames)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_default_config_files (char ***pfilenames)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_free_config_files (char **filenames)
KRB5_LIB_FUNCTION const krb5_enctype *KRB5_LIB_CALL krb5_kerberos_enctypes (krb5_context context)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_default_in_tkt_etypes (krb5_context context, const krb5_enctype *etypes)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_default_in_tkt_etypes (krb5_context context, krb5_pdu pdu_type, krb5_enctype **etypes)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_init_ets (krb5_context context)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_set_use_admin_kdc (krb5_context context, krb5_boolean flag)
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_get_use_admin_kdc (krb5_context context)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_add_extra_addresses (krb5_context context, krb5_addresses *addresses)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_extra_addresses (krb5_context context, const krb5_addresses *addresses)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_extra_addresses (krb5_context context, krb5_addresses *addresses)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_add_ignore_addresses (krb5_context context, krb5_addresses *addresses)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_ignore_addresses (krb5_context context, const krb5_addresses *addresses)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_ignore_addresses (krb5_context context, krb5_addresses *addresses)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_fcache_version (krb5_context context, int version)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_fcache_version (krb5_context context, int *version)
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_is_thread_safe (void)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_set_dns_canonicalize_hostname (krb5_context context, krb5_boolean flag)
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_get_dns_canonicalize_hostname (krb5_context context)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_kdc_sec_offset (krb5_context context, int32_t *sec, int32_t *usec)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_kdc_sec_offset (krb5_context context, int32_t sec, int32_t usec)
KRB5_LIB_FUNCTION time_t KRB5_LIB_CALL krb5_get_max_time_skew (krb5_context context)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_set_max_time_skew (krb5_context context, time_t t)
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_set_home_dir_access (krb5_context context, krb5_boolean allow)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_host_realm (krb5_context context, const krb5_realm *from, krb5_realm **to)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_free_cred_contents (krb5_context context, krb5_creds *c)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_creds_contents (krb5_context context, const krb5_creds *incred, krb5_creds *c)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_creds (krb5_context context, const krb5_creds *incred, krb5_creds **outcred)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_free_creds (krb5_context context, krb5_creds *c)
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_compare_creds (krb5_context context, krb5_flags whichfields, const krb5_creds *mcreds, const krb5_creds *creds)
KRB5_LIB_FUNCTION unsigned long KRB5_LIB_CALL krb5_creds_get_ticket_flags (krb5_creds *creds)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_data_zero (krb5_data *p)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_data_free (krb5_data *p)
KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_free_data (krb5_context context, krb5_data *p)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_data_alloc (krb5_data *p, int len)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_data_realloc (krb5_data *p, int len)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_data_copy (krb5_data *p, const void *data, size_t len)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_data (krb5_context context, const krb5_data *indata, krb5_data **outdata)
KRB5_LIB_FUNCTION int KRB5_LIB_CALL krb5_data_cmp (const krb5_data *data1, const krb5_data *data2)
KRB5_LIB_FUNCTION int KRB5_LIB_CALL krb5_data_ct_cmp (const krb5_data *data1, const krb5_data *data2)
KRB5_LIB_FUNCTION const char *KRB5_LIB_CALL krb5_get_err_text (krb5_context context, krb5_error_code code)
KRB5_DEPRECATED_FUNCTION('Use krb5_get_error_message instead')
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_krbhst_get_addrinfo (krb5_context context, krb5_krbhst_info *host, struct addrinfo **ai)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_free_ticket (krb5_context context, krb5_ticket *ticket)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_ticket (krb5_context context, const krb5_ticket *from, krb5_ticket **to)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_ticket_get_client (krb5_context context, const krb5_ticket *ticket, krb5_principal *client)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_ticket_get_server (krb5_context context, const krb5_ticket *ticket, krb5_principal *server)
KRB5_LIB_FUNCTION time_t KRB5_LIB_CALL krb5_ticket_get_endtime (krb5_context context, const krb5_ticket *ticket)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_ticket_get_authorization_data_type (krb5_context context, krb5_ticket *ticket, int type, krb5_data *data)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_real_time (krb5_context context, krb5_timestamp sec, int32_t usec)

🌈 Detailed Description 🌈

not me checking the original for this section and finding... literally nothing, bestie. it's just the heading, sitting there, empty, living its best life. 🦋 so we're not gonna invent anything — no vibes-only filler, no cap. straight on to the functions. 💅

📚 Function Documentation 📚

🌟 `krb5_add_et_list` 🌟

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_add_et_list (krb5_context context, void(*)(struct et_list **) func)

okay so this one adds a specified list of error messages to the et list chillin' inside your context. it calls func — and yeah, that's probably a comerr-generated function, just so you know — and it hands func a pointer to the current et_list. ✨

💬 Parameters

context — a kerberos context.
func — the generated com_err et function.

📤 Returns

Returns 0 to indicate success. Otherwise a kerberos et error code is returned, see krb5_get_error_message(). 💀

🌟 `krb5_add_extra_addresses` 🌟

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_add_extra_addresses (krb5_context context, krb5_addresses *addresses)

so bestie, this adds extra address(es) to the address list that the library is gonna tack onto the client's address list when it's talking to the KDC. iconic behavior honestly. 👑

💬 Parameters

context — Kerberos 5 context.
addresses — addresses to add.

📤 Returns

Returns 0 to indicate success. Otherwise a kerberos et error code is returned, see krb5_get_error_message().

🌟 `krb5_add_ignore_addresses` 🌟

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_add_ignore_addresses (krb5_context context, krb5_addresses *addresses)

this one adds extra addresses to ignore when it's fetching addresses from the underlying operating system. like a little blocklist, but make it Kerberos. 🙈

💬 Parameters

context — Kerberos 5 context.
addresses — addresses to ignore.

📤 Returns

Returns 0 to indicate success. Otherwise a kerberos et error code is returned, see krb5_get_error_message().

🌟 `krb5_compare_creds` 🌟

KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_compare_creds (krb5_context context, krb5_flags whichfields, const krb5_creds *mcreds, const krb5_creds *creds)

okay so: this returns TRUE if mcreds and creds are equal — and whichfields is the thing that decides what "equal" even means here. the way that one flag changes the whole comparison... it's giving choose-your-own-adventure. 🦋

the following flags, set in whichfields, affect the comparison:

KRB5_TC_MATCH_SRV_NAMEONLY — consider all realms equal when comparing the service principal.
KRB5_TC_MATCH_KEYTYPE — compare enctypes.
KRB5_TC_MATCH_FLAGS_EXACT — make sure the ticket flags are identical.
KRB5_TC_MATCH_FLAGS — make sure that all ticket flags set in mcreds are also present in creds.
KRB5_TC_MATCH_TIMES_EXACT — compares the ticket times exactly.
KRB5_TC_MATCH_TIMES — compares only the expiration times of the creds.
KRB5_TC_MATCH_AUTHDATA — compares the authdata fields.
KRB5_TC_MATCH_2ND_TKT — compares the second tickets (used by user-to-user authentication).
KRB5_TC_MATCH_IS_SKEY — compares the existence of the second ticket.

💬 Parameters

context — Kerberos 5 context.
whichfields — which fields to compare.
mcreds — cred to compare with.
creds — cred to compare with.

📤 Returns

return TRUE if mcred and creds are equal, FALSE if not.

🌟 `krb5_copy_context` 🌟

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_context (krb5_context context, krb5_context *out)

make a copy of the Kerberos 5 context! and listen — the new krb5_context shoud be freed with krb5_free_context(), don't leave it hanging bestie. 🫶

💬 Parameters

context — the Kerberos context to copy.
out — the copy of the Kerberos, set to NULL error.

📤 Returns

Returns 0 to indicate success. Otherwise a kerberos et error code is returned, see krb5_get_error_message().

🌟 `krb5_copy_creds` 🌟

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_creds (krb5_context context, const krb5_creds *incred, krb5_creds **outcred)

copy krb5_creds. that's it, that's the description. short queen. 💅

💬 Parameters

context — Kerberos 5 context.
incred — source credential.
outcred — destination credential, free with krb5_free_creds().

📤 Returns

Returns 0 to indicate success. Otherwise a kerberos et error code is returned, see krb5_get_error_message().

🌟 `krb5_copy_creds_contents` 🌟

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_creds_contents (krb5_context context, const krb5_creds *incred, krb5_creds *c)

copy content of krb5_creds.

Parameters

context — Kerberos 5 context.
incred — source credential
c — destination credential, free with krb5_free_cred_contents().

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_copy_data` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_data (krb5_context context, const krb5_data * indata, krb5_data ** outdata)

Copy the data into a newly allocated krb5_data. It's giving duplication with ✨pizazz✨.

Parameters

context — Kerberos 5 context.
indata — the krb5_data data to copy
outdata — new krb5_date to copy too. Free with krb5_free_data().

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned.

✨ `krb5_copy_host_realm` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_host_realm (krb5_context context, const krb5_realm * from, krb5_realm ** to)

Copy the list of realms from from to to. Bestie, it's a whole realm list glow-up. 💅

Parameters

context — Kerberos 5 context.
from — list of realms to copy from.
to — list of realms to copy to, free list of krb5_free_host_realm().

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_copy_ticket` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_copy_ticket (krb5_context context, const krb5_ticket * from, krb5_ticket ** to)

Copy ticket and content. 🎟️✨

Parameters

context — a Kerberos 5 context
from — ticket to copy
to — new copy of ticket, free with krb5_free_ticket()

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_creds_get_ticket_flags` ✨

KRB5_LIB_FUNCTION unsigned long KRB5_LIB_CALL krb5_creds_get_ticket_flags (krb5_creds * creds)

Returns the ticket flags for the credentials in creds. See also krb5_ticket_get_flags(). 👑

Parameters

creds — credential to get ticket flags from

Returns ticket flags

✨ `krb5_data_alloc` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_data_alloc (krb5_data * p, int len)

Allocate data of and krb5_data. (Yes, the original says "of and" — we keep it fr fr.) 💀

Parameters

p — krb5_data to allocate.
len — size to allocate.

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned.

✨ `krb5_data_cmp` ✨

KRB5_LIB_FUNCTION int KRB5_LIB_CALL krb5_data_cmp (const krb5_data * data1, const krb5_data * data2)

Compare to data. (Again, original phrasing.) It's a comparison moment. 🔍

Parameters

data1 — krb5_data to compare
data2 — krb5_data to compare

Returns return the same way as memcmp(), useful when sorting.

✨ `krb5_data_copy` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_data_copy (krb5_data * p, const void * data, size_t len)

Copy the data of len into the krb5_data. 🫶

Parameters

p — krb5_data to copy into.
data — data to copy..
len — new size.

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned.

✨ `krb5_data_ct_cmp` ✨

KRB5_LIB_FUNCTION int KRB5_LIB_CALL krb5_data_ct_cmp (const krb5_data * data1, const krb5_data * data2)

Compare to data not exposing timing information from the checksum data. This is the sneaky-safe one, no timing leaks. 🕵️♀️

Parameters

data1 — krb5_data to compare
data2 — krb5_data to compare

Returns returns zero for same data, otherwise non zero.

✨ `krb5_data_free` ✨

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_data_free (krb5_data * p)

Free the content of krb5_data structure, its ok to free a zeroed structure (with memset() or krb5_data_zero()). When done, the structure will be zeroed. The same function is called krb5_free_data_contents() in MIT Kerberos. 🧹

Parameters

p — krb5_data to free.

✨ `krb5_data_realloc` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_data_realloc (krb5_data * p, int len)

Grow (or shrink) the content of krb5_data to a new size. It's giving flexible. 🦋

Parameters

p — krb5_data to free.
len — new size.

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned.

✨ `krb5_data_zero` ✨

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_data_zero (krb5_data * p)

Reset the (potentially uninitalized) krb5_data structure. Fresh start energy. ✨

Parameters

p — krb5_data to reset.

✨ `krb5_free_config_files` ✨

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_free_config_files (char ** filenames)

Free a list of configuration files. Bye bye configs. 👋

Parameters

filenames — list, terminated with a NULL pointer, to be freed. NULL is an valid argument.

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_free_context` ✨

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_free_context (krb5_context context)

Frees the krb5_context allocated by krb5_init_context(). Clean up your room bestie. 🧼

Parameters

context — context to be freed.

✨ `krb5_free_cred_contents` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_free_cred_contents (krb5_context context, krb5_creds * c)

Free content of krb5_creds. Not the whole creds, just the contents. 💅

Parameters

context — Kerberos 5 context.
c — krb5_creds to free.

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_free_creds` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_free_creds (krb5_context context, krb5_creds * c)

Free krb5_creds. The whole thing. Gone. 💀

Parameters

context — Kerberos 5 context.
c — krb5_creds to free.

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_free_data` ✨

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_free_data (krb5_context context, krb5_data * p)

Free krb5_data (and its content). 🫧

Parameters

context — Kerberos 5 context.
p — krb5_data to free.

✨ `krb5_free_ticket` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_free_ticket (krb5_context context, krb5_ticket * ticket)

Free ticket and content. 🎟️➡️🗑️

Parameters

context — a Kerberos 5 context
ticket — ticket to free

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_get_default_config_files` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_default_config_files (char *** pfilenames)

Get the global configuration list. 🌍

Parameters

pfilenames — return array of filenames, should be freed with krb5_free_config_files().

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_get_default_in_tkt_etypes` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_default_in_tkt_etypes (krb5_context context, krb5_pdu pdu_type, krb5_enctype ** etypes)

Get the default encryption types that will be use in communcation with the KDC, clients and servers. 🔐

Parameters

context — Kerberos 5 context.
pdu_type — request type (AS, TGS or none)
etypes — Encryption types, array terminated with ETYPE_NULL(0), caller should free array with krb5_xfree():

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_get_dns_canonicalize_hostname` ✨

KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_get_dns_canonicalize_hostname (krb5_context context)

Get if the library uses DNS to canonicalize hostnames. 🌐

Parameters

context — Kerberos 5 context.

Returns return non zero if the library uses DNS to canonicalize hostnames.

✨ `krb5_get_err_text` ✨

KRB5_LIB_FUNCTION const char* KRB5_LIB_CALL krb5_get_err_text (krb5_context context, krb5_error_code code)

Return the error string for the error code. The caller must not free the string.

⚠️ This function is deprecated since its not threadsafe. ⚠️

Parameters

context — Kerberos 5 context.
code — Kerberos error code.

Returns the error message matching code

✨ `krb5_get_extra_addresses` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_extra_addresses (krb5_context context, krb5_addresses * addresses)

Get extra address to the address list that the library will add to the client's address list when communicating with the KDC. 📬

Parameters

context — Kerberos 5 context.
addresses — addreses to set

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_get_fcache_version` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_fcache_version (krb5_context context, int * version)

Get version of fcache that the library should use. 📦

Parameters

context — Kerberos 5 context.
version — version number.

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_get_ignore_addresses` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_ignore_addresses (krb5_context context, krb5_addresses * addresses)

Get extra addresses to ignore when fetching addresses from the underlaying operating system. 🙈

Parameters

context — Kerberos 5 context.
addresses — list addreses ignored

Returns Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

✨ `krb5_get_kdc_sec_offset` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_get_kdc_sec_offset (krb5_context context, int32_t * sec, int32_t * usec)

Get current offset in time to the KDC. ⏰

Parameters

context — Kerberos 5 context.
sec — seconds part of offset.
usec — micro seconds part of offset.

Returns returns zero

✨ `krb5_get_max_time_skew` ✨

KRB5_LIB_FUNCTION time_t KRB5_LIB_CALL krb5_get_max_time_skew (krb5_context context)

Get max time skew allowed. ⏳

Parameters

context — Kerberos 5 context.

Returns timeskew in seconds.

✨ `krb5_get_use_admin_kdc` ✨

KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_get_use_admin_kdc (krb5_context context)

Make the kerberos library default to the admin KDC. 👑

Parameters

context — Kerberos 5 context.

Returns boolean flag to telling the context will use admin KDC as the default KDC.

✨ `krb5_init_context` ✨

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_init_context (krb5_context * context)

Initializes the context structure and reads the configuration file /etc/krb5.conf. The structure should be freed by calling krb5_free_context() when it is no longer being used. This is the main character init. 🌟

Parameters

context — pointer to returned context

Returns Returns 0 to indicate success. Otherwise an errno code is returned. Failure means either that something bad happened during initialization (typically ENOMEM) or that Kerberos should not be used ENXIO. If the function returns HEIM_ERR_RANDOM_OFFLINE, the random source is not available and later Kerberos calls might fail.

krb5_init_context() will get one random byte to make sure our random is alive. Assumption is that once the non blocking source allows us to pull bytes, its all seeded and allows us to pull more bytes.

Most Kerberos users calls krb5_init_context(), so this is useful point where we can do the checking.

✨ `krb5_init_ets` ✨

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_init_ets (krb5_context context)

Init the built-in ets in the Kerberos library. ✨

context — kerberos context to add the ets too

(ok bestie we're literally mid-parameter-list rn — that bullet above is the tail end of the function right before this one, so we're just picking the thread back up like nothing happened 💅)

`krb5_is_thread_safe` 🧵

KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_is_thread_safe (void)

A lil runtime vibe check: was the Kerberos library complied with thread support? (yes, "complied", the original said it, we don't fix it, we respect it 💀)

Returns

TRUE if the library was compiled with thread support, FALSE if not.

`krb5_kerberos_enctypes` 🔐

KRB5_LIB_FUNCTION const krb5_enctype* KRB5_LIB_CALL krb5_kerberos_enctypes (krb5_context context)

Hands you back the list of Kerberos encryption types, sorted from most preferred all the way down to least preferred encryption type. Obsessed with the ranking energy honestly.

Heads up though — some encryption types might be disabled, so you gotta check with krb5_enctype_valid() before you actually go using the encryption type. Don't skip the vibe check. 🙈

Returns

list of enctypes, terminated with ETYPE_NULL. It's a static array compiled into the Kerberos library, so the content doesn't need to be freed. (Free real estate? No — free of charge to you. 🎀)

`krb5_krbhst_get_addrinfo` 🌐

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_krbhst_get_addrinfo (krb5_context context, krb5_krbhst_info * host, struct addrinfo ** ai)

Returns you a struct addrinfo * for a KDC host. Iconic.

It returns the struct addrinfo in ai that corresponds to the info in host. And listen — free:ing is handled by krb5_krbhst_free, so the returned ai must not be released. Do not touch it. Not yours. Hands off. 🙅‍♀️

`krb5_prepend_config_files_default` 📂

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_prepend_config_files_default (const char * filelist, char *** pfilenames)

Prepend the filename to the global configuration list. Very "let me just slide in at the front of the queue" of it. ✨

Parameters

filelist — a filename to add to the default list of filename
pfilenames — return array of filenames, should be freed with krb5_free_config_files().

Returns

Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

`krb5_set_config_files` 🗂️

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_config_files (krb5_context context, char ** filenames)

Reinit the context from a new set of filenames. Glow-up for your context, fr fr.

Parameters

context — context to add configuration too.
filenames — array of filenames, end of list is indicated with a NULL filename.

Returns

Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

`krb5_set_default_in_tkt_etypes` 🎟️

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_default_in_tkt_etypes (krb5_context context, const krb5_enctype * etypes)

Set the default encryption types that will be use in communcation with the KDC, clients and servers. The whole squad. 👑

Parameters

context — Kerberos 5 context.
etypes — Encryption types, array terminated with ETYPE_NULL (0). A value of NULL resets the encryption types to the defaults set in the configuration file.

Returns

Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

`krb5_set_dns_canonicalize_hostname` 🦋

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_set_dns_canonicalize_hostname (krb5_context context, krb5_boolean flag)

Set if the library should use DNS to canonicalize hostnames. Toggle it, bestie.

Parameters

context — Kerberos 5 context.
flag — if its dns canonicalizion is used or not.

`krb5_set_extra_addresses` 📍

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_extra_addresses (krb5_context context, const krb5_addresses * addresses)

Set extra address to the address list that the library will add to the client's address list when communicating with the KDC. Little extra sprinkle of addresses, as a treat. 🌸

Parameters

context — Kerberos 5 context.
addresses — addreses to set

Returns

Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

`krb5_set_fcache_version` 💾

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_fcache_version (krb5_context context, int version)

Set version of fcache that the library should use. Pick your fave, no judgment. 💅

Parameters

context — Kerberos 5 context.
version — version number.

Returns

Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

`krb5_set_home_dir_access` 🏠

KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_set_home_dir_access (krb5_context context, krb5_boolean allow)

Enable and disable home directory access on either the global state or the krb5_context state. By calling krb5_set_home_dir_access() with context set to NULL, the global state is configured — otherwise the state for the krb5_context is modified.

Important, bestie: for home directory access to be allowed, both the global state and the krb5_context state have to be allowed. Two yeses, zero nos. 🫶

Parameters

context — a Kerberos 5 context or NULL
allow — allow if TRUE home directory

Returns

the old value

`krb5_set_ignore_addresses` 🚫

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_ignore_addresses (krb5_context context, const krb5_addresses * addresses)

Set extra addresses to ignore when fetching addresses from the underlaying operating system. Blocked. Not on the guest list. 🙈

Parameters

context — Kerberos 5 context.
addresses — addreses to ignore

Returns

Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

`krb5_set_kdc_sec_offset` ⏰

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_kdc_sec_offset (krb5_context context, int32_t sec, int32_t usec)

Set current offset in time to the KDC. Time-zone drama, but make it Kerberos. ✨

Parameters

context — Kerberos 5 context.
sec — seconds part of offset.
usec — micro seconds part of offset.

Returns

returns zero

`krb5_set_max_time_skew` ⏳

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_set_max_time_skew (krb5_context context, time_t t)

Set max time skew allowed. How much clock drift are we tolerating today, bestie?

Parameters

context — Kerberos 5 context.
t — timeskew in seconds.

`krb5_set_password` 🔑🔐

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_password (krb5_context context, krb5_creds * creds, const char * newpw, krb5_principal targprinc, int * result_code, krb5_data * result_code_string, krb5_data * result_string)

Change password using creds. The main character moment of every password reset. 💅

Parameters

context — a Keberos context
creds — The initial kadmin/passwd for the principal or an admin principal
newpw — The new password to set
targprinc — if unset, the default principal is used.
result_code — Result code, KRB5_KPASSWD_SUCCESS is when password is changed.
result_code_string — binary message from the server, contains at least the result_code.
result_string — A message from the kpasswd service or the library in human printable form. The string is NUL terminated.

Returns

On sucess and *result_code is KRB5_KPASSWD_SUCCESS, the password is changed.

And then the source doc just... has a lonely little

sitting there all by itself. A whole stray character. She's just vibing. We keep her. 😭

`krb5_set_real_time` 🕰️

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_set_real_time (krb5_context context, krb5_timestamp sec, int32_t usec)

Set the absolute time that the caller knows the kdc has, so the kerberos library can calculate the relative diffrence beteen the KDC time and local system time. (We said "diffrence" and "beteen" exactly how the source said it, no cap. 🎀)

Parameters

context — Keberos 5 context.
sec — The applications new of 'now' in seconds
usec — The applications new of 'now' in micro seconds

Returns

Kerberos 5 error code, see krb5_get_error_message().

Extra note, and it matters: if the caller passes in a negative usec, it's assumed to be unknown and the function will use the current time usec. So don't panic. 🫶

`krb5_set_use_admin_kdc` 👑

KRB5_LIB_FUNCTION void KRB5_LIB_CALL krb5_set_use_admin_kdc (krb5_context context, krb5_boolean flag)

Make the kerberos library default to the admin KDC. Admin privileges, admin energy, admin KDC. Periodt.

Parameters

context — Kerberos 5 context.
flag — boolean flag to select if the use the admin KDC or not.

`krb5_ticket_get_authorization_data_type` 📜

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_ticket_get_authorization_data_type (krb5_context context, krb5_ticket * ticket, int type, krb5_data * data)

Extract the authorization data type of type from the ticket. Store the field in data. This function is to use for kerberos applications. ✨

Parameters

context — a Kerberos 5 context
ticket — Kerberos ticket
type — type to fetch
data — returned data, free with krb5_data_free()

`krb5_ticket_get_client` 🧑‍💻

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_ticket_get_client (krb5_context context, const krb5_ticket * ticket, krb5_principal * client)

Return client principal in ticket. Who are you, per this ticket? 🌈

Parameters

context — a Kerberos 5 context
ticket — ticket to copy
client — client principal, free with krb5_free_principal()

Returns

Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

`krb5_ticket_get_endtime` ⌛

KRB5_LIB_FUNCTION time_t KRB5_LIB_CALL krb5_ticket_get_endtime (krb5_context context, const krb5_ticket * ticket)

Return end time of ticket. When does this ticket's story end? 😭

Parameters

context — a Kerberos 5 context
ticket — ticket to copy

Returns

end time of ticket

`krb5_ticket_get_server` 🖥️

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_ticket_get_server (krb5_context context, const krb5_ticket * ticket, krb5_principal * server)

Return server principal in ticket. The other half of the ticket's little duo. 🫶

Parameters

context — a Kerberos 5 context
ticket — ticket to copy
server — server principal, free with krb5_free_principal()

Returns

Returns 0 to indicate success. Otherwise an kerberos et error code is returned, see krb5_get_error_message().

Author ✍️

Generated automatically by Doxygen for Heimdal Kerberos 5 library from the source code. (Not me, not you, not a human — Doxygen did that. Slay, I guess. 🤖✨)

And that's a wrap on the whole krb5(3) page, bestie!! 🎉💖 We did it, we made it to the end, and the footer says we're on Version 7.8.0, dated Tue Nov 15 2022, living in section krb5(3). So screenshot that, hydrate, and go use krb5_free_principal() on everything you've been holding onto. 👑🌸

📦 where this page comes from

alpine 3.22: heimdal-doc 7.8.0-r4 · BSD-3-Clause
alpine 3.23: heimdal-doc 7.8.0-r5 · BSD-3-Clause
alpine 3.24: heimdal-doc 7.8.0-r5 · BSD-3-Clause
epel 10: heimdal-devel 7.8.0-26.el10_2 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
epel 9: heimdal-devel 7.8.0-5.el9 · BSD and MIT
fedora 43: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 43: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-28.fc44 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-28.fc44 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms

krb5(3)

💖 NAME 💖

✨ SYNOPSIS ✨

🎀 Functions 🎀

🌈 Detailed Description 🌈

📚 Function Documentation 📚

🌟 krb5_add_et_list 🌟

💬 Parameters

📤 Returns

🌟 krb5_add_extra_addresses 🌟

💬 Parameters

📤 Returns

🌟 krb5_add_ignore_addresses 🌟

💬 Parameters

📤 Returns

🌟 krb5_compare_creds 🌟

💬 Parameters

📤 Returns

🌟 krb5_copy_context 🌟

💬 Parameters

📤 Returns

🌟 krb5_copy_creds 🌟

💬 Parameters

📤 Returns

🌟 krb5_copy_creds_contents 🌟

✨ krb5_copy_data ✨

✨ krb5_copy_host_realm ✨

✨ krb5_copy_ticket ✨

✨ krb5_creds_get_ticket_flags ✨

✨ krb5_data_alloc ✨

✨ krb5_data_cmp ✨

✨ krb5_data_copy ✨

✨ krb5_data_ct_cmp ✨

✨ krb5_data_free ✨

✨ krb5_data_realloc ✨

✨ krb5_data_zero ✨

✨ krb5_free_config_files ✨

✨ krb5_free_context ✨

✨ krb5_free_cred_contents ✨

✨ krb5_free_creds ✨

✨ krb5_free_data ✨

✨ krb5_free_ticket ✨

✨ krb5_get_default_config_files ✨

✨ krb5_get_default_in_tkt_etypes ✨

✨ krb5_get_dns_canonicalize_hostname ✨

✨ krb5_get_err_text ✨

✨ krb5_get_extra_addresses ✨

✨ krb5_get_fcache_version ✨

✨ krb5_get_ignore_addresses ✨

✨ krb5_get_kdc_sec_offset ✨

✨ krb5_get_max_time_skew ✨

✨ krb5_get_use_admin_kdc ✨

✨ krb5_init_context ✨

✨ krb5_init_ets ✨

krb5_is_thread_safe 🧵

krb5_kerberos_enctypes 🔐

krb5_krbhst_get_addrinfo 🌐

krb5_prepend_config_files_default 📂

krb5_set_config_files 🗂️

krb5_set_default_in_tkt_etypes 🎟️

krb5_set_dns_canonicalize_hostname 🦋

krb5_set_extra_addresses 📍

krb5_set_fcache_version 💾

krb5_set_home_dir_access 🏠

krb5_set_ignore_addresses 🚫

krb5_set_kdc_sec_offset ⏰

krb5_set_max_time_skew ⏳

krb5_set_password 🔑🔐

krb5_set_real_time 🕰️

krb5_set_use_admin_kdc 👑

krb5_ticket_get_authorization_data_type 📜

krb5_ticket_get_client 🧑‍💻

krb5_ticket_get_endtime ⌛

krb5_ticket_get_server 🖥️

Author ✍️

🌟 `krb5_add_et_list` 🌟

🌟 `krb5_add_extra_addresses` 🌟

🌟 `krb5_add_ignore_addresses` 🌟

🌟 `krb5_compare_creds` 🌟

🌟 `krb5_copy_context` 🌟

🌟 `krb5_copy_creds` 🌟

🌟 `krb5_copy_creds_contents` 🌟

✨ `krb5_copy_data` ✨

✨ `krb5_copy_host_realm` ✨

✨ `krb5_copy_ticket` ✨

✨ `krb5_creds_get_ticket_flags` ✨

✨ `krb5_data_alloc` ✨

✨ `krb5_data_cmp` ✨

✨ `krb5_data_copy` ✨

✨ `krb5_data_ct_cmp` ✨

✨ `krb5_data_free` ✨

✨ `krb5_data_realloc` ✨

✨ `krb5_data_zero` ✨

✨ `krb5_free_config_files` ✨

✨ `krb5_free_context` ✨

✨ `krb5_free_cred_contents` ✨

✨ `krb5_free_creds` ✨

✨ `krb5_free_data` ✨

✨ `krb5_free_ticket` ✨

✨ `krb5_get_default_config_files` ✨

✨ `krb5_get_default_in_tkt_etypes` ✨

✨ `krb5_get_dns_canonicalize_hostname` ✨

✨ `krb5_get_err_text` ✨

✨ `krb5_get_extra_addresses` ✨

✨ `krb5_get_fcache_version` ✨

✨ `krb5_get_ignore_addresses` ✨

✨ `krb5_get_kdc_sec_offset` ✨

✨ `krb5_get_max_time_skew` ✨

✨ `krb5_get_use_admin_kdc` ✨

✨ `krb5_init_context` ✨

✨ `krb5_init_ets` ✨

`krb5_is_thread_safe` 🧵

`krb5_kerberos_enctypes` 🔐

`krb5_krbhst_get_addrinfo` 🌐

`krb5_prepend_config_files_default` 📂

`krb5_set_config_files` 🗂️

`krb5_set_default_in_tkt_etypes` 🎟️

`krb5_set_dns_canonicalize_hostname` 🦋

`krb5_set_extra_addresses` 📍

`krb5_set_fcache_version` 💾

`krb5_set_home_dir_access` 🏠

`krb5_set_ignore_addresses` 🚫

`krb5_set_kdc_sec_offset` ⏰

`krb5_set_max_time_skew` ⏳

`krb5_set_password` 🔑🔐

`krb5_set_real_time` 🕰️

`krb5_set_use_admin_kdc` 👑

`krb5_ticket_get_authorization_data_type` 📜

`krb5_ticket_get_client` 🧑‍💻

`krb5_ticket_get_endtime` ⌛

`krb5_ticket_get_server` 🖥️