KRB5_GET_CREDENTIALS(3)

💖 KRB5_GET_CREDENTIALS(3) 💖

okay bestie, so this is a Library Functions Manual page from section 3 — the krb5_get_credentials girlies. Let's get into it 🎀

✨ NAME ✨

krb5_get_credentials, krb5_get_credentials_with_flags, krb5_get_kdc_cred, krb5_get_renewed_creds — get credentials from the KDC using krbtgt

like literally, that's the whole vibe. grabbing creds from the KDC with your krbtgt 💅

📚 LIBRARY 📚

Kerberos 5 Library (libkrb5, -lkrb5)

so you're gonna link it like that, no cap 🫶

🌸 SYNOPSIS 🌸

#include <krb5.h>

krb5_error_code
krb5_get_credentials(krb5_context context, krb5_flags options,
    krb5_ccache ccache, krb5_creds *in_creds, krb5_creds **out_creds);

krb5_error_code
krb5_get_credentials_with_flags(krb5_context context,
    krb5_flags options, krb5_kdc_flags flags, krb5_ccache ccache,
    krb5_creds *in_creds, krb5_creds **out_creds);

krb5_error_code
krb5_get_kdc_cred(krb5_context context, krb5_ccache id,
    krb5_kdc_flags flags, krb5_addresses *addresses,
    Ticket *second_ticket, krb5_creds *in_creds,
    krb5_creds **out_creds);

krb5_error_code
krb5_get_renewed_creds(krb5_context context, krb5_creds *creds,
    krb5_const_principal client, krb5_ccache ccache,
    const char *in_tkt_service);

four whole functions, all serving 💅 the way that they all return krb5_error_code? iconic.

🌈 DESCRIPTION 🌈

okay so krb5_get_credentials_with_flags() gets credentials that are specified by in_creds->server and in_creds->client — and heads up, the rest of the in_creds structure is ignored, like not even looked at, periodt. it first peeks in the ccache, and if the credential doesn't exist or is expired, it goes and fetches the credential from the KDC using the krbtgt in the ccache. the credential comes back in out_creds and — super important bestie — you should free it using krb5_free_creds() 🧚

the valid flags you can pass into the options argument are:

• KRB5_GC_CACHED — only check the ccache, don't go out on the network to fetch the credential. like stay home, no travel required 💅
• KRB5_GC_USER_USER — request a user to user ticket. this option doesn't store the resulting user to user credential in the ccache. so it's giving "borrowed, never owned" ✨
• KRB5_GC_EXPIRED_OK — returns the credential even if it is expired. the default behavior is trying to refetch the credential from the KDC. so yeah, this one's the "expired is fine actually" button 🩷

⚠️ the flags are KDCOptions, and note — the caller must fill in the bit-field and not use the integer associated structure. don't do it the other way, fr fr, that's the whole warning.

krb5_get_credentials() works the same way as krb5_get_credentials_with_flags() except that the flags field is missing. same energy, minus one argument 🎀

krb5_get_kdc_cred() does the same as the functions above, but the caller must fill in all the information and it's closer to the wire protocol. so like, lowkey raw, lowkey manual mode 👑

krb5_get_renewed_creds() renews a credential given by in_tkt_service (if NULL, the default krbtgt) using the credential cache ccache. the result is stored in creds and should be freed using krb5_free_creds. yes queen, free your memory 🔥

🦋 EXAMPLES 🦋

here is a example function that get a credential from a credential cache id or the KDC and returns it to the caller. (yes bestie, that grammar is exactly what the page says, we keep everything 💖)

#include <krb5.h>

int
getcred(krb5_context context, krb5_ccache id, krb5_creds **creds)
{
    krb5_error_code ret;
    krb5_creds in;

    ret = krb5_parse_name(context, "client@EXAMPLE.COM",
                          &in.client);
    if (ret)
        krb5_err(context, 1, ret, "krb5_parse_name");

    ret = krb5_parse_name(context, "host/server.example.com@EXAMPLE.COM",
                          &in.server);
    if (ret)
        krb5_err(context, 1, ret, "krb5_parse_name");

    ret = krb5_get_credentials(context, 0, id, &in, creds);
    if (ret)
        krb5_err(context, 1, ret, "krb5_get_credentials");

    return 0;
}

see how it parses the client, parses the server, then calls krb5_get_credentials(context, 0, id, &in, creds)? and every single ret gets checked because we are not out here ignoring error codes, periodt 😤

👑 SEE ALSO 👑

• krb5(3)
• krb5_get_forwarded_creds(3)
• krb5.conf(5)

go read those too bestie, iykyk 💜

HEIMDAL — July 26, 2004 🦋✨

that's the source, the version and the date all wrapped up in one cute lil sign-off. this page came from HEIMDAL, dated July 26, 2004, and it's KRB5_GET_CREDENTIALS(3) through and through. slay, go get those credentials 💅💖