krb5_keytab(3)

📦

version 7.8.0 · 3 versions

7.8.0 · alpine 3.22, alpine 3.23, alpine 3.24, epel 10, epel 9, fedora 43, fedora 44 (latest)
14.5 · freebsd 14.5, nixpkgs unstable
11.0 · nixpkgs unstable

, in alpine 3.22, alpine 3.23, alpine 3.24, epel 10, epel 9, fedora 43, fedora 44

💖 krb5_keytab 💖

okay bestie, welcome to the Heimdal Kerberos 5 library glow-up corner 🌸 this is the krb5_keytab(3) page and it's giving keytab handling functions energy, no cap ✨

✨ NAME ✨

krb5_keytab — the Heimdal Kerberos 5 keytab handling functions, aka the whole friend group of calls that deal with your keytabs 🎀

🌈 SYNOPSIS 🌈

🦋 Functions 🦋

okay so these are literally all the functions, and I'm not skipping a single one because every one of them is iconic in its own way 💅

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_register
    (krb5_context context, const krb5_kt_ops *ops)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_resolve
    (krb5_context context, const char *name, krb5_keytab *id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_default_name
    (krb5_context context, char *name, size_t namesize)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
    krb5_kt_default_modify_name (krb5_context context, char *name,
    size_t namesize)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_default
    (krb5_context context, krb5_keytab *id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_read_service_key
    (krb5_context context, krb5_pointer keyprocarg, krb5_principal
    principal, krb5_kvno vno, krb5_enctype enctype, krb5_keyblock **key)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_get_type
    (krb5_context context, krb5_keytab keytab, char *prefix, size_t
    prefixsize)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_get_name
    (krb5_context context, krb5_keytab keytab, char *name, size_t
    namesize)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_get_full_name
    (krb5_context context, krb5_keytab keytab, char **str)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_close
    (krb5_context context, krb5_keytab id)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_destroy
    (krb5_context context, krb5_keytab id)
KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_kt_compare
    (krb5_context context, krb5_keytab_entry *entry,
    krb5_const_principal principal, krb5_kvno vno, krb5_enctype enctype)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_get_entry
    (krb5_context context, krb5_keytab id, krb5_const_principal
    principal, krb5_kvno kvno, krb5_enctype enctype, krb5_keytab_entry
    *entry)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL
    krb5_kt_copy_entry_contents (krb5_context context, const
    krb5_keytab_entry *in, krb5_keytab_entry *out)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_free_entry
    (krb5_context context, krb5_keytab_entry *entry)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_start_seq_get
    (krb5_context context, krb5_keytab id, krb5_kt_cursor *cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_next_entry
    (krb5_context context, krb5_keytab id, krb5_keytab_entry *entry,
    krb5_kt_cursor *cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_end_seq_get
    (krb5_context context, krb5_keytab id, krb5_kt_cursor *cursor)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_add_entry
    (krb5_context context, krb5_keytab id, krb5_keytab_entry *entry)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_remove_entry
    (krb5_context context, krb5_keytab id, krb5_keytab_entry *entry)
KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_have_content
    (krb5_context context, krb5_keytab id)

🔥 Detailed Description 🔥

okay so bestie, this is where the lore usually goes… and right now it's just the heading sitting there looking pretty 👑 this part of the page is literally empty, and the rest of the story is coming up next, so stay with me 🫶

to be continued… 🌟

💖 Function Documentation 💖

Okay bestie, this is the main event — every function in this family, one by one. Quick heads-up before we start: the original page says "a Keberos context" for basically every context param, and yes, that's a typo for "Kerberos", and no, I'm not fixing it, because our job is to keep every detail exactly as it is. So every time you see "a Keberos context" below, that's canon. 💅

🌸 `krb5_kt_add_entry`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_add_entry
    (krb5_context context, krb5_keytab id, krb5_keytab_entry * entry)

Add the entry in entry to the keytab id. Slap it in there, it's official now. ✨

Parameters

context — a Keberos context.
id — a keytab.
entry — the entry to add.

Returns

Return an error code or 0, see krb5_get_error_message().

🎀 `krb5_kt_close`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_close
    (krb5_context context, krb5_keytab id)

Finish using the keytab in id. All resources will be released, even on errors. So like, even if it goes wrong, it still cleans up after itself. Responsible queen behavior fr fr. 👑

Parameters

context — a Keberos context.
id — keytab to close.

Returns

Return an error code or 0, see krb5_get_error_message().

🦋 `krb5_kt_compare`

KRB5_LIB_FUNCTION krb5_boolean KRB5_LIB_CALL krb5_kt_compare
    (krb5_context context, krb5_keytab_entry * entry,
     krb5_const_principal principal, krb5_kvno vno, krb5_enctype enctype)

Compare entry against principal, vno, enctype. Any of principal, vno, enctype might be 0, which acts as a wildcard. Return TRUE if they compare the same, FALSE otherwise. It's giving "match me or don't, I'm flexible". 💫

Parameters

context — a Keberos context.
entry — an entry to match with.
principal — principal to match, NULL matches all principals.
vno — key version to match, 0 matches all key version numbers.
enctype — encryption type to match, 0 matches all encryption types.

Returns

Return TRUE or match, FALSE if not matched.

🍓 `krb5_kt_copy_entry_contents`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_copy_entry_contents
    (krb5_context context, const krb5_keytab_entry * in,
     krb5_keytab_entry * out)

Copy the contents of in into out. Dupe it, basically — a little copy-paste moment but make it C. 🫶

Parameters

context — a Keberos context.
in — the keytab entry to copy.
out — the copy of the keytab entry, free with krb5_kt_free_entry().

Returns

Return an error code or 0, see krb5_get_error_message().

🌈 `krb5_kt_default`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_default
    (krb5_context context, krb5_keytab * id)

Set id to the default keytab. The main character keytab, the one everybody means when they don't say which one. ⭐

Parameters

context — a Keberos context.
id — the new default keytab.

Returns

Return an error code or 0, see krb5_get_error_message().

💜 `krb5_kt_default_modify_name`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_default_modify_name
    (krb5_context context, char * name, size_t namesize)

Copy the name of the default modify keytab into name. Note that it's specifically the modify one — this is not the same call as the next one, don't mix them up bestie. 🚨

Parameters

context — a Keberos context.
name — buffer where the name will be written.
namesize — length of name.

Returns

Return an error code or 0, see krb5_get_error_message().

🧚 `krb5_kt_default_name`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_default_name
    (krb5_context context, char * name, size_t namesize)

copy the name of the default keytab into name. (Yes, the original is lowercase here. I'm keeping it, it's cute. 💅)

Parameters

context — a Keberos context.
name — buffer where the name will be written.
namesize — length of name.

Returns

Return an error code or 0, see krb5_get_error_message().

🔥 `krb5_kt_destroy`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_destroy
    (krb5_context context, krb5_keytab id)

Destroy (remove) the keytab in id. All resources will be released, even on errors, and it does the equvalment of krb5_kt_close() on the resources. So it's not just a goodbye, it's a goodbye and also delete everything. Dramatic, iconic, irreversible. 💀

Parameters

context — a Keberos context.
id — keytab to destroy.

Returns

Return an error code or 0, see krb5_get_error_message().

🎀 `krb5_kt_end_seq_get`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_end_seq_get
    (krb5_context context, krb5_keytab id, krb5_kt_cursor * cursor)

Release all resources associated with cursor. Cleanup era. ✨

Parameters

context — a Keberos context.
id — a keytab.
cursor — the cursor to free.

Returns

Return an error code or 0, see krb5_get_error_message().

🦋 `krb5_kt_free_entry`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_free_entry
    (krb5_context context, krb5_keytab_entry * entry)

Free the contents of entry. Let it go, let it goooo. 🌬️

Parameters

context — a Keberos context.
entry — the entry to free.

Returns

Return an error code or 0, see krb5_get_error_message().

💖 `krb5_kt_get_entry`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_get_entry
    (krb5_context context, krb5_keytab id, krb5_const_principal principal,
     krb5_kvno kvno, krb5_enctype enctype, krb5_keytab_entry * entry)

Retrieve the keytab entry for principal, kvno, enctype into entry from the keytab id. Matching is done like krb5_kt_compare(). So same wildcard energy as above, but this time it actually fetches the thing. 💫

Parameters

context — a Keberos context.
id — a keytab.
principal — principal to match, NULL matches all principals.
kvno — key version to match, 0 matches all key version numbers.
enctype — encryption type to match, 0 matches all encryption types.
entry — the returned entry, free with krb5_kt_free_entry().

Returns

Return an error code or 0, see krb5_get_error_message().

🌸 `krb5_kt_get_full_name`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_get_full_name
    (krb5_context context, krb5_keytab keytab, char ** str)

Retrieve the full name of the keytab keytab and store the name in str. Full name only, government name, no nicknames. 👑

Parameters

context — a Keberos context.
keytab — keytab to get name for.
str — the name of the keytab name, usee krb5_xfree() to free the string. On error, *str is set to NULL.

Returns

Return an error code or 0, see krb5_get_error_message().

🍓 `krb5_kt_get_name`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_get_name
    (krb5_context context, krb5_keytab keytab, char * name, size_t namesize)

Retrieve the name of the keytab keytab into name, namesize. 🫶

Parameters

context — a Keberos context.
keytab — the keytab to get the name for.
name — name buffer.
namesize — size of name buffer.

Returns

Return an error code or 0, see krb5_get_error_message().

🌈 `krb5_kt_get_type`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_get_type
    (krb5_context context, krb5_keytab keytab, char * prefix,
     size_t prefixsize)

Return the type of the keytab in the string prefix of length prefixsize. The type! Not the name! The type! It's giving "which flavor of keytab are we even dealing with". ⭐

Parameters

context — a Keberos context.
keytab — the keytab to get the prefix for.
prefix — prefix buffer.
prefixsize — length of prefix buffer.

Returns

Return an error code or 0, see krb5_get_error_message().

💜 `krb5_kt_have_content`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_have_content
    (krb5_context context, krb5_keytab id)

Return true if the keytab exists and have entries. Vibe check: is there actually anything in here or is it just an empty little file with dreams. 🙈

Parameters

context — a Keberos context.
id — a keytab.

Returns

Return an error code or 0, see krb5_get_error_message().

🧚 `krb5_kt_next_entry`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_next_entry
    (krb5_context context, krb5_keytab id, krb5_keytab_entry * entry,
     krb5_kt_cursor * cursor)

Get the next entry from keytab, advance the cursor. On last entry the function will return KRB5_KT_END. So you loop until KRB5_KT_END shows up and then you know the party's over. 🎉

Parameters

context — a Keberos context.
id — a keytab.
entry — the returned entry, free with krb5_kt_free_entry().
cursor — the cursor of the iteration.

Returns

Return an error code or 0, see krb5_get_error_message().

🔥 `krb5_kt_read_service_key`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_read_service_key
    (krb5_context context, krb5_pointer keyprocarg, krb5_principal principal,
     krb5_kvno vno, krb5_enctype enctype, krb5_keyblock ** key)

Read the key identified by (principal, vno, enctype) from the keytab in keyprocarg (the default if == NULL) into *key. ✨

Parameters

context — a Keberos context.
keyprocarg
principal
vno
enctype
key

Returns

Return an error code or 0, see krb5_get_error_message().

🎀 `krb5_kt_register`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_register
    (krb5_context context, const krb5_kt_ops * ops)

Parameters

context — a Keberos context.
ops — a backend to register.

Returns

Return an error code or 0, see krb5_get_error_message().

🦋 `krb5_kt_remove_entry`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_remove_entry
    (krb5_context context, krb5_keytab id, krb5_keytab_entry * entry)

Remove an entry from the keytab, matching is done using krb5_kt_compare(). Bye bye entry, you will not be missed (jk, but also you're gone now). 😭

Parameters

context — a Keberos context.
id — a keytab.
entry — the entry to remove.

Returns

Return an error code or 0, see krb5_get_error_message().

💖 `krb5_kt_resolve`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_resolve
    (krb5_context context, const char * name, krb5_keytab * id)

Resolve the keytab name (of the form type:residual) in name into a keytab in id. It's giving "turn this little string into a whole actual keytab object". 🌈

Parameters

context — a Keberos context.
name — name to resolve.
id — resulting keytab, free with krb5_kt_close().

Returns

Return an error code or 0, see krb5_get_error_message().

🌸 `krb5_kt_start_seq_get`

KRB5_LIB_FUNCTION krb5_error_code KRB5_LIB_CALL krb5_kt_start_seq_get
    (krb5_context context, krb5_keytab id, krb5_kt_cursor * cursor)

Set cursor to point at the beginning of id. Start of the list, back to the top, ready to iterate. ⭐

Parameters

context — a Keberos context.
id — a keytab.
cursor — a newly allocated cursor, free with krb5_kt_end_seq_get().

Returns

Return an error code or 0, see krb5_get_error_message().

✨ Author ✨

Generated automatically by Doxygen for Heimdal Kerberos 5 library from the source code.

and that's the whole page bestie!! 🫶 this was Version 7.8.0, dated Tue Nov 15 2022, filed under krb5_keytab(3) — and the fact that it was auto-generated by Doxygen from the source code is honestly the most real thing about it. no cap, you now know more about keytabs than 99% of the group chat. mwah 💖💅✨

📦 where this page comes from

alpine 3.22: heimdal-doc 7.8.0-r4 · BSD-3-Clause
alpine 3.23: heimdal-doc 7.8.0-r5 · BSD-3-Clause
alpine 3.24: heimdal-doc 7.8.0-r5 · BSD-3-Clause
epel 10: heimdal-devel 7.8.0-26.el10_2 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
epel 9: heimdal-devel 7.8.0-5.el9 · BSD and MIT
fedora 43: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 43: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-26.fc43 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-28.fc44 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
fedora 44: heimdal-devel 7.8.0-28.fc44 · BSD-2-Clause AND BSD-3-Clause AND HPND-export-US AND HPND-export2-US AND LicenseRef-Fedora-Public-Domain
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms

krb5_keytab(3)

💖 krb5_keytab 💖

✨ NAME ✨

🌈 SYNOPSIS 🌈

🦋 Functions 🦋

🔥 Detailed Description 🔥

💖 Function Documentation 💖

🌸 krb5_kt_add_entry

🎀 krb5_kt_close

🦋 krb5_kt_compare

🍓 krb5_kt_copy_entry_contents

🌈 krb5_kt_default

💜 krb5_kt_default_modify_name

🧚 krb5_kt_default_name

🔥 krb5_kt_destroy

🎀 krb5_kt_end_seq_get

🦋 krb5_kt_free_entry

💖 krb5_kt_get_entry

🌸 krb5_kt_get_full_name

🍓 krb5_kt_get_name

🌈 krb5_kt_get_type

💜 krb5_kt_have_content

🧚 krb5_kt_next_entry

🔥 krb5_kt_read_service_key

🎀 krb5_kt_register

🦋 krb5_kt_remove_entry

💖 krb5_kt_resolve

🌸 krb5_kt_start_seq_get

✨ Author ✨

🌸 `krb5_kt_add_entry`

🎀 `krb5_kt_close`

🦋 `krb5_kt_compare`

🍓 `krb5_kt_copy_entry_contents`

🌈 `krb5_kt_default`

💜 `krb5_kt_default_modify_name`

🧚 `krb5_kt_default_name`

🔥 `krb5_kt_destroy`

🎀 `krb5_kt_end_seq_get`

🦋 `krb5_kt_free_entry`

💖 `krb5_kt_get_entry`

🌸 `krb5_kt_get_full_name`

🍓 `krb5_kt_get_name`

🌈 `krb5_kt_get_type`

💜 `krb5_kt_have_content`

🧚 `krb5_kt_next_entry`

🔥 `krb5_kt_read_service_key`

🎀 `krb5_kt_register`

🦋 `krb5_kt_remove_entry`

💖 `krb5_kt_resolve`

🌸 `krb5_kt_start_seq_get`