KRB5_SET_PASSWORD(3)

💖 KRB5_SET_PASSWORD(3) 💖

okay bestie, pull up a chair, because this is the change your password page of the Kerberos 5 Library manual, and it's giving very much "let me in, I forgot my password" energy 🔐✨

📚 LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5) 🫶

✨ SYNOPSIS

#include <krb5.h>

krb5_error_code
krb5_change_password(krb5_context context, krb5_creds *creds,
    char *newpw, int *result_code, krb5_data *result_code_string,
    krb5_data *result_string);

krb5_error_code
krb5_set_password(krb5_context context, krb5_creds *creds, char *newpw,
    krb5_principal targprinc, int *result_code,
    krb5_data *result_code_string, krb5_data *result_string);

krb5_error_code
krb5_set_password_using_ccache(krb5_context context, krb5_ccache ccache,
    char *newpw, krb5_principal targprinc, int *result_code,
    krb5_data *result_code_string, krb5_data *result_string);

const char *
krb5_passwd_result_to_string(krb5_context context, int result);

no cap, that's a lot of parameters. but we're gonna get through this together 💅

🌸 DESCRIPTION

So here's the tea: these functions change the password for a given principal. that's the whole vibe. 🎀

krb5_set_password() and krb5_set_password_using_ccache() are the newer ones out of the three, and they use a newer version of the protocol — and also fall back to the older set-password protocol if the newer protocol doesn't work. lowkey iconic of them to have a backup plan 🦋

krb5_change_password() sets the password newpasswd for the client principal in creds. the server principal of creds must be kadmin/changepw. that part is not optional, bestie, that's the rule 📌

krb5_set_password() and krb5_set_password_using_ccache() change the password for the principal targprinc.

krb5_set_password() requires that the credential for kadmin/changepw@REALM is in creds. if the user caller isn't an administrator, this credential needs to be an initial credential — go look at krb5_get_init_creds(3) for how to get such credentials. iykyk 😌

krb5_set_password_using_ccache() will get the credential from ccache. very much "it's already in my bag, no need to ask" energy 👜✨

if targprinc is NULL, then krb5_set_password_using_ccache() uses the default principal in ccache, and krb5_set_password() uses the global default principal. so like, it'll just pick for you 🙈

all three functions return an error in result_code, and maybe an error string to print in result_string. so check your result_code, bestie, it's literally telling you what happened 💀

krb5_passwd_result_to_string() returns a human readable string describing the error code in result_code from the krb5_set_password() functions. it's the translator friend who turns cryptic error numbers into actual sentences 🫶

👀 SEE ALSO

• krb5_ccache(3)
• krb5_init_context(3)

reminder: this page is HEIMDAL's, dated July 15, 2004, and it's the KRB5_SET_PASSWORD(3) page. slay, go change that password responsibly 💖🌈👑

that's the whole page, bestie — go forth and authenticate ✨