ZMQ_GSSAPI(7)

💖 ZMQ_GSSAPI 💖

okay bestie, this is zmq_gssapi(7) from the 0MQ manual, and it's literally the page about secure authentication and confidentiality. it's giving "we're being responsible with our sockets" and honestly? we love that for us. 🫶

---

✨ NAME ✨

zmq_gssapi — secure authentication and confidentiality 💅

---

🌸 SYNOPSIS 🌸

so the GSSAPI mechanism defines a whole mechanism for secure authentication and confidentiality for communications between a client and a server, using the Generic Security Service Application Program Interface (GSSAPI). yes that's a mouthful. yes it's iconic. 👑

the GSSAPI mechanism can be used on both public and private networks. GSSAPI itself is defined in IETF RFC-2743: http://tools.ietf.org/html/rfc2743

and the ZeroMQ GSSAPI mechanism is defined by this document: http://rfc.zeromq.org/spec:38

no cap, those links are the lore. 📚

---

🎀 CLIENT AND SERVER ROLES 🎀

a socket using GSSAPI can be either client or server, but not both. pick a lane bestie, you can't be the main character and the love interest. 😭

• to become a GSSAPI server, the application sets the ZMQ_GSSAPI_SERVER option on the socket.
• to become a GSSAPI client, the application sets the ZMQ_GSSAPI_SERVICE_PRINCIPAL option to the name of the principal on the server to which it intends to connect.

and on client or server, the application may additionally set the ZMQ_GSSAPI_PRINCIPAL option to provide the socket with the name of the principal for whom GSSAPI credentials should be acquired. if this option is not set, default credentials are used. easy. ✨

---

🌈 OPTIONAL ENCRYPTION 🌈

by default, the GSSAPI mechanism will encrypt all communications between client and server. locked down. sealed. no one's reading your texts. 💌

but if encryption is not desired (e.g. on private networks), the client and server applications can disable it by setting the ZMQ_GSSAPI_PLAINTEXT option.

⚠️ heads up: both the client and server must set this option to the same value. matching vibes only, or it's not gonna work.

---

🦋 PRINCIPAL NAMES 🦋

principal names specified with the ZMQ_GSSAPI_SERVICE_PRINCIPAL or ZMQ_GSSAPI_PRINCIPAL options are interpreted as "host based" name types by default.

the ZMQ_GSSAPI_PRINCIPAL_NAMETYPE and ZMQ_GSSAPI_SERVICE_PRINCIPAL_NAMETYPE options may be used to change the name type to one of these:

• ZMQ_GSSAPI_NT_HOSTBASED — the name should be of the form "service" or "service@hostname", which will parse into a principal of "service/hostname" in the local realm. this is the default name type. 🏠
• ZMQ_GSSAPI_NT_USER_NAME — the name should be a local username, which will parse into a single-component principal in the local realm. 🧍
• ZMQ_GSSAPI_NT_KRB5_PRINCIPAL — the name is a principal name string. this name type only works with the krb5 GSSAPI mechanism. 🗝️

---

⭐ SEE ALSO ⭐

zmq_setsockopt(3) zmq_null(7) zmq_curve(7) zmq(7)

go read those too, they're all in the same friend group. 💖

---

👑 AUTHORS 👑

this page was written by the 0MQ community. to make a change please read the 0MQ Contribution Policy at http://www.zeromq.org/docs:contributing

like, please actually read it before you push. we're all besties here but the contribution policy is the contribution policy. 🎀

---

and that's the whole page, bestie! this was 0MQ 4.3.5, dated 10/09/2023, and the page is ZMQ_GSSAPI(7). slay, you're now GSSAPI literate. go secure something. 💅✨🌈