CODEWITHSUNDEEP
kerberosgssapi
peroksid
peroksid

Reputation: 357

gss_acquire_cred on Windows

I'm trying to acquire credentials for Administrator on Windows host. I'm under mingw64_shell.

Here is my credential:

$ klist Credentials cache: FILE:/tmp/krb5cc_1049076 Principal: [email protected]

Issued Expires Principal Jan 4 10:14:07 2016 Jan 4 20:14:07 2016 krbtgt/[email protected]

Here is my code:

#include <stdio.h>
#include <string.h>
#include <gss.h>

static void doDisplay(const char *m,OM_uint32 code,int type)
{
    OM_uint32 maj_stat, min_stat;
    gss_buffer_desc msg;
    OM_uint32 msg_ctx;

    msg_ctx = 0;
    while (1)
    {
        maj_stat = gss_display_status(&min_stat, code,
                                      type, GSS_C_NULL_OID,
                                      &msg_ctx, &msg);
        printf("GSS-API error %s - type: %s code: %d, msg: %s\n", m,
             type == GSS_C_GSS_CODE ? "major" : "minor",
             code,
             (char *)msg.value);
        gss_release_buffer(&min_stat, &msg);

        if (!msg_ctx)
            break;
    }
}

void displayError(const char *msg, OM_uint32 maj_stat, OM_uint32 min_stat)
{
    doDisplay(msg, maj_stat, GSS_C_GSS_CODE);
    doDisplay(msg, min_stat, GSS_C_MECH_CODE);
}



int getCreds(const char *service_name, gss_cred_id_t *server_creds)
{
    printf ("Test name: %s\n", service_name);
    gss_buffer_desc name_buf;
    gss_name_t server_name;
    OM_uint32 maj_stat, min_stat;

    name_buf.value = service_name;
    //name_buf.length = strlen(name_buf.value) + 1;
    name_buf.length = strlen(name_buf.value);
    maj_stat = gss_import_name(&min_stat, &name_buf,
                               (gss_OID) GSS_C_NT_HOSTBASED_SERVICE, &server_name);
    if (maj_stat != GSS_S_COMPLETE)
    {
        displayError("importing name", maj_stat, min_stat);
        return -1;
    }
    maj_stat = gss_acquire_cred(&min_stat, server_name, 0,
                                GSS_C_NULL_OID_SET, GSS_C_ACCEPT,
                                server_creds, NULL, NULL);

    if (maj_stat != GSS_S_COMPLETE)
    {
        displayError("acquiring credentials", maj_stat, min_stat);
        return -1;
    }

    (void) gss_release_name(&min_stat, &server_name);

    return 0;
}

int main(int argc, char** argv) {
        gss_cred_id_t gsscreds;
        if(getCreds(argv[1], &gsscreds) != 0)
                return 1;
}

I have compiled it as a.exe. I run it:

$ ./a.exe '[email protected]' Test name: [email protected] GSS-API error acquiring credentials - type: major code: 458752, msg: No credentials were supplied, or the credentials were unavailable or inaccessible GSS-API error acquiring credentials - type: minor code: 11, msg: No principal in keytab matches desired name

How I can fix this error?

Upvotes: 0

Views: 825

Answers (1)

Michael-O
Michael-O

Reputation: 18415

You probably misunderstood the API. The servername you are importing with GSS_C_NT_HOSTBASED_SERVICE is your target server. gss_acquire_cred needs an initiate crdential. accept is for servers/services. Services do work with keytabs only and client with caches or client keytabs. Since you have a valid credential cache for a user principal, you want to initiate a context with a client redential.

Upvotes: 0

Related Questions