diff options
Diffstat (limited to 'usr/src/man/man3gss/gss_init_sec_context.3gss')
| -rw-r--r-- | usr/src/man/man3gss/gss_init_sec_context.3gss | 101 |
1 files changed, 6 insertions, 95 deletions
diff --git a/usr/src/man/man3gss/gss_init_sec_context.3gss b/usr/src/man/man3gss/gss_init_sec_context.3gss index bfb885e01a..992eeec3b3 100644 --- a/usr/src/man/man3gss/gss_init_sec_context.3gss +++ b/usr/src/man/man3gss/gss_init_sec_context.3gss @@ -3,7 +3,7 @@ .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License. .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License. .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner] -.TH gss_init_sec_context 3GSS "22 May 2006" "SunOS 5.11" "Generic Security Services API Library Functions" +.TH GSS_INIT_SEC_CONTEXT 3GSS "May 22, 2006" .SH NAME gss_init_sec_context \- initiate a GSS-API security context with a peer application @@ -29,23 +29,19 @@ cc [ \fIflag\fR\&.\|.\|. ] \fIfile\fR\&.\|.\|. \fB-lgss\fR [ \fIlibrary\fR\&.\|. The parameter descriptions for \fBgss_init_sec_context()\fR follow: .sp .ne 2 -.mk .na \fB\fIminor_status\fR\fR .ad .RS 25n -.rt A mechanism specific status code. .RE .sp .ne 2 -.mk .na \fB\fIinitiator_cred_handle\fR\fR .ad .RS 25n -.rt The handle for the credentials claimed. Supply \fBGSS_C_NO_CREDENTIAL\fR to act as a default initiator principal. If no default initiator is defined, the function returns \fBGSS_S_NO_CRED\fR. @@ -53,12 +49,10 @@ function returns \fBGSS_S_NO_CRED\fR. .sp .ne 2 -.mk .na \fB\fIcontext_handle\fR\fR .ad .RS 25n -.rt The context handle for a new context. Supply the value \fBGSS_C_NO_CONTEXT\fR for the first call, and use the value returned in any continuation calls. The resources associated with \fIcontext_handle\fR must be released by the @@ -67,71 +61,59 @@ application after use by a call to \fBgss_delete_sec_context\fR(3GSS). .sp .ne 2 -.mk .na \fB\fItarget_name\fR\fR .ad .RS 25n -.rt The name of the context acceptor. .RE .sp .ne 2 -.mk .na \fB\fImech_type\fR\fR .ad .RS 25n -.rt The object \fBID\fR of the desired mechanism. To obtain a specific default, supply the value \fBGSS_C_NO_ID\fR. .RE .sp .ne 2 -.mk .na \fB\fIreq_flags\fR\fR .ad .RS 25n -.rt Contains independent flags, each of which will request that the context support a specific service option. A symbolic name is provided for each flag. Logically-\fBOR\fR the symbolic name to the corresponding required flag to form the bit-mask value. \fIreq_flags\fR may contain one of the following values: .sp .ne 2 -.mk .na \fB\fBGSS_C_DELEG_FLAG\fR\fR .ad .RS 23n -.rt If true, delegate credentials to a remote peer. Do not delegate the credentials if the value is false. .RE .sp .ne 2 -.mk .na \fB\fBGSS_C_MUTUAL_FLAG\fR\fR .ad .RS 23n -.rt If true, request that the peer authenticate itself. If false, authenticate to the remote peer only. .RE .sp .ne 2 -.mk .na \fB\fBGSS_C_REPLAY_FLAG\fR\fR .ad .RS 23n -.rt If true, enable replay detection for messages protected with \fBgss_wrap\fR(3GSS) or \fBgss_get_mic\fR(3GSS). Do not attempt to detect replayed messages if false. @@ -139,24 +121,20 @@ replayed messages if false. .sp .ne 2 -.mk .na \fB\fBGSS_C_SEQUENCE_FLAG\fR\fR .ad .RS 23n -.rt If true, enable detection of out-of-sequence protected messages. Do not attempt to detect out-of-sequence messages if false. .RE .sp .ne 2 -.mk .na \fB\fBGSS_C_CONF_FLAG\fR\fR .ad .RS 23n -.rt If true, request that confidential service be made available by means of \fBgss_wrap\fR(3GSS). If false, no per-message confidential service is required. @@ -164,12 +142,10 @@ required. .sp .ne 2 -.mk .na \fB\fBGSS_C_INTEG_FLAG\fR\fR .ad .RS 23n -.rt If true, request that integrity service be made available by means of \fBgss_wrap\fR(3GSS) or \fBgss_get_mic\fR(3GSS). If false, no per-message integrity service is required. @@ -177,12 +153,10 @@ integrity service is required. .sp .ne 2 -.mk .na \fB\fBGSS_C_ANON_FLAG\fR\fR .ad .RS 23n -.rt If true, do not reveal the initiator's identify to the acceptor. If false, authenticate normally. .RE @@ -191,24 +165,20 @@ authenticate normally. .sp .ne 2 -.mk .na \fB\fItime_req\fR\fR .ad .RS 25n -.rt The number of seconds for which the context will remain valid. Supply a zero value to \fItime_req\fR to request a default validity period. .RE .sp .ne 2 -.mk .na \fB\fIinput_chan_bindings\fR\fR .ad .RS 25n -.rt Optional application-specified bindings. Allows application to securely bind channel identification information to the security context. Set to \fBGSS_C_NO_CHANNEL_BINDINGS\fR if you do not want to use channel bindings. @@ -216,12 +186,10 @@ channel identification information to the security context. Set to .sp .ne 2 -.mk .na \fB\fIinput_token\fR\fR .ad .RS 25n -.rt Token received from the peer application. On the initial call, supply \fBGSS_C_NO_BUFFER\fR or a pointer to a buffer containing the value \fBGSS_C_EMPTY_BUFFER\fR. @@ -229,12 +197,10 @@ Token received from the peer application. On the initial call, supply .sp .ne 2 -.mk .na \fB\fIactual_mech_type\fR\fR .ad .RS 25n -.rt The actual mechanism used. The \fBOID\fR returned by means of this parameter will be pointer to static storage that should be treated as read-only. The application should not attempt to free it. To obtain a specific default, supply @@ -244,12 +210,10 @@ required. .sp .ne 2 -.mk .na \fB\fIoutput_token\fR\fR .ad .RS 25n -.rt The token to send to the peer application. If the length field of the returned buffer is zero, no token need be sent to the peer application. After use storage associated with this buffer must be freed by the application by a call @@ -258,12 +222,10 @@ to \fBgss_release_buffer\fR(3GSS). .sp .ne 2 -.mk .na \fB\fIret_flags\fR\fR .ad .RS 25n -.rt Contains various independent flags, each of which indicates that the context supports a specific service option. If not needed, specify \fBNULL\fR. Test the returned bit-mask \fIret_flags\fR value against its symbolic name to determine @@ -271,60 +233,50 @@ if the given option is supported by the context. \fIret_flags\fR may contain one of the following values: .sp .ne 2 -.mk .na \fB\fBGSS_C_DELEG_FLAG\fR\fR .ad .RS 25n -.rt If true, credentials were delegated to the remote peer. If false, no credentials were delegated. .RE .sp .ne 2 -.mk .na \fB\fBGSS_C_MUTUAL_FLAG\fR\fR .ad .RS 25n -.rt If true, the remote peer authenticated itself. If false, the remote peer did not authenticate itself. .RE .sp .ne 2 -.mk .na \fB\fBGSS_C_REPLAY_FLAG\fR\fR .ad .RS 25n -.rt If true, replay of protected messages will be detected. If false, replayed messages will not be detected. .RE .sp .ne 2 -.mk .na \fB\fBGSS_C_SEQUENCE_FLAG\fR\fR .ad .RS 25n -.rt If true, out of sequence protected messages will be detected. If false, they will not be detected. .RE .sp .ne 2 -.mk .na \fB\fBGSS_C_CONF_FLAG\fR\fR .ad .RS 25n -.rt If true, confidential service may be invoked by calling the \fBgss_wrap()\fR routine. If false, no confidentiality service is available by means of \fBgss_wrap\fR(3GSS). \fBgss_wrap()\fR will provide message encapsulation, @@ -333,12 +285,10 @@ data-origin authentication and integrity services only. .sp .ne 2 -.mk .na \fB\fBGSS_C_INTEG_FLAG\fR\fR .ad .RS 25n -.rt If true, integrity service may be invoked by calling either the \fBgss_wrap\fR(3GSS) or \fBgss_get_mic\fR(3GSS) routine. If false, per-message integrity service is not available. @@ -346,12 +296,10 @@ integrity service is not available. .sp .ne 2 -.mk .na \fB\fBGSS_C_ANON_FLAG\fR\fR .ad .RS 25n -.rt If true, the initiator's identity has not been revealed; it will not be revealed if any emitted token is passed to the acceptor. If false, the initiator has been or will be authenticated normally. @@ -359,12 +307,10 @@ initiator has been or will be authenticated normally. .sp .ne 2 -.mk .na \fB\fBGSS_C_PROT_READY_FLAG\fR\fR .ad .RS 25n -.rt If true, the protection services specified by the states of \fBGSS_C_CONF_FLAG\fR and \fBGSS_C_INTEG_FLAG\fR are available if the accompanying major status return value is either \fBGSS_S_COMPLETE\fR or @@ -374,12 +320,10 @@ only if the accompanying major status return value is \fBGSS_S_COMPLETE\fR. .sp .ne 2 -.mk .na \fB\fBGSS_C_TRANS_FLAG\fR\fR .ad .RS 25n -.rt If true, the resultant security context may be transferred to other processes by means of a call to \fBgss_export_sec_context\fR(3GSS). If false, the security context cannot be transferred. @@ -389,12 +333,10 @@ security context cannot be transferred. .sp .ne 2 -.mk .na \fB\fItime_rec\fR\fR .ad .RS 25n -.rt The number of seconds for which the context will remain valid. Specify \fBNULL\fR if the parameter is not required. .RE @@ -504,174 +446,144 @@ Version 1 implementations must special-case these codes. \fBgss_init_sec_context()\fR may return the following status codes: .sp .ne 2 -.mk .na \fB\fBGSS_S_COMPLETE\fR\fR .ad .RS 30n -.rt Successful completion. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_CONTINUE_NEEDED\fR\fR .ad .RS 30n -.rt A token from the peer application is required to complete the context, and \fBgss_init_sec_context()\fR must be called again with that token. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_DEFECTIVE_TOKEN\fR\fR .ad .RS 30n -.rt Consistency checks performed on the \fIinput_token\fR failed. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_DEFECTIVE_CREDENTIAL\fR\fR .ad .RS 30n -.rt Consistency checks performed on the credential failed. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_NO_CRED\fR\fR .ad .RS 30n -.rt The supplied credentials are not valid for context acceptance, or the credential handle does not reference any credentials. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_CREDENTIALS_EXPIRED\fR\fR .ad .RS 30n -.rt The referenced credentials have expired. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_BAD_BINDINGS\fR\fR .ad .RS 30n -.rt The \fIinput_token\fR contains different channel bindings than those specified by means of the \fIinput_chan_bindings\fR parameter. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_BAD_SIG\fR\fR .ad .RS 30n -.rt The \fIinput_token\fR contains an invalid \fBMIC\fR or a \fBMIC\fR that cannot be verified. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_OLD_TOKEN\fR\fR .ad .RS 30n -.rt The \fIinput_token\fR is too old. This is a fatal error while establishing context. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_DUPLICATE_TOKEN\fR\fR .ad .RS 30n -.rt The \fIinput_token\fR is valid, but it is a duplicate of a token already processed. This is a fatal error while establishing context. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_NO_CONTEXT\fR\fR .ad .RS 30n -.rt The supplied context handle does not refer to a valid context. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_BAD_NAMETYPE\fR\fR .ad .RS 30n -.rt The provided \fItarget_name\fR parameter contains an invalid or unsupported \fIname\fR type. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_BAD_NAME\fR\fR .ad .RS 30n -.rt The supplied \fItarget_name\fR parameter is ill-formed. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_BAD_MECH\fR\fR .ad .RS 30n -.rt The token received specifies a mechanism that is not supported by the implementation or the provided credential. .RE .sp .ne 2 -.mk .na \fB\fBGSS_S_FAILURE\fR\fR .ad .RS 30n -.rt The underlying mechanism detected an error for which no specific \fBGSS\fR status code is defined. The mechanism-specific status code reported by means of the \fIminor_status\fR parameter details the error condition. @@ -740,13 +652,12 @@ See \fBattributes\fR(5) for descriptions of the following attributes: .sp .TS -tab() box; -cw(2.75i) |cw(2.75i) -lw(2.75i) |lw(2.75i) -. -ATTRIBUTE TYPEATTRIBUTE VALUE +box; +c | c +l | l . +ATTRIBUTE TYPE ATTRIBUTE VALUE _ -MT-LevelSafe +MT-Level Safe .TE .SH SEE ALSO |