Using the gss classes

The gss, gssmechanism, gsscredentials, and gsscontext classes provide support for the Generic Security Services API (GSS-API), commonly used with Kerberos.

The gss class provides methods for determining whether GSS support is available and for listing the available security mechanisms.

The gssmechanism class represents a security mechanism, identified by an OID string.

The gsscredentials class provides methods for acquiring credentials using one or more desired mechanisms.

The gsscontext class provides methods for establishing a security context with a peer, wrapping and unwrapping data, and reading and writing across the secured connection.

The following example checks for GSS support, lists available mechanisms, opens a mechanism by OID, creates credentials with a desired mechanism and lifetime, and configures a GSS context.

#include <rudiments/gss.h>
#include <rudiments/stdio.h>

int main(int argc, const char **argv) {

	// check if gss is supported
	if (!gss::isSupported()) {
		stdoutput.write("GSS is not supported\n");
		return 1;
	}
	stdoutput.write("GSS is supported\n\n");


	// get the available mechanisms
	gss	g;
	const char * const	*mechs=g.getAvailableMechanisms();
	if (mechs) {
		stdoutput.write("available mechanisms:\n");
		for (uint64_t i=0; mechs[i]; i++) {
			stdoutput.printf("  %s\n",mechs[i]);
		}
		stdoutput.write('\n');
	}


	// open a mechanism by OID string
	gssmechanism	mech;
	if (mech.open("{ 1 2 840 113554 1 2 2 }")) {
		stdoutput.printf("opened mechanism: %s\n\n",
						mech.getString());
	}


	// create credentials
	gsscredentials	cred;
	cred.addDesiredMechanism(&mech);
	cred.setDesiredLifetime(600);

	stdoutput.printf("desired lifetime:  %d seconds\n",
					cred.getDesiredLifetime());
	stdoutput.printf("desired mechanism count: %lld\n\n",
				(long long)cred.getDesiredMechanismCount());


	// create a gss context
	gsscontext	ctx;

	// configure the context
	ctx.setCredentials(&cred);
	ctx.setDesiredMechanism(&mech);
	ctx.setDesiredLifetime(600);
	ctx.setService("host");

	stdoutput.printf("service: %s\n",ctx.getService());
	stdoutput.printf("desired lifetime: %d seconds\n",
					ctx.getDesiredLifetime());


	// clean up
	mech.close();
	cred.close();
}