shishi_tkt_transited_policy_checked_p(3)
NAME
shishi_tkt_transited_policy_checked_p - API function
SYNOPSIS
#include <shishi.h> int shishi_tkt_transited_policy_checked_p(Shishi_tkt * tkt);
ARGUMENTS
- Shishi_tkt * tkt
- input variable with ticket info.
DESCRIPTION
Determine if ticket has been policy checked for transit.
The application server is ultimately responsible for accepting or
rejecting authentication and SHOULD check that only suitably trusted
KDCs are relied upon to authenticate a principal. The transited field
in the ticket identifies which realms (and thus which KDCs) were
involved in the authentication process and an application server would
normally check this field. If any of these are untrusted to authenticate the indicated client principal (probably determined by a
realm-based policy), the authentication attempt MUST be rejected. The
presence of trusted KDCs in this list does not provide any guarantee;
an untrusted KDC may have fabricated the list.
While the end server ultimately decides whether authentication is
valid, the KDC for the end server's realm MAY apply a realm specific
policy for validating the transited field and accepting credentials for
cross-realm authentication. When the KDC applies such checks and
accepts such cross-realm authentication it will set the TRANSITED-POLICY-CHECKED flag in the service tickets it issues based on the
cross-realm TGT. A client MAY request that the KDCs not check the transited field by setting the DISABLE-TRANSITED-CHECK flag. KDCs are
encouraged but not required to honor this flag.
Application servers MUST either do the transited-realm checks themselves, or reject cross-realm tickets without TRANSITED-POLICY- CHECKED
set.
RETURN VALUE
Returns non-0 iff transited-policy-checked flag is set in ticket.
REPORTING BUGS
Report bugs to <bug-shishi@josefsson.org>.
COPYRIGHT
Copyright © 2002-2008 Simon Josefsson.
Permission is granted to make and distribute verbatim copies of this
manual provided the copyright notice and this permission notice are
preserved on all copies.
SEE ALSO
- The full documentation for shishi is maintained as a Texinfo manual.
If the info and shishi programs are properly installed at your site,
the command
- info shishi
- should give you access to the complete manual.