Inicio Explorar Ayuda
Registro Iniciar sesión
publics
/
gokrb5.v7
0
0
Fork 0
Archivos Incidencias 0 Pull Requests 0 Wiki
Árbol: cd9d74dfdb
Ramas Etiquetas
gokrb5.v7
/
gssapi
Jonathan Turner 62e2cb2241 replace byte.Equals with hmac.Equals in order to avoid timing side-channels hace 7 años
..
ContextFlags.go 81c03155ec support big.Int for iterations within key derivation hace 8 años
MechType.go 81c03155ec support big.Int for iterations within key derivation hace 8 años
NegotiationToken.go 91e2843b95 major version increment to v6 hace 7 años
NegotiationToken_test.go 018098a529 parallelize tests (#143) hace 8 años
README.md 39a59b8776 readme table fix hace 7 años
WrapToken.go 62e2cb2241 replace byte.Equals with hmac.Equals in order to avoid timing side-channels hace 7 años
WrapToken_test.go 91e2843b95 major version increment to v6 hace 7 años
gssapi.go 91e2843b95 major version increment to v6 hace 7 años
gssapi_test.go 018098a529 parallelize tests (#143) hace 8 años
krb5Token.go 91e2843b95 major version increment to v6 hace 7 años
krb5Token_test.go 91e2843b95 major version increment to v6 hace 7 años

README.md

Notes on GSS-API Negotiation Mechanism

https://tools.ietf.org/html/rfc4178

Client sends an initial negotiation message to the server which specifies the list of mechanisms the client can support in order of decreasing preference. This message is generated with the NewNegTokenInitKrb5 method. The message generated by this function specifies only a kerberos v5 mechanism is supported.

The RFC states that this message can optionally contain the initial mechanism token for the preferred mechanism (KRB5 in this case) of the client. The NewNegTokenInitKrb5 includes this in the message.

The server side responds to this message with a one of four messages:

Message Type/State Description
accept-completed indicates that the initiator-selected mechanism was acceptable to the target, and that the security mechanism token embedded in the first negotiation message was sufficient to complete the authentication
accept-incomplete At least one more message is needed from the client to establish security context.
reject Negotiation is being terminated.
request-mic (this state can only be present in the first reply message from the target) indicates that the MIC token exchange is REQUIRED if per-message integrity services are available