Projects/APIs for keytab and cccol content - Revision history

Ghudson at 18:34, 15 June 2012

2012-06-15T18:34:27Z

Ghudson at 18:33, 15 June 2012

2012-06-15T18:33:53Z

Ghudson at 16:39, 14 June 2012

2012-06-14T16:39:29Z

Ghudson: Projects/keytab have content API moved to Projects/APIs for keytab and cccol content: Rename to add krb5_cccol_have_content

2012-06-14T16:29:29Z

Projects/keytab have content API moved to Projects/APIs for keytab and cccol content: Rename to add krb5_cccol_have_content

Ghudson: /* Description */

2012-06-02T17:26:35Z

‎Description

Ghudson: /* Description */

2012-06-02T17:17:07Z

‎Description

Ghudson at 17:08, 2 June 2012

2012-06-02T17:08:57Z

Ghudson at 17:05, 2 June 2012

2012-06-02T17:05:32Z

Ghudson: New page: This project is to implement the Heimdal API krb5_kt_have_content(). ==Background== In certain situations, it is desirable to know whether a keytab is actually present and populated. Fo...

2012-06-02T17:04:44Z

New page: This project is to implement the Heimdal API krb5_kt_have_content(). ==Background== In certain situations, it is desirable to know whether a keytab is actually present and populated. Fo...

New page

This project is to implement the Heimdal API krb5_kt_have_content().

==Background==

In certain situations, it is desirable to know whether a keytab is actually present and populated. For example, acquiring GSS acceptor credentials with the krb5 mech should not succeed if the default keytab file doesn't exist. krb5_kt_resolve() does not answer this question, as it returns successfully even if the file doesn't exist.

==Description==

The API signature is:

krb5_boolean krb5_kt_have_content(krb5_context context, krb5_keytab id);

The function returns true if entries can be successfully retrieved from the keytab.

==Implementation==

The Heimdal implementation begins iterating over the keytab and returns true if one entry can be retrieved. We can make the implementation somewhat more efficient using a vtable method; for instance, the FILE keytab type can stat the keytab and return true if the file size is larger than the size of a keytab header. But this optimization is probably not worth the code footprint.

The KDB keytab is not iterable. Since KDBs are almost never empty, it is probably reasonable to return true unconditionally for non-iterable keytabs.

==Testing==

The existing t_keytab.c test program can be augmented to test krb5_kt_have_content().

==Documentation==

Doxygen markup for krb5_kt_have_content() should be sufficient. It may be worth briefly mentioning this API in our application programmer section on keytabs when we have one.

← Older revision		Revision as of 18:34, 15 June 2012
Line 1:		Line 1:
−	{{project-~~target~~\|1.11}}	+	{{project-rel\|1.11}}

	This project is to implement the Heimdal API krb5_kt_have_content() and a new API krb5_cccol_have_content().		This project is to implement the Heimdal API krb5_kt_have_content() and a new API krb5_cccol_have_content().

← Older revision		Revision as of 18:33, 15 June 2012
Line 1:		Line 1:
−	{{project-~~review~~\|~~2012-06-15~~}}	+	{{project-target\|1.11}}

	This project is to implement the Heimdal API krb5_kt_have_content() and a new API krb5_cccol_have_content().		This project is to implement the Heimdal API krb5_kt_have_content() and a new API krb5_cccol_have_content().

@@ Line 1: / Line 1: @@
-{{project-review|2012-06-08}}
+{{project-review|2012-06-15}}
-This project is to implement the Heimdal API krb5_kt_have_content().
+This project is to implement the Heimdal API krb5_kt_have_content() and a new API krb5_cccol_have_content().
 ==Background==
-In certain situations, it is desirable to know whether a keytab is actually present and populated.  For example, acquiring GSS acceptor credentials with the krb5 mech should not succeed if the default keytab file doesn't exist.  krb5_kt_resolve() does not answer this question, as it returns successfully even if the file doesn't exist.
+In certain situations, it is desirable to know whether any keytab keys or credentials are available to the current process.  For example, acquiring GSS acceptor credentials with the krb5 mech should fail immediately if the default keytab file doesn't exist.  krb5_kt_resolve() does not answer this question, as it returns successfully even if the file doesn't exist.  Similarly, acquiring GSS initiator credentials with the krb5 mech should fail immediately if the ccache collection (including the default ccache) is devoid of krb5 credentials.
 ==Description==
-The API signature is:
+The API signatures are:
     krb5_error_code krb5_kt_have_content(krb5_context context, krb5_keytab keytab);
-It returns 0 if keytab exists and contains entries, or KRB5_KT_NOTFOUND if it does not.
+krb5_kt_have_content returns 0 if keytab exists and contains entries, or KRB5_KT_NOTFOUND if it does not.  krb5_cccol_have_content returns 0 if the ccache collection contains any krb5 credentials, or KRB5_CC_NOTFOUND if it does not.
 ==Implementation==
-The Heimdal implementation begins iterating over the keytab and returns true if one entry can be retrieved.  We can make the implementation somewhat more efficient using a vtable method; for instance, the FILE keytab type can stat the keytab and return true if the file size is larger than the size of a keytab header.  But this optimization is probably not worth the code footprint.
+The Heimdal implementation of krb5_kt_have_content begins iterating over the keytab and returns true if one entry can be retrieved.  We can make the implementation somewhat more efficient using a vtable method; for instance, the FILE keytab type can stat the keytab and return true if the file size is larger than the size of a keytab header.  But this optimization is probably not worth the code footprint.  Similar reasoning applies for the implementation of krb5_cccol_have_content().
-The KDB keytab is not iterable.  Since KDBs are almost never empty, it is probably reasonable to return true unconditionally for non-iterable keytabs.
+The KDB keytab is not iterable.  Since KDBs are almost never empty, it is reasonable to return true unconditionally for non-iterable keytabs.
 ==Testing==
-The existing t_keytab.c test program can be augmented to test krb5_kt_have_content().
+The existing t_keytab.c test program can be augmented to test krb5_kt_have_content().  The existing t_cccursor.c and t_cccol.py tests can be augmented to test krb5_cccol_have_content().
 ==Documentation==
-Doxygen markup for krb5_kt_have_content() should be sufficient.  It may be worth briefly mentioning this API in our application programmer section on keytabs when we have one.
+Doxygen markup for krb5_kt_have_content() and krb5_cccol_have_content() should be sufficient.  It may be worth briefly mentioning this API in our application programmer sections on keytabs and ccache collections when we have them.
 ==Release notes==
 * Add a new API krb5_kt_have_content() to determine whether a keytab exists and contains any entries.

@@ Line 11: / Line 11: @@
 The API signature is:
-    krb5_error_code krb5_kt_have_content(krb5_context context, krb5_keytab id);
+    krb5_error_code krb5_kt_have_content(krb5_context context, krb5_keytab keytab);
-It returns 0 if id exists and contains entries, or KRB5_KT_NOTFOUND if it does not.
+It returns 0 if keytab exists and contains entries, or KRB5_KT_NOTFOUND if it does not.
 ==Implementation==

← Older revision		Revision as of 17:08, 2 June 2012
Line 28:		Line 28:

	Doxygen markup for krb5_kt_have_content() should be sufficient. It may be worth briefly mentioning this API in our application programmer section on keytabs when we have one.		Doxygen markup for krb5_kt_have_content() should be sufficient. It may be worth briefly mentioning this API in our application programmer section on keytabs when we have one.
		+
		+	==Release notes==
		+
		+	* Add a new API krb5_kt_have_content() to determine whether a keytab exists and contains any entries.

← Older revision	Revision as of 16:29, 14 June 2012
(No difference)

← Older revision		Revision as of 17:05, 2 June 2012
Line 1:		Line 1:
		+	{{project-review\|2012-06-08}}
		+
	This project is to implement the Heimdal API krb5_kt_have_content().		This project is to implement the Heimdal API krb5_kt_have_content().