Projects/GS2 - Revision history

Ghudson at 17:24, 12 October 2010

2010-10-12T17:24:45Z

Lukeh at 08:03, 28 September 2010

2010-09-28T08:03:59Z

Lukeh: /* Architecture */

2010-09-26T10:44:37Z

‎Architecture

Lukeh: /* Architecture */

2010-09-26T10:44:13Z

‎Architecture

Lukeh at 10:44, 26 September 2010

2010-09-26T10:44:02Z

Lukeh at 21:16, 25 September 2010

2010-09-25T21:16:24Z

Lukeh at 20:06, 25 September 2010

2010-09-25T20:06:05Z

Lukeh at 19:06, 25 September 2010

2010-09-25T19:06:14Z

Show changes

Lukeh: /* Status */

2010-09-25T13:48:39Z

‎Status

Lukeh: /* Examples */

2010-09-25T13:48:08Z

‎Examples

← Older revision		Revision as of 17:24, 12 October 2010
Line 1:		Line 1:
−	{{project-~~early~~}}	+	{{project-rel\|1.9}}
−	{{project-target\|1.9}}

	==Background==		==Background==

← Older revision		Revision as of 08:03, 28 September 2010
Line 103:		Line 103:

	A test program is in src/tests/gssapi/t_saslname.c.		A test program is in src/tests/gssapi/t_saslname.c.
		+
		+	GS2 implementation at http://www.project-moonshot.org/git/cyrus-sasl in plugins/gs2.c.

	==Examples==		==Examples==

@@ Line 28: / Line 28: @@
     gss_OID_desc except_oids[3];
     gss_OID_set_desc except_attrs;
     desired_oids[0] = *GSS_C_MA_AUTH_INIT;

@@ Line 21: / Line 21: @@
 <pre>
-static int gs2_indicate_mechs(void
+static int gs2_indicate_mechs(void)
+{
     OM_uint32 major, minor;

@@ Line 6: / Line 6: @@
 Some additional features in the GSS mechanism glue are useful for implementors of SASL GS2.
-* GSS_Inquire_SASLname_for_mech and GSS_Inquire_mech_for_SASLname as defined in RFC 5801
+* RFC 5801: GSS_Inquire_SASLname_for_mech and GSS_Inquire_mech_for_SASLname
-* gss_inquire_attrs_for_mech and friends as described in RFC 5587
+* RFC 5587: gss_inquire_attrs_for_mech &c
 These allow a SASL library to dynamically bridge GSS mechanisms without mechanism-specific knowledge.
@@ Line 17: / Line 17: @@
 * a bidirectional mapping between GSS OIDs and SASL mechanism names. (In the case of no mapping, the mechanism glue synthesises a SASL name using a base-32 encoded SHA-1 of the OID.)
 * a means to determine which features, denoted by OIDs, are supported by mechanisms
 ==Implementation==

@@ Line 4: / Line 4: @@
 ==Background==
 ==Architecture==
-* a bidirectional mapping between GSS OIDs and SASL mechanism names (in the case of no mapping, the mechanism glue synthesises a SASL name using a base-32 encoded SHA-1 of the OID)
+* a bidirectional mapping between GSS OIDs and SASL mechanism names. (In the case of no mapping, the mechanism glue synthesises a SASL name using a base-32 encoded SHA-1 of the OID.)
-* a means to determine which features are supported by mechanisms
+* a means to determine which features, denoted by OIDs, are supported by mechanisms
 ==Implementation==
-The implementations live in src/lib/gssapi/mechglue/g_saslname.c.
+The implementations live in src/lib/gssapi/mechglue/g_saslname.c and src/lib/gssapi/mechglue/g_mechattr.c, respectively.
 <pre>
@@ Line 117: / Line 121: @@
 Mech name  : eap-des3-cbc-sha1
 Mech desc  : Extensible Authentication Protocol GSS-API Mechanism
 Known attrs: GSS_C_MA_MECH_CONCRETE GSS_C_MA_MECH_PSEUDO GSS_C_MA_MECH_COMPOSITE GSS_C_MA_MECH_NEGO GSS_C_MA_MECH_GLUE GSS_C_MA_NOT_MECH GSS_C_MA_DEPRECATED GSS_C_MA_NOT_DFLT_MECH GSS_C_MA_ITOK_FRAMED GSS_C_MA_AUTH_INIT GSS_C_MA_AUTH_TARG GSS_C_MA_AUTH_INIT_INIT GSS_C_MA_AUTH_TARG_INIT GSS_C_MA_AUTH_INIT_ANON GSS_C_MA_AUTH_TARG_ANON GSS_C_MA_DELEG_CRED GSS_C_MA_INTEG_PROT GSS_C_MA_CONF_PROT GSS_C_MA_MIC GSS_C_MA_WRAP GSS_C_MA_PROT_READY GSS_C_MA_REPLAY_DET GSS_C_MA_OOS_DET GSS_C_MA_CBINDINGS GSS_C_MA_PFS GSS_C_MA_COMPRESS GSS_C_MA_CTX_TRANS
 ------------------------------------------------------------------------------
@@ Line 125: / Line 129: @@
 Mech name  : eap-aes128-cts-hmac-sha1-96
 Mech desc  : Extensible Authentication Protocol GSS-API Mechanism
 Known attrs: GSS_C_MA_MECH_CONCRETE GSS_C_MA_MECH_PSEUDO GSS_C_MA_MECH_COMPOSITE GSS_C_MA_MECH_NEGO GSS_C_MA_MECH_GLUE GSS_C_MA_NOT_MECH GSS_C_MA_DEPRECATED GSS_C_MA_NOT_DFLT_MECH GSS_C_MA_ITOK_FRAMED GSS_C_MA_AUTH_INIT GSS_C_MA_AUTH_TARG GSS_C_MA_AUTH_INIT_INIT GSS_C_MA_AUTH_TARG_INIT GSS_C_MA_AUTH_INIT_ANON GSS_C_MA_AUTH_TARG_ANON GSS_C_MA_DELEG_CRED GSS_C_MA_INTEG_PROT GSS_C_MA_CONF_PROT GSS_C_MA_MIC GSS_C_MA_WRAP GSS_C_MA_PROT_READY GSS_C_MA_REPLAY_DET GSS_C_MA_OOS_DET GSS_C_MA_CBINDINGS GSS_C_MA_PFS GSS_C_MA_COMPRESS GSS_C_MA_CTX_TRANS
 ------------------------------------------------------------------------------
 </pre>

@@ Line 34: / Line 34: @@
 ==Status==
-Implemented and tested with a prototype GS2 implementation, as well as a mechanism plugin.
+Implemented and tested with a prototype GS2 implementation, as well as a mechanism plugin. Code is in the users/lhoward/sasl-gs2 branch (note that this is branched off import-cred; pick up only the changes you need).
 A test program is in src/tests/gssapi/t_saslname.c.

← Older revision		Revision as of 13:48, 25 September 2010
Line 41:		Line 41:

	A list of GS2 mechanisms.		A list of GS2 mechanisms.
		+
		+	<pre>
		+
		+	------------------------------------------------------------------------------
		+	OID : { 1 2 840 113554 1 2 2 }
		+	SASL mech: GS2-KRB5
		+	Mech name: krb5
		+	Mech desc: Kerberos 5 GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	------------------------------------------------------------------------------
		+	OID : { 1 3 5 1 5 2 }
		+	SASL mech: GS2-KRB5
		+	Mech name: krb5
		+	Mech desc: Kerberos 5 GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	Got different OID { 1 2 840 113554 1 2 2 } for mechanism GS2-KRB5
		+	------------------------------------------------------------------------------
		+	OID : { 1 2 840 48018 1 2 2 }
		+	SASL mech: GS2-KRB5
		+	Mech name: krb5
		+	Mech desc: Kerberos 5 GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	------------------------------------------------------------------------------
		+	OID : { 1 3 6 1 5 2 5 }
		+	SASL mech: GS2-KRB5
		+	Mech name: krb5
		+	Mech desc: Kerberos 5 GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	Got different OID { 1 2 840 113554 1 2 2 } for mechanism GS2-KRB5
		+	------------------------------------------------------------------------------
		+	OID : { 1 3 6 1 5 5 2 }
		+	SASL mech: SPNEGO
		+	Mech name: spnego
		+	Mech desc: Simple and Protected GSS-API Negotiation Mechanism
		+	------------------------------------------------------------------------------
		+	------------------------------------------------------------------------------
		+	OID : { 1 3 6 1 4 1 5322 21 1 }
		+	SASL mech: GS2-EAP
		+	Mech name: eap
		+	Mech desc: Extensible Authentication Protocol GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	------------------------------------------------------------------------------
		+	OID : { 1 3 6 1 4 1 5322 21 1 16 }
		+	SASL mech: GS2-ZGMBGB5SLBQ
		+	Mech name: eap-des3-cbc-sha1
		+	Mech desc: Extensible Authentication Protocol GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	------------------------------------------------------------------------------
		+	OID : { 1 3 6 1 4 1 5322 21 1 17 }
		+	SASL mech: GS2-EAP-AES128
		+	Mech name: eap-aes128-cts-hmac-sha1-96
		+	Mech desc: Extensible Authentication Protocol GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	------------------------------------------------------------------------------
		+	OID : { 1 3 6 1 4 1 5322 21 1 18 }
		+	SASL mech: GS2-EAP-AES256
		+	Mech name: eap-aes256-cts-hmac-sha1-96
		+	Mech desc: Extensible Authentication Protocol GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	------------------------------------------------------------------------------
		+	OID : { 1 3 6 1 4 1 5322 21 1 23 }
		+	SASL mech: GS2-6PUERUGDUSC
		+	Mech name: eap-arcfour-hmac
		+	Mech desc: Extensible Authentication Protocol GSS-API Mechanism
		+	------------------------------------------------------------------------------
		+	</pre>