Name
kerberos_get_tgt,
kerberos_destroy_tiket,
kerberos_get_tiket_info,
kerberos_client_auth,
kerberos_server_auth,
kerberos_seal,
krb_seal,
kerberos_unseal,
krb_unseal,
kerberos_encrypt_tst,
kerberos_decrypt_tst,
kerberos_free_context,
krb_free_ctx,
krb_init_ctx,
krb_init_srv_ctx,
krb_inquire_ctx
—
Kerberos / GSS-API client and server authentication primitives
Synopsis
varchar kerberos_get_tgt(
|
in principal varchar, |
| |
in password varchar, |
| |
in lifetime varchar); |
varchar kerberos_destroy_tiket(
|
in principal varchar); |
varchar kerberos_get_tiket_info(
|
in auth_token varchar, |
| |
in service varchar); |
varchar kerberos_client_auth(
|
in context_id integer, |
| |
in my_token varchar, |
| |
in server_token varchar, |
| |
in service varchar); |
varchar kerberos_server_auth(
|
in input_token varchar, |
| |
in service_name varchar); |
varchar kerberos_seal(
|
in context_id integer, |
| |
in plaintext varchar); |
varchar kerberos_unseal(
|
in context_id integer, |
| |
in ciphertext varchar); |
varchar kerberos_encrypt_tst(
|
in mode integer, |
| |
in message varchar, |
| |
in hostname varchar, |
| |
in service varchar); |
varchar kerberos_decrypt_tst(
|
in mode integer, |
| |
in auth_token varchar, |
| |
in message_token varchar, |
| |
in service varchar); |
varchar kerberos_free_context(
|
in context_id integer); |
any krb_init_ctx(
|
in service_name varchar); |
any krb_init_srv_ctx(
|
in service_name varchar, |
| |
in client_ticket varchar); |
any krb_inquire_ctx(
|
in context integer, |
| |
in info_type integer); |
Description
These BIFs expose the host's Kerberos / GSS-API libraries to SQL, letting
Virtuoso obtain Kerberos credentials, authenticate over a GSS-API security
context, and seal (encrypt & integrity-protect) messages exchanged
inside that context. Use them to integrate Virtuoso with an existing
Kerberos realm (e.g. Active Directory) for SSO and secured
service-to-service communication.
The BIFs fall into four functional groups:
-
Credential cache (TGT) management
-
kerberos_get_tgt obtains a Ticket-Granting
Ticket for principal using
password and stores it in the process
credential cache. The optional lifetime
string follows the Kerberos library duration syntax (e.g.
'10h', '1d').
kerberos_destroy_tiket removes the cached
credentials for principal.
kerberos_get_tiket_info returns descriptive
information about a Kerberos auth token (principal, expiry, flags).
-
Stateful GSS-API authentication
-
kerberos_client_auth drives the client side of
the GSS-API token exchange. The first call passes
context_id = 0; subsequent calls pass the
context id returned by the previous step plus the latest server-side
token. Returns the next client-side token (or empty when negotiation
completes). kerberos_server_auth consumes an
input_token from a client and returns the
server-side response token for service_name.
kerberos_free_context (also reachable as
krb_free_ctx) releases the security context
identified by context_id once the exchange is
complete or aborted.
-
Message protection
-
kerberos_seal (alias
krb_seal) encrypts and signs
plaintext using the established Kerberos
security context, producing the GSS-API "sealed" wire token.
kerberos_unseal (alias
krb_unseal) is the inverse: it verifies and
decrypts a sealed token.
-
Self-test and inspection helpers
-
kerberos_encrypt_tst and
kerberos_decrypt_tst are end-to-end test BIFs
that perform a full encrypt/decrypt round-trip in one call (used by
Virtuoso's test suite). The mode argument
selects the negotiation flavour (0 for password-based, 1 for
keytab-based, etc.). krb_init_ctx,
krb_init_srv_ctx and
krb_inquire_ctx are lower-level entry points
that initialise client / server GSS contexts and query their
internal state (the info_type argument
selects mechanism, lifetime, source name, target name, or flags).
Most application code should use the higher-level
kerberos_client_auth /
kerberos_server_auth pair instead.
All Kerberos BIFs require the server to be linked against a GSS-API
library at build time (typically MIT Kerberos or Heimdal). On a build
without GSS-API support the BIFs return SQL state 42000 with hint
KR000.