krb_realmofhost(3N)

NAME | SYNOPSIS | DESCRIPTION | ATTRIBUTES | SEE ALSO | FILES | NOTES | BUGS

NAME

krb_realmofhost, krb_get_phost, krb_get_krbhst, krb_get_admhst, krb_get_lrealm- additional Kerberos utility routines

SYNOPSIS

cc [ flag ... ] file ... -lkrb [ library ... ]
#include <kerberos/krb.h>
#include <netinet/in.h>

char *krb_realmofhost(const char *host);
char *krb_get_phost(const char *alias);
int krb_get_krbhst(char *host, const char *realm, const int n);
int krb_get_admhst(char *host, const char *realm, const int n);
int krb_get_lrealm(char *realm, const int n);

DESCRIPTION

krb_realmofhost() returns the Kerberos realm of the host host, as determined by the translation table /etc/krb.realms. host should be the fully-qualified domain-style primary host name of the host in question. In order to prevent certain security attacks, this routine must either have a prior knowledge of a host's realm, or obtain such information securely.

The format of the translation file is described by krb.realms(4). If host exactly matches a host_name line, the corresponding realm is returned. Otherwise, if the domain portion of host matches a domain_name line, the corresponding realm is returned. If host contains a domain, but no translation is found, host's domain is converted to upper-case and returned. If host contains no discernible domain, or an error occurs, the local realm name, as supplied by krb_get_lrealm(), is returned.

krb_get_phost() converts the hostname alias (which can be either an official name or an alias) into the instance name to be used in obtaining Kerberos tickets for most services, including the Berkeley rcmd suite (rlogin, rcp, rsh). The current convention is to return the first segment of the official domain-style name after conversion to lower case.

krb_get_krbhst() fills in host with the hostname of the nth host running a Kerberos key distribution center (KDC) for realm realm, as specified in the configuration file (/etc/krb.conf or krb.conf NIS map). The configuration format is described by krb.conf(4). If the host is successfully filled in, the routine returns KSUCCESS. If the file (or NIS map) cannot be accessed, and n equals 1, then the hostname kerberos is filled in, and KSUCCESS is returned. If there are fewer than n hosts running a Kerberos KDC for the requested realm, or the configuration file is malformed, the routine returns KFAILURE.

When there is both a local /etc/krb.conf and a krb.conf NIS map, then the entries are counted starting first with the local file, then continuing with the NIS map. For example, if the local /etc/krb.conf file contains two entries which match realm, and the NIS map contains one matching entry, then there are three possible matches that krb_get_krbhst() can return. The first two (for n values 1 and 2) come from the file, and the third (for n equal to 3) comes from the map.

krb_get_admhst() fills in host with the hostname of the nth host running a Kerberos KDC database administration server for realm realm, as specified in /etc/krb.conf. If the file cannot be opened or is malformed, or there are fewer than n hosts running a Kerberos KDC database administration server, the routine returns KFAILURE.

The character arrays used as return values for krb_get_krbhst() and krb_get_admhst() should be large enough to hold any hostname.

krb_get_lrealm() fills in realm with the nth realm of the local host, as specified in the configuration file. realm should be at least REALM_SZ (from <kerberos/krb.h>) characters long. The return value is either KSUCCESS or KFAILURE.

ATTRIBUTES

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
MT-Level	Unsafe

SEE ALSO

kerberos(3N), krb.conf(4), krb.realms(4), attributes(5)

FILES

/etc/krb.realms

translation file for host-to-realm mapping.

/etc/krb.conf

local realm-name and realm/server configuration file.

NOTES

These interfaces are unsafe in multithreaded applications. Unsafe interfaces should be called only from the main thread.

BUGS

The current convention for instance names is too limited; the full domain name should be used.

krb_get_lrealm() currently only supports n equal to 1. It should really consult the user's ticket cache to determine the user's current realm, rather than consulting a file on the host.

SunOS 5.7  Last Revised 30 Dec 1996

NAME | SYNOPSIS | DESCRIPTION | ATTRIBUTES | SEE ALSO | FILES | NOTES | BUGS