Developer's Guide to Oracle^® Solaris 11.3 Security

Index

A

access control lists

use in GSS-APIComparing Names in GSS-API

account management

PAM service modulePAM Service Modules

ACL  Seeaccess control list

acquiring context informationObtaining Context Information in GSS-API

anonymous authenticationPerforming Anonymous Authentication in GSS-API

aslr security extensionSecurity Extensions Framework

authentication

GSS-APISecurity Services in GSS-API

anonymousPerforming Anonymous Authentication in GSS-API

mutualPerforming Mutual Authentication Between Peers in GSS-API

PAM process forPAM Authentication Process

PAM service modulePAM Service Modules

SASLSASL Authentication

authid

auxprop pluginsAuxiliary Property (auxprop) Plugins

SASLSASL Library Basics

authorizations

code exampleChecking for Authorizations

definedPrivileged Applications

use in application developmentAbout Authorizations

authzid

auxprop pluginsAuxiliary Property (auxprop) Plugins

auxiliary properties  Seeauxprop plugins

auxprop pluginsAuxiliary Property (auxprop) Plugins

C

C_CloseSession() function

digest message exampleMessage Digest Example

message signing exampleSign and Verify Example

random byte generation exampleRandom Byte Generation Example

C_Decrypt() functionSymmetric Encryption Example

C_DecryptInit() functionSymmetric Encryption Example

C_EncryptFinal() functionSymmetric Encryption Example

C_EncryptInit() functionSymmetric Encryption Example

C_EncryptUpdate() functionSymmetric Encryption Example

C_Finalize() function

digest message exampleMessage Digest Example

message signing exampleSign and Verify Example

C_GenerateKeyPair() functionSign and Verify Example

C_GenerateRandom() functionRandom Byte Generation Example

C_GetAttributeValue() functionSign and Verify Example

C_GetInfo() function

Message Digest Example

PKCS #11 Functions: C_GetInfo

C_GetMechanismList() functionPKCS #11 Functions: C_GetMechanismList

C_GetSlotList() functionPKCS #11 Functions: C_GetSlotList

message signing exampleSign and Verify Example

random byte generation exampleRandom Byte Generation Example

C_Initialize() functionPKCS #11 Functions: C_Initialize

C_OpenSession() functionPKCS #11 Functions: C_OpenSession

random byte generation exampleRandom Byte Generation Example

C_SignInit() functionSign and Verify Example

C_Verify() functionSign and Verify Example

C_VerifyInit() functionSign and Verify Example

callbacks

SASLCommunication in SASL

SASL_CB_AUTHNAMECommunication in SASL

SASL_CB_CANON_USERCommunication in SASL

SASL_CB_ECHOPROMPTCommunication in SASL

SASL_CB_GETCONFCommunication in SASL

SASL_CB_GETOPTCommunication in SASL

SASL_CB_GETPATHCommunication in SASL

SASL_CB_GETREALMCommunication in SASL

SASL_CB_LANGUAGECommunication in SASL

SASL_CB_LOGCommunication in SASL

SASL_CB_NOECHOPROMPTCommunication in SASL

SASL_CB_PASSCommunication in SASL

SASL_CB_PROXY_POLICYCommunication in SASL

SASL_CB_SERVER_USERDB_CHECKPASSCommunication in SASL

SASL_CB_SERVER_USERDB_SETPASSCommunication in SASL

SASL_CB_USERCommunication in SASL

SASL_CB_VERIFYFILECommunication in SASL

canonicalization

SASLUser Canonicalization Plugins

Certificate Revocation List (CRL)Oracle Solaris Key Management Framework Features

Certificate Signing Request (CSR)KMF Key Management Tool

channel bindings

GSS-API

Address Types for Channel Bindings

Using Channel Bindings in GSS-API

client plugins

SASL

SASL Plugin Development Guidelines

Client Plugins

client_establish_context() function

GSS-API client exampleEstablishing a Security Context With the Server

confidentiality

GSS-API

Sending Protected Data in GSS-API

Security Services in GSS-API

connect_to_server() function

GSS-API client example

Establishing a Security Context for GSS-API

Opening a Connection With the Server

connection contexts

SASLSASL Connection Contexts

consumers

Cryptographic FrameworkOracle Solaris Cryptography Terminology

definedNetwork Security Architecture

context-level tokens

GSS-APIGSS-API Tokens

contexts

GSS-API

acceptanceAccepting a Context in GSS-API

acceptance exampleAccepting a Context

deletionCleaning Up a GSS-API Session

establishingWorking With Contexts in GSS-API

establishing exampleEstablishing a Security Context for GSS-API

exportingExporting and Importing Contexts in GSS-API

getting acquisition informationObtaining Context Information in GSS-API

gss-client exampleDeleting the Security Context

import and export

Using the test_import_export_context Function

Exporting and Importing Contexts in GSS-API

introductionGSS-API Layer

other context servicesUsing Other Context Services in GSS-API

releasingCleanup in the GSSAPI Server Example

initiation in GSS-APIInitiating a Context in GSS-API

createMechOid() functioncreateMechOid Function

credentials

delegationDelegating a Credential in GSS-API

GSS-API

Types of Credentials Supported

Working With Credentials in GSS-API

acquisitionAcquiring Credentials

GSS-API defaultAcquiring Credentials in GSS-API

CRL (Certificate Revocation List)Oracle Solaris Key Management Framework Features

crypto pseudo device driverComponents of the Cryptographic Framework

cryptoadm pseudo device driverComponents of the Cryptographic Framework

cryptoadm utilityComponents of the Cryptographic Framework

cryptographic checksum (MIC)Tagging Messages With gss_get_mic

Cryptographic Framework

architectureOverview of the Cryptographic Framework

crypto pseudo device driverComponents of the Cryptographic Framework

cryptoadm pseudo device driverComponents of the Cryptographic Framework

cryptoadm utilityComponents of the Cryptographic Framework

cryptographic providersComponents of the Cryptographic Framework

cryptoki libraryOverview of the Cryptoki Library

design requirements

user-level consumersRequirements for Developers of User-Level Consumers

user-level providersRequirements for Developers of User-Level Providers

elfsign utilityComponents of the Cryptographic Framework

examples

message digestMessage Digest Example

random byte generationRandom Byte Generation Example

signing and verifying messagesSign and Verify Example

symmetric encryptionSymmetric Encryption Example

introductionIntroduction to the Oracle Solaris Cryptographic Framework

kernel programmer interfaceComponents of the Cryptographic Framework

libpkcs11.soComponents of the Cryptographic Framework

modules verification libraryComponents of the Cryptographic Framework

pkcs11_kernel.soComponents of the Cryptographic Framework

pkcs11_softtoken.soComponents of the Cryptographic Framework

pluggable interfaceComponents of the Cryptographic Framework

role in Oracle SolarisSystem Security

scheduler / load balancer

Components of the Cryptographic Framework

Components of the Cryptographic Framework

cryptographic providers

Cryptographic FrameworkComponents of the Cryptographic Framework

cryptoki library

overviewOverview of the Cryptoki Library

CSR (Certificate Signing Request)KMF Key Management Tool

D

data encryption

GSS-APIWrapping Messages With gss_wrap

data protection

GSS-APISending Protected Data in GSS-API

data types

GSS-API

GSS-API Data Types and Values

GSS-API Data Types

integersGSS-API Integers

namesNames in GSS-API

stringsStrings and Similar Data in GSS-API

privilegesPrivilege Data Types

debugging

security extensions andDebugging When Using Security Extensions

default credentials

GSS-APIAcquiring Credentials in GSS-API

delegation

credentialsDelegating a Credential in GSS-API

design requirements

Cryptographic Framework

user-level consumersRequirements for Developers of User-Level Consumers

user-level providersRequirements for Developers of User-Level Providers

digesting messages

Cryptographic FrameworkMessage Digest Example

E

effective privilege set

definedEffective Privilege Set

elfdump commandManaging Security Extensions in Objects With elfdump and elfedit

elfedit commandManaging Security Extensions in Objects With elfdump and elfedit

elfsign command

Cryptographic FrameworkComponents of the Cryptographic Framework

encryption

GSS-APISending Protected Data in GSS-API

wrapping messages with gss_wrap()Wrapping Messages With gss_wrap

error codes

GSS-APIGSS-API Major Status Code Values

examples

checking for authorizationsChecking for Authorizations

Cryptographic Framework

message digestMessage Digest Example

random byte generationRandom Byte Generation Example

signing and verifying messagesSign and Verify Example

symmetric encryptionSymmetric Encryption Example

GSS-API client application

descriptionGSSAPI Client Example Overview

source codeClient-Side Application

GSS-API miscellaneous functions

source codeMiscellaneous GSS-API Sample Functions

GSS-API server application

descriptionGSSAPI Server Example Overview

source codeServer-Side Application

miscellaneous SASL functionsCommon Code

PAM consumer applicationA Simple PAM Consumer Example

PAM conversation functionWriting Conversation Functions

PAM service providerSample PAM Provider Service Module

privilege bracketingPrivilege Bracketing in the Least Privilege Model

SASL client applicationSASL Client Example

SASL server applicationSASL Server Example

exporting GSS-API contextsExporting and Importing Contexts in GSS-API

F

functions  Seespecific function name

GSS-APIGSS-API Functions

G

General Security Standard Application Programming Interface  SeeGSS-API

GetMechanismInfo() functionSign and Verify Example

GetRandSlot() functionRandom Byte Generation Example

GetTokenInfo() functionRandom Byte Generation Example

GSS-API

acquiring credentialsAcquiring Credentials

anonymous authenticationPerforming Anonymous Authentication in GSS-API

anonymous name formatFormat of Anonymous Names

channel bindings

Address Types for Channel Bindings

Using Channel Bindings in GSS-API

communication layersIntroduction to GSS-API

comparing names inComparing Names in GSS-API

confidentialitySending Protected Data in GSS-API

constructing OIDsConstructing Mechanism OIDs

context establishment exampleEstablishing a Security Context for GSS-API

contexts

acceptance exampleAccepting a Context

deallocationCleaning Up a GSS-API Session

expirationContext Expiration

createMechOid() functioncreateMechOid Function

credentialsWorking With Credentials in GSS-API

expirationCredential Expiration

data types

GSS-API Data Types and Values

GSS-API Data Types

detecting out-of-sequence problemsDetecting Sequence Problems in GSS-API

developing applicationsDeveloping Applications That Use GSS-API

displaying status codesDisplaying Status Codes

encryption

Wrapping Messages With gss_wrap

Sending Protected Data in GSS-API

exporting contexts

Context Exportation and Interprocess Tokens

Exporting and Importing Contexts in GSS-API

files containing OID valuesFiles with OID Values

functionsGSS-API Functions

generalized stepsGeneralized GSS-API Usage

gss-client example

context deletionDeleting the Security Context

contextsMiscellaneous GSSAPI Context Operations on the Client Side

sending messagesWrapping and Sending a Message

signature blocksReading and Verifying a Signature Block From a GSS-API Client

gss-server example

signing messagesSigning and Returning the Message

unwrapping messagesUnwrapping the Message

gss_str_to_oid() functiongss_str_to_oid Function

include filesGeneralized GSS-API Usage

integritySending Protected Data in GSS-API

interprocess tokensContext Exportation and Interprocess Tokens

introductionIntroduction to GSS-API

Kerberos v5 status codesKerberos v5 Status Codes

language bindingsLanguage Bindings for GSS-API

limitationsLimitations of GSS-API

mech file/etc/gss/mech File

message transmissionConfirming Message Transmission in GSS-API

MICsSending Protected Data in GSS-API

minor-status codesUse of minor_status Parameter

miscellaneous sample functions

source codeMiscellaneous GSS-API Sample Functions

mutual authenticationPerforming Mutual Authentication Between Peers in GSS-API

name types

Name Types

Name Types in GSS-API

OIDsGSS-API OIDs

other context servicesUsing Other Context Services in GSS-API

outside referencesWhere to Get More Information on GSS-API

portabilityApplication Portability With GSS-API

protecting channel-binding informationProtection of Channel-Binding Information

QOP

/etc/gss/qop File

Application Portability With GSS-API

readable name syntaxHuman-Readable Name Syntax

releasing contextsCleanup in the GSSAPI Server Example

releasing stored dataDeletion of Contexts and Stored Data

remote procedure callsRemote Procedure Calls With GSS-API

replaced functionsFunctions From Previous Versions of GSS-API

role in Oracle Solaris OSNetwork Security Architecture

sample client application

descriptionGSSAPI Client Example Overview

source codeClient-Side Application

sample server application

descriptionGSSAPI Server Example Overview

source codeServer-Side Application

specifying non-default mechanismsSpecifying a Non-Default Mechanism

specifying OIDsSpecifying an OID

status code macrosStatus Code Macros

status codes

GSS-API Major Status Code Values

GSS-API Status Codes

GSS-API Status Codes

supported credentialsTypes of Credentials Supported

tokensGSS-API Tokens

context-levelGSS-API Tokens

interprocessInterprocess Tokens in GSS-API

per-messageGSS-API Tokens

translation into GSS-API formatTranslating a Service Name into GSS-API Format

wrap-size limitsWrap Size Limits and QOP Values

gss-client example

context deletionDeleting the Security Context

obtaining context statusMiscellaneous GSSAPI Context Operations on the Client Side

restoring contextsMiscellaneous GSSAPI Context Operations on the Client Side

saving contextsMiscellaneous GSSAPI Context Operations on the Client Side

sending messagesWrapping and Sending a Message

signature blocksReading and Verifying a Signature Block From a GSS-API Client

gss-client sample applicationGSSAPI Client Example Overview

gss-server example

signing messagesSigning and Returning the Message

unwrapping messagesUnwrapping the Message

gss-server sample applicationGSSAPI Server Example Overview

gss_accept_sec_context() functionGSS-API Functions

gss_accept_sec_context() functionAccepting a Context in GSS-API

GSS-API server exampleserver_establish_context Function

gss_acquire_cred() functionGSS-API Functions

gss_acquire_cred() functionAcquiring Credentials in GSS-API

GSS-API server exampleAcquiring Credentials

gss_add_cred() functionGSS-API Functions

gss_add_cred() functionAcquiring Credentials in GSS-API

gss_add_oid_set_member() functionGSS-API Functions

gss_buffer_desc structuregss_buffer_desc Data Type

gss_buffer_desc structureStrings and Similar Data in GSS-API

gss_buffer_t pointerStrings and Similar Data in GSS-API

GSS_C_ACCEPT credentialWorking With Credentials in GSS-API

GSS_C_BOTH credentialWorking With Credentials in GSS-API

GSS_C_INITIATE credentialWorking With Credentials in GSS-API

GSS_CALLING_ERROR macro

Status Code Macros

GSS-API Status Codes

gss_canonicalize_name() functionGSS-API Functions

gss_canonicalize_name() functionUsing gss_import_name

gss_channel_bindings_structure structuregss_channel_bindings_struct Data Type

gss_channel_bindings_t data typeUsing Channel Bindings in GSS-API

gss_compare_name() functionGSS-API Functions

gss_compare_name() function

Comparing Names (Slow)

Comparing Names in GSS-API

gss_context_time() functionGSS-API Functions

gss_create_empty_oid_set() functionGSS-API Functions

gss_delete_oid() functionFunctions for Manipulating OIDs

gss_delete_sec_context() functionGSS-API Functions

gss_delete_sec_context() functionCleaning Up a GSS-API Session

releasing contextsDeletion of Contexts and Stored Data

gss_display_name() functionGSS-API Functions

gss_display_name() functionUsing gss_import_name

gss_display_status() functionGSS-API Functions

gss_display_status() functionDisplaying Status Codes

gss_duplicate_name() functionGSS-API Functions

gss_export_context() functionInterprocess Tokens in GSS-API

gss_export_name() functionGSS-API Functions

gss_export_sec_context() functionGSS-API Functions

gss_export_sec_context() functionExporting and Importing Contexts in GSS-API

gss_get_mic() functionGSS-API Functions

gss_get_mic() function

Tagging Messages With gss_get_mic

Sending Protected Data in GSS-API

comparison with gss_wrap()functionSending Protected Data in GSS-API

GSS-API server exampleSigning and Returning the Message

gss_import_name() functionGSS-API Functions

gss_import_name() functionNames in GSS-API

GSS-API client exampleTranslating a Service Name into GSS-API Format

GSS-API server exampleAcquiring Credentials

gss_import_sec_context() functionGSS-API Functions

gss_import_sec_context() functionExporting and Importing Contexts in GSS-API

gss_indicate_mechs() functionGSS-API Functions

gss_init_sec_context() functionGSS-API Functions

gss_init_sec_context() function

Using Other Context Services in GSS-API

Initiating a Context in GSS-API

GSS-API client exampleEstablishing a Security Context for GSS-API

use in anonymous authenticationPerforming Anonymous Authentication in GSS-API

use in mutual authenticationPerforming Mutual Authentication Between Peers in GSS-API

gss_inquire_context functionObtaining Context Information in GSS-API

gss_inquire_context() functionGSS-API Functions

gss_inquire_cred() functionGSS-API Functions

gss_inquire_cred_by_mech() functionGSS-API Functions

gss_inquire_mechs_for_name() functionGSS-API Functions

gss_inquire_names_for_mech() functionGSS-API Functions

gss_OID pointerGSS-API OIDs

gss_OID_desc structuregss_OID_desc Data Type

gss_OID_set pointerOIDs Structure

gss_OID_set_desc structuregss_OID_set_desc Data Type

gss_OID_set_desc structureOIDs Structure

gss_oid_to_str() functionFunctions for Manipulating OIDs

gss_process_context_token() functionGSS-API Functions

gss_release_buffer() functionGSS-API Functions

gss_release_buffer() functionCleaning Up a GSS-API Session

gss_release_cred() functionGSS-API Functions

gss_release_cred() functionCleaning Up a GSS-API Session

GSS-API server exampleCleanup in the GSSAPI Server Example

gss_release_name() functionGSS-API Functions

gss_release_name() functionCleaning Up a GSS-API Session

releasing stored dataDeletion of Contexts and Stored Data

gss_release_oid() function

GSS-API client exampleGSSAPI Client Example: main Function

GSS-API server exampleAcquiring Credentials

gss_release_oid_set() functionGSS-API Functions

gss_release_oid_set() functionCleaning Up a GSS-API Session

GSS_ROUTINE_ERROR macro

Status Code Macros

GSS-API Status Codes

gss_seal() functionRenamed Functions

gss_sign() functionRenamed Functions

gss_str_to_oid() function

gss_str_to_oid Function

Functions for Manipulating OIDs

GSS_SUPPLEMENTARY_INFO macro

Status Code Macros

GSS-API Status Codes

gss_test_oid_set_member() functionGSS-API Functions

gss_unseal() functionRenamed Functions

gss_unwrap() functionGSS-API Functions

gss_unwrap() function

GSS-API server exampleUnwrapping the Message

gss_verify() functionRenamed Functions

gss_verify_mic() functionGSS-API Functions

gss_wrap() functionGSS-API Functions

gss_wrap() function

Handling Wrap Size Issues in GSS-API

Sending Protected Data in GSS-API

comparison with gss_get_mic() functionSending Protected Data in GSS-API

wrapping messagesWrapping Messages With gss_wrap

gss_wrap_size_limit() functionGSS-API Functions

gss_wrap_size_limit() functionHandling Wrap Size Issues in GSS-API

gssapi.h fileGeneralized GSS-API Usage

guidelines for privileged applicationsGuidelines for Developing Privileged Applications

H

header files

GSS-APIGeneralized GSS-API Usage

I

importing GSS-API contextsExporting and Importing Contexts in GSS-API

inetd

checking for in gss-client() exampleChecking for inetd

inheritable privilege set

definedInheritable Privilege Set

integers

GSS-APIGSS-API Integers

integrity

GSS-API

Sending Protected Data in GSS-API

Security Services in GSS-API

interprocess tokens

GSS-APIInterprocess Tokens in GSS-API

IPC privilegesPrivilege Categories

J

Java APISystem Security

K

Kerberos v5

GSS-APIAvailable Mechanisms in GSS-API

key managementSystem Security

Key Management Framework (KMF)Introduction to the Oracle Solaris Key Management Framework

keypairKMF Application Programming Interfaces

keystoreOracle Solaris Key Management Framework Features

KMF (Key Management Framework)Introduction to the Oracle Solaris Key Management Framework

kmfcfg(1) configuration utilityKMF Policy Enforcement Mechanisms

L

language bindings

GSS-APILanguage Bindings for GSS-API

libpamPAM Library

libpkcs11.so library

Cryptographic FrameworkComponents of the Cryptographic Framework

libsasl

initializationlibsasl Initialization

use of APICommunication in SASL

libsasl librarySASL Library Basics

limit privilege set

definedLimit Privilege Set

M

macros

GSS-API

GSS_CALLING_ERRORGSS-API Status Codes

GSS_ROUTINE_ERRORGSS-API Status Codes

GSS_SUPPLEMENTARY_INFOGSS-API Status Codes

major status codes

GSS-APIGSS-API Status Codes

descriptionsGSS-API Major Status Code Values

major-status codes

GSS-API

encodingGSS-API Status Codes

mech file/etc/gss/mech File

Mechanism Name (MN)Using gss_import_name

mechanisms

Cryptographic FrameworkOracle Solaris Cryptography Terminology

definedNetwork Security Architecture

GSS-APIAvailable Mechanisms in GSS-API

printable formatsgss_str_to_oid Function

SASLSecurity Mechanisms

specifying GSS-APIMechanisms and QOPs in GSS-API

memcmp functionComparing Names (Slow)

message digesting

Cryptographic FrameworkMessage Digest Example

Message Integrity Code  SeeMICs

messages  See Alsodata

encrypting with gss_wrap()Wrapping Messages With gss_wrap

GSS-APIGSS-API Tokens

out-of-sequence problemsDetecting Sequence Problems in GSS-API

sendingWrapping and Sending a Message

signingSigning and Returning the Message

transmission confirmationConfirming Message Transmission in GSS-API

unwrappingUnwrapping the Message

tagging with MICsTagging Messages With gss_get_mic

wrapping in GSS-APIHandling Wrap Size Issues in GSS-API

metaslot

Cryptographic FrameworkOracle Solaris Cryptography Terminology

MICs

definedSending Protected Data in GSS-API

GSS-API

tagging messagesTagging Messages With gss_get_mic

message transmission confirmationConfirming Message Transmission in GSS-API

minor status codes

GSS-APIGSS-API Status Codes

MN  SeeMechanism Name

mutual authentication

GSS-APIPerforming Mutual Authentication Between Peers in GSS-API

N

name types

GSS-APIName Types

names

comparing in GSS-APIComparing Names in GSS-API

GSS-APINames in GSS-API

types in GSS-APIName Types in GSS-API

network security

overviewNetwork Security Architecture

nxheap security extensionSecurity Extensions Framework

nxstack security extensionSecurity Extensions Framework

O

Object Identifiers  SeeOIDs

OCSP (Online Certificate Status Protocol)Oracle Solaris Key Management Framework Features

OIDs

constructingConstructing Mechanism OIDs

deallocation ofOID Set Structure

GSS-APIGSS-API OIDs

setsOIDs Structure

specifying

Specifying an OID

Mechanisms and QOPs in GSS-API

types of data stored asGSS-API OIDs

Online Certificate Status Protocol (OCSP)Oracle Solaris Key Management Framework Features

Oracle Solaris Cryptographic Framework  SeeCryptographic Framework

Oracle Solaris Enterprise Authentication Mechanism  SeeSEAM

out-of-sequence problems

GSS-APIDetecting Sequence Problems in GSS-API

P

PAMWriting PAM Applications and Services

authentication processPAM Authentication Process

consumer application exampleA Simple PAM Consumer Example

frameworkIntroduction to the PAM Framework

itemsRequirements for PAM Consumers

libraryPAM Library

requirements for PAM consumersRequirements for PAM Consumers

role in Oracle Solaris OSNetwork Security Architecture

service modulesPAM Service Modules

service provider exampleSample PAM Provider Service Module

service provider requirementsRequirements for PAM Service Providers

writing conversation functionsWriting Conversation Functions

pam.conf file  SeePAM configuration file

pam_end() functionRequirements for PAM Consumers

pam_getenvlist() functionOther Useful PAM Functions

pam_open_session() functionOther Useful PAM Functions

pam_set_item() functionRequirements for PAM Consumers

pam_setcred() functionA Simple PAM Consumer Example

pam_start() functionRequirements for PAM Consumers

parse_oid() functionSpecifying a Non-Default Mechanism

GSS-API client exampleGSSAPI Client Example: main Function

per-message tokens

GSS-APIGSS-API Tokens

permitted privilege set

definedPermitted Privilege Set

PKCS #11

C_GetInfo() functionPKCS #11 Functions: C_GetInfo

C_GetMechanismList() functionPKCS #11 Functions: C_GetMechanismList

C_GetSlotList() functionPKCS #11 Functions: C_GetSlotList

C_GetTokenInfo() functionPKCS #11 Functions: C_GetTokenInfo

C_Initialize() functionPKCS #11 Functions: C_Initialize

C_OpenSession() functionPKCS #11 Functions: C_OpenSession

function listPKCS #11 Function List

pkcs11_softtoken.so moduleOverview of the Cryptoki Library

SUNW_C_GetMechSession() function

Extended PKCS #11 Functions: SUNW_C_KeyToObject

Extended PKCS #11 Functions: SUNW_C_GetMechSession

pkcs11_kernel.so library

Cryptographic FrameworkComponents of the Cryptographic Framework

pkcs11_softtoken.so library

Cryptographic FrameworkComponents of the Cryptographic Framework

PKI (Public Key Infrastructure)Introduction to the Oracle Solaris Key Management Framework

pktool(1) key management toolKMF Key Management Tool

pluggable authentication module  SeePAM

pluggable interface

Cryptographic FrameworkComponents of the Cryptographic Framework

plugins

Cryptographic FrameworkOracle Solaris Cryptography Terminology

SASLSASL Plugin Overview

principals

GSS-APINames in GSS-API

PRIV_FILE_LINK_ANYPrivilege Categories

PRIV_OFF flagPrivilege Data Types

PRIV_ON flagPrivilege Data Types

PRIV_PROC_EXEC privilegePrivilege Categories

PRIV_PROC_FORK privilegePrivilege Categories

PRIV_PROC_INFO privilegePrivilege Categories

PRIV_PROC_SESSION privilegePrivilege Categories

PRIV_SET flagPrivilege Data Types

priv_set_t structurePrivilege Data Types

priv_str_to_set() function

synopsispriv_str_to_set for Mapping Privileges

priv_t typePrivilege Data Types

privilege sets

definedHow Privileges Are Implemented

privileged applications

definedPrivileged Applications

privileges

assignmentHow Administrators Assign Privileges

bracketing in the least privilege modelPrivilege Bracketing in the Least Privilege Model

bracketing in the superuser modelPrivilege Bracketing in the Superuser Model

categoriesPrivilege Categories

IPCPrivilege Categories

processPrivilege Categories

systemPrivilege Categories

System V IPCPrivilege Categories

code examplePrivilege Bracketing in the Least Privilege Model

compatibility with superuserCompatibility Between the Superuser and Privilege Models

data typesPrivilege Data Types

definedPrivileged Applications

interfacesPrivilege Interfaces

introductionSystem Security

operation flagsPrivilege Data Types

overviewAbout Privileges

priv_str_to_set() functionpriv_str_to_set for Mapping Privileges

privilege ID data typePrivilege Data Types

required header fileProgramming with Privileges

setppriv() functionsetppriv for Setting Privileges

use in application developmentGuidelines for Developing Privileged Applications

process privileges

Privilege Categories

  Seeprivileges

protecting data

GSS-APISending Protected Data in GSS-API

providers

Cryptographic Framework

Components of the Cryptographic Framework

Oracle Solaris Cryptography Terminology

definedNetwork Security Architecture

Public Key Infrastructure (PKI)Introduction to the Oracle Solaris Key Management Framework

Q

qop file/etc/gss/qop File

QOPsApplication Portability With GSS-API

role in wrap sizeHandling Wrap Size Issues in GSS-API

specifying

Files with OID Values

Mechanisms and QOPs in GSS-API

storage in OIDsGSS-API OIDs

Quality of Protection  SeeQOP

R

random byte generation

Cryptographic Framework

exampleRandom Byte Generation Example

remote procedure calls

GSS-APIRemote Procedure Calls With GSS-API

return codes

GSS-APIGSS-API Status Codes

RPCSEC_GSSRemote Procedure Calls With GSS-API

S

SASL

architectureSASL Architecture

authenticationSASL Authentication

authidSASL Library Basics

auxprop pluginsAuxiliary Property (auxprop) Plugins

callbacks

SASL_CB_AUTHNAMECommunication in SASL

SASL_CB_CANON_USERCommunication in SASL

SASL_CB_ECHOPROMPTCommunication in SASL

SASL_CB_GETCONFCommunication in SASL

SASL_CB_GETOPTCommunication in SASL

SASL_CB_GETPATHCommunication in SASL

SASL_CB_GETREALMCommunication in SASL

SASL_CB_LANGUAGECommunication in SASL

SASL_CB_LOGCommunication in SASL

SASL_CB_NOECHOPROMPTCommunication in SASL

SASL_CB_PASSCommunication in SASL

SASL_CB_PROXY_POLICYCommunication in SASL

SASL_CB_SERVER_USERDB_CHECKPASSCommunication in SASL

SASL_CB_SERVER_USERDB_SETPASSCommunication in SASL

SASL_CB_USERCommunication in SASL

SASL_CB_VERIFYFILECommunication in SASL

canonicalizationUser Canonicalization Plugins

client sample applicationSASL Client Example

confidentialitySASL Confidentiality and Integrity

connection contextsSASL Connection Contexts

functionsSASL Interface Summaries

integritySASL Confidentiality and Integrity

librarySASL Library Basics

libsasl APICommunication in SASL

libsasl initializationlibsasl Initialization

life cycleSteps in the SASL Cycle

mechanismsSecurity Mechanisms

overviewIntroduction to Simple Authentication Security Layer (SASL)

plugin designSASL Plugin Development Guidelines

client pluginsClient Plugins

overviewSASL Plugin Overview

server pluginsServer Plugins

structuresImportant Structures for SASL Plugins

reference tablesSASL Interface Summaries

releasing resourceslibsasl Cleanup

releasing sessionsReleasing SASL Sessions

role in Oracle Solaris OSNetwork Security Architecture

sample functionsCommon Code

sample outputSASL Example

server sample applicationSASL Server Example

session initializationSASL Session Initialization

setting SSFSASL Session Initialization

SPISASL Plugin Overview

SSFSASL Security Strength Factor

useridSASL Library Basics

sasl_canonuser_plug_nit() functionUser Canonicalization Plugins

SASL_CB_AUTHNAME callbackCommunication in SASL

SASL_CB_CANON_USER callbackCommunication in SASL

SASL_CB_ECHOPROMPT callbackCommunication in SASL

SASL_CB_GETCONF callbackCommunication in SASL

SASL_CB_GETOPT callbackCommunication in SASL

SASL_CB_GETPATH callbackCommunication in SASL

SASL_CB_GETREALM callbackCommunication in SASL

SASL_CB_LANGUAGE callbackCommunication in SASL

SASL_CB_LOG callbackCommunication in SASL

SASL_CB_NOECHOPROMPT callbackCommunication in SASL

SASL_CB_PASS callbackCommunication in SASL

SASL_CB_PROXY_POLICY callbackCommunication in SASL

SASL_CB_SERVER_USERDB_CHECKPASS callbackCommunication in SASL

SASL_CB_SERVER_USERDB_SETPASS callbackCommunication in SASL

SASL_CB_USER callbackCommunication in SASL

SASL_CB_VERIFYFILE callbackCommunication in SASL

sasl_client_add_plugin() functionSASL Plugin Overview

sasl_client_init() function

SASL Plugin Overview

libsasl Initialization

sasl_client_new() function

SASL life cycleSASL Session Initialization

sasl_client_start() function

SASL life cycleSASL Authentication

SASL_CONTINUE flagSASL Authentication

sasl_decode() functionSASL Confidentiality and Integrity

sasl_dispose() function

libsasl Cleanup

Releasing SASL Sessions

sasl_done() function

libsasl Cleanup

Releasing SASL Sessions

sasl_encode() functionSASL Confidentiality and Integrity

sasl_getprop() function

checking SSFSASL Confidentiality and Integrity

SASL_INTERACT flagSASL Authentication

SASL_OK flagSASL Authentication

sasl_server_add_plugin() functionSASL Plugin Overview

sasl_server_init() function

SASL Plugin Overview

libsasl Initialization

sasl_server_new() function

SASL life cycleSASL Session Initialization

sasl_server_start() function

SASL life cycleSASL Authentication

SEAM

GSS-APIAvailable Mechanisms in GSS-API

security context  Seecontexts

security extensions

kernelSecurity Extensions Framework

security mechanisms  SeeGSS-API

security policy

privileged application guidelinesGuidelines for Developing Privileged Applications

security strength factor  SeeSSF

send_token() function

GSS-API client exampleEstablishing a Security Context for GSS-API

sequence problems

GSS-APIDetecting Sequence Problems in GSS-API

server plugins

SASLServer Plugins

server_acquire_creds() function

GSS-API server exampleAcquiring Credentials

server_establish_context() function

GSS-API server exampleAccepting a Context

service provider interface  SeeSPI

session management

PAM service modulePAM Service Modules

session objects

Cryptographic FrameworkOracle Solaris Cryptography Terminology

setppriv() function

synopsissetppriv for Setting Privileges

shell escapes

and privilegesGuidelines for Developing Privileged Applications

sign_server() function

GSS-API client exampleGSSAPI Server Example: main Function

GSS-API server exampleReceiving Data From a Client

signature blocks

GSS-API

gss-client exampleReading and Verifying a Signature Block From a GSS-API Client

signing messages

GSS-APISigning and Returning the Message

signing messages example

Cryptographic FrameworkSign and Verify Example

Simple Authentication and Security Layer  SeeSASL

slots

Cryptographic FrameworkOracle Solaris Cryptography Terminology

soft tokens

Cryptographic FrameworkOracle Solaris Cryptography Terminology

specifying a QOPFiles with OID Values

specifying mechanisms in GSS-APIFiles with OID Values

specifying OIDsSpecifying an OID

SPI

Cryptographic Framework

user levelComponents of the Cryptographic Framework

SSF

definedSASL Security Strength Factor

setting

SASL Authentication

SASL Session Initialization

status codes

GSS-API

GSS-API Status Codes

GSS-API Status Codes

majorGSS-API Status Codes

minorGSS-API Status Codes

strings

GSS-APIStrings and Similar Data in GSS-API

SUNW_C_GetMechSession() function

digest message exampleMessage Digest Example

symmetric encryption exampleSymmetric Encryption Example

SUNW_C_GetMechSession() function

Extended PKCS #11 Functions: SUNW_C_KeyToObject

Extended PKCS #11 Functions: SUNW_C_GetMechSession

sxadm commandUsing the sxadm Command to Manage Security Extensions

symmetric encryption

Cryptographic Framework

exampleSymmetric Encryption Example

system privilegesPrivilege Categories

System V IPC privilegesPrivilege Categories

T

test_import_export_context() function

GSS-API server exampleUsing the test_import_export_context Function

token objects

Cryptographic FrameworkOracle Solaris Cryptography Terminology

tokens

Cryptographic FrameworkOracle Solaris Cryptography Terminology

distinguishing GSS-API typesGSS-API Tokens

GSS-APIGSS-API Tokens

context-levelGSS-API Tokens

interprocessInterprocess Tokens in GSS-API

per-messageGSS-API Tokens

U

userid

SASLSASL Library Basics

V

verifying messages example

Cryptographic Framework

exampleSign and Verify Example

W

wrapping messages

GSS-APIHandling Wrap Size Issues in GSS-API