Go to main content

Developer's Guide to Oracle® Solaris 11.3 Security

Exit Print View

Updated: April 2020

Specifying an OID

You should use the default QOP and mechanism provided by the GSS-API if at all possible. See GSS-API OIDs. However, you might have your own reasons for specifying OIDs. This appendix describes how to specify OIDs.

Files with OID Values

For convenience, the GSS-API does allow mechanisms and QOPs to be displayed in human-readable form. On Oracle Solaris systems, two files, /etc/gss/mech and /etc/gss/qop, contain information about available mechanisms and available QOPs. If you do not have access to these files, then you must provide the string literals from some other source. The published Internet standard for that mechanism or QOP should serve that purpose.

/etc/gss/mech File

    The /etc/gss/mech file lists the mechanisms that are available. /etc/gss/mech contains the names in both the numerical format and the alphabetic form. /etc/gss/mech presents the information in this format:

  • Mechanism name, in ASCII

  • Mechanism's OID

  • Shared library for implementing the services that are provided by this mechanism

  • Optionally, the kernel module for implementing the service

A sample /etc/gss/mech might look like Example 34, The /etc/gss/mech File.

Example 34  The /etc/gss/mech File
# Copyright (c) 2005, 2015, Oracle and/or its affiliates. All rights reserved.
#ident	"@(#)mech	1.12	03/10/20 SMI"
# This file contains the GSS-API based security mechanism names,
# the associated object identifiers (OID) and a shared library that 
# implements the services for the mechanisms under GSS-API.
# Mechanism Name	Object Identifier	Shared Library	Kernel Module
kerberos_v5		1.2.840.113554.1.2.2	mech_krb5.so kmech_krb5 
spnego		mech_spnego.so.1 [msinterop]
diffie_hellman_640_0	dh640-0.so.1
diffie_hellman_1024_0	dh1024-0.so.1

/etc/gss/qop File

The /etc/gss/qop file stores, for all mechanisms installed, all the QOPs supported by each mechanism, both as an ASCII string and as the corresponding 32-bit integer. A sample /etc/gss/qop might look like the following example.

Example 35  The /etc/gss/qop File
# Copyright (c) 2000,2012

 by Oracle and/or its affiliates. All rights reserved. .
# All rights reserved.
#ident  "@(#)qop 1.3     00/11/09 SMI" 
# This file contains information about the GSS-API based quality of
# protection (QOP), its string name and its value (32-bit integer).
# QOP string                    QOP Value       Mechanism Name
GSS_KRB5_INTEG_C_QOP_DES_MD5    0               kerberos_v5
GSS_KRB5_CONF_C_QOP_DES         0               kerberos_v5