2 Unix SMB/CIFS implementation.
4 Kerberos backend for GENSEC
6 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
7 Copyright (C) Andrew Tridgell 2001
8 Copyright (C) Luke Howard 2002-2003
9 Copyright (C) Stefan Metzmacher 2004-2005
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
22 You should have received a copy of the GNU General Public License
23 along with this program; if not, write to the Free Software
24 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #include "system/kerberos.h"
29 #include "system/time.h"
30 #include "libcli/auth/kerberos.h"
31 #include "librpc/gen_ndr/ndr_krb5pac.h"
32 #include "auth/auth.h"
34 enum GENSEC_KRB5_STATE {
35 GENSEC_KRB5_SERVER_START,
36 GENSEC_KRB5_CLIENT_START,
37 GENSEC_KRB5_CLIENT_MUTUAL_AUTH,
41 struct gensec_krb5_state {
42 DATA_BLOB session_key;
44 enum GENSEC_KRB5_STATE state_position;
45 krb5_context krb5_context;
46 krb5_auth_context krb5_auth_context;
47 krb5_ccache krb5_ccache;
49 krb5_keyblock krb5_keyblock;
53 #ifdef KRB5_DO_VERIFY_PAC
54 static NTSTATUS gensec_krb5_pac_checksum(DATA_BLOB pac_data,
55 struct PAC_SIGNATURE_DATA *sig,
56 struct gensec_krb5_state *gensec_krb5_state,
64 cksum.cksumtype = (CKSUMTYPE)sig->type;
65 cksum.checksum.length = sizeof(sig->signature);
66 cksum.checksum.data = sig->signature;
69 ret = krb5_crypto_init(gensec_krb5_state->krb5_context,
70 &gensec_krb5_state->krb5_keyblock,
74 DEBUG(0,("krb5_crypto_init() failed\n"));
75 return NT_STATUS_FOOBAR;
77 for (i=0; i < 40; i++) {
79 ret = krb5_verify_checksum(gensec_krb5_state->krb5_context,
86 DEBUG(0,("PAC Verified: keyusage: %d\n", keyusage));
90 krb5_crypto_destroy(gensec_krb5_state->krb5_context, crypto);
93 DEBUG(0,("NOT verifying PAC checksums yet!\n"));
94 //return NT_STATUS_LOGON_FAILURE;
96 DEBUG(0,("PAC checksums verified!\n"));
103 static NTSTATUS gensec_krb5_decode_pac(TALLOC_CTX *mem_ctx,
104 struct PAC_LOGON_INFO **logon_info_out,
106 struct gensec_krb5_state *gensec_krb5_state)
109 struct PAC_SIGNATURE_DATA srv_sig;
110 struct PAC_SIGNATURE_DATA *srv_sig_ptr;
111 struct PAC_SIGNATURE_DATA kdc_sig;
112 struct PAC_SIGNATURE_DATA *kdc_sig_ptr;
113 struct PAC_LOGON_INFO *logon_info = NULL;
114 struct PAC_DATA pac_data;
115 #ifdef KRB5_DO_VERIFY_PAC
116 DATA_BLOB tmp_blob = data_blob(NULL, 0);
120 status = ndr_pull_struct_blob(&blob, mem_ctx, &pac_data,
121 (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
122 if (!NT_STATUS_IS_OK(status)) {
123 DEBUG(0,("can't parse the PAC\n"));
126 NDR_PRINT_DEBUG(PAC_DATA, &pac_data);
128 if (pac_data.num_buffers < 3) {
129 /* we need logon_ingo, service_key and kdc_key */
130 DEBUG(0,("less than 3 PAC buffers\n"));
131 return NT_STATUS_FOOBAR;
134 for (i=0; i < pac_data.num_buffers; i++) {
135 switch (pac_data.buffers[i].type) {
136 case PAC_TYPE_LOGON_INFO:
137 if (!pac_data.buffers[i].info) {
140 logon_info = &pac_data.buffers[i].info->logon_info;
142 case PAC_TYPE_SRV_CHECKSUM:
143 if (!pac_data.buffers[i].info) {
146 srv_sig_ptr = &pac_data.buffers[i].info->srv_cksum;
147 srv_sig = pac_data.buffers[i].info->srv_cksum;
149 case PAC_TYPE_KDC_CHECKSUM:
150 if (!pac_data.buffers[i].info) {
153 kdc_sig_ptr = &pac_data.buffers[i].info->kdc_cksum;
154 kdc_sig = pac_data.buffers[i].info->kdc_cksum;
156 case PAC_TYPE_UNKNOWN_10:
164 DEBUG(0,("PAC no logon_info\n"));
165 return NT_STATUS_FOOBAR;
169 DEBUG(0,("PAC no srv_key\n"));
170 return NT_STATUS_FOOBAR;
174 DEBUG(0,("PAC no kdc_key\n"));
175 return NT_STATUS_FOOBAR;
177 #ifdef KRB5_DO_VERIFY_PAC
178 /* clear the kdc_key */
179 /* memset((void *)kdc_sig_ptr , '\0', sizeof(*kdc_sig_ptr));*/
181 status = ndr_push_struct_blob(&tmp_blob, mem_ctx, &pac_data,
182 (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
183 if (!NT_STATUS_IS_OK(status)) {
186 status = ndr_pull_struct_blob(&tmp_blob, mem_ctx, &pac_data,
187 (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
188 if (!NT_STATUS_IS_OK(status)) {
189 DEBUG(0,("can't parse the PAC\n"));
192 /*NDR_PRINT_DEBUG(PAC_DATA, &pac_data);*/
194 /* verify by kdc_key */
195 status = gensec_krb5_pac_checksum(tmp_blob, &kdc_sig, gensec_krb5_state, 0);
197 if (!NT_STATUS_IS_OK(status)) {
201 /* clear the service_key */
202 /* memset((void *)srv_sig_ptr , '\0', sizeof(*srv_sig_ptr));*/
204 status = ndr_push_struct_blob(&tmp_blob, mem_ctx, &pac_data,
205 (ndr_push_flags_fn_t)ndr_push_PAC_DATA);
206 if (!NT_STATUS_IS_OK(status)) {
209 status = ndr_pull_struct_blob(&tmp_blob, mem_ctx, &pac_data,
210 (ndr_pull_flags_fn_t)ndr_pull_PAC_DATA);
211 if (!NT_STATUS_IS_OK(status)) {
212 DEBUG(0,("can't parse the PAC\n"));
215 NDR_PRINT_DEBUG(PAC_DATA, &pac_data);
217 /* verify by servie_key */
218 status = gensec_krb5_pac_checksum(tmp_blob, &srv_sig, gensec_krb5_state, 0);
220 if (!NT_STATUS_IS_OK(status)) {
224 DEBUG(0,("account_name: %s [%s]\n",logon_info->info3.base.account_name.string, logon_info->info3.base.full_name.string));
225 *logon_info_out = logon_info;
230 static int gensec_krb5_destory(void *ptr)
232 struct gensec_krb5_state *gensec_krb5_state = ptr;
234 if (gensec_krb5_state->ticket.length) {
235 kerberos_free_data_contents(gensec_krb5_state->krb5_context, &gensec_krb5_state->ticket);
237 if (gensec_krb5_state->krb5_ccache) {
238 /* current heimdal - 0.6.3, which we need anyway, fixes segfaults here */
239 krb5_cc_close(gensec_krb5_state->krb5_context, gensec_krb5_state->krb5_ccache);
242 krb5_free_keyblock_contents(gensec_krb5_state->krb5_context,
243 &gensec_krb5_state->krb5_keyblock);
245 if (gensec_krb5_state->krb5_auth_context) {
246 krb5_auth_con_free(gensec_krb5_state->krb5_context,
247 gensec_krb5_state->krb5_auth_context);
250 if (gensec_krb5_state->krb5_context) {
251 krb5_free_context(gensec_krb5_state->krb5_context);
256 static NTSTATUS gensec_krb5_start(struct gensec_security *gensec_security)
258 struct gensec_krb5_state *gensec_krb5_state;
259 krb5_error_code ret = 0;
261 gensec_krb5_state = talloc(gensec_security, struct gensec_krb5_state);
262 if (!gensec_krb5_state) {
263 return NT_STATUS_NO_MEMORY;
266 gensec_security->private_data = gensec_krb5_state;
268 initialize_krb5_error_table();
269 gensec_krb5_state->krb5_context = NULL;
270 gensec_krb5_state->krb5_auth_context = NULL;
271 gensec_krb5_state->krb5_ccache = NULL;
272 ZERO_STRUCT(gensec_krb5_state->ticket);
273 ZERO_STRUCT(gensec_krb5_state->krb5_keyblock);
274 gensec_krb5_state->session_key = data_blob(NULL, 0);
275 gensec_krb5_state->pac = data_blob(NULL, 0);
277 talloc_set_destructor(gensec_krb5_state, gensec_krb5_destory);
279 ret = krb5_init_context(&gensec_krb5_state->krb5_context);
281 DEBUG(1,("gensec_krb5_start: krb5_init_context failed (%s)\n", error_message(ret)));
282 return NT_STATUS_INTERNAL_ERROR;
285 if (lp_realm() && *lp_realm()) {
286 ret = krb5_set_default_realm(gensec_krb5_state->krb5_context, lp_realm());
288 DEBUG(1,("gensec_krb5_start: krb5_set_default_realm failed (%s)\n", error_message(ret)));
289 return NT_STATUS_INTERNAL_ERROR;
293 ret = krb5_auth_con_init(gensec_krb5_state->krb5_context, &gensec_krb5_state->krb5_auth_context);
295 DEBUG(1,("gensec_krb5_start: krb5_auth_con_init failed (%s)\n", error_message(ret)));
296 return NT_STATUS_INTERNAL_ERROR;
302 static NTSTATUS gensec_krb5_server_start(struct gensec_security *gensec_security)
305 struct gensec_krb5_state *gensec_krb5_state;
307 nt_status = gensec_krb5_start(gensec_security);
308 if (!NT_STATUS_IS_OK(nt_status)) {
312 gensec_krb5_state = gensec_security->private_data;
313 gensec_krb5_state->state_position = GENSEC_KRB5_SERVER_START;
318 static NTSTATUS gensec_krb5_client_start(struct gensec_security *gensec_security)
320 struct gensec_krb5_state *gensec_krb5_state;
324 nt_status = gensec_krb5_start(gensec_security);
325 if (!NT_STATUS_IS_OK(nt_status)) {
329 gensec_krb5_state = gensec_security->private_data;
330 gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_START;
332 /* TODO: This is effecivly a static/global variable...
334 TODO: If the user set a username, we should use an in-memory CCACHE (see below)
336 ret = krb5_cc_default(gensec_krb5_state->krb5_context, &gensec_krb5_state->krb5_ccache);
338 DEBUG(1,("krb5_cc_default failed (%s)\n",
339 error_message(ret)));
340 return NT_STATUS_INTERNAL_ERROR;
344 if (gensec_security->target.principal) {
345 DEBUG(5, ("Finding ticket for target [%s]\n", gensec_security->target.principal));
346 ret = ads_krb5_mk_req(gensec_krb5_state->krb5_context,
347 &gensec_krb5_state->krb5_auth_context,
348 AP_OPTS_USE_SUBKEY | AP_OPTS_MUTUAL_REQUIRED,
349 gensec_security->target.principal,
350 gensec_krb5_state->krb5_ccache,
351 &gensec_krb5_state->ticket);
354 const char *hostname = gensec_get_target_hostname(gensec_security);
356 DEBUG(1, ("Could not determine hostname for target computer, cannot use kerberos\n"));
357 return NT_STATUS_ACCESS_DENIED;
362 ret = krb5_mk_req(gensec_krb5_state->krb5_context,
363 &gensec_krb5_state->krb5_auth_context,
364 AP_OPTS_USE_SUBKEY | AP_OPTS_MUTUAL_REQUIRED,
365 gensec_get_target_service(gensec_security),
367 &in_data, gensec_krb5_state->krb5_ccache,
368 &gensec_krb5_state->ticket);
374 case KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:
375 DEBUG(3, ("Server is not registered with our KDC: %s\n",
376 error_message(ret)));
377 return NT_STATUS_ACCESS_DENIED;
378 case KRB5KDC_ERR_PREAUTH_FAILED:
379 case KRB5KRB_AP_ERR_TKT_EXPIRED:
382 DEBUG(3, ("kerberos (mk_req) failed: %s\n",
383 error_message(ret)));
384 /* fall down to remaining code */
386 /* just don't print a message for these really ordinary messages */
387 case KRB5_FCC_NOFILE:
388 case KRB5_CC_NOTFOUND:
394 nt_status = gensec_get_password(gensec_security,
397 if (!NT_STATUS_IS_OK(nt_status)) {
401 /* this string should be unique */
402 ccache_string = talloc_asprintf(gensec_krb5_state, "MEMORY:%s:%s:%s",
403 gensec_get_client_principal(gensec_security, gensec_krb5_state),
404 gensec_get_target_principal(gensec_security),
405 generate_random_str(gensec_krb5_state, 16));
407 ret = krb5_cc_resolve(gensec_krb5_state->krb5_context, ccache_string, &gensec_krb5_state->krb5_ccache);
409 DEBUG(1,("failed to generate a new krb5 keytab (%s): %s\n",
411 error_message(ret)));
412 return NT_STATUS_INTERNAL_ERROR;
415 ret = kerberos_kinit_password_cc(gensec_krb5_state->krb5_context, gensec_krb5_state->krb5_ccache,
416 gensec_get_client_principal(gensec_security, gensec_krb5_state),
417 password, NULL, &kdc_time);
419 /* cope with ticket being in the future due to clock skew */
420 if ((unsigned)kdc_time > time(NULL)) {
421 time_t t = time(NULL);
422 int time_offset =(unsigned)kdc_time-t;
423 DEBUG(4,("Advancing clock by %d seconds to cope with clock skew\n", time_offset));
424 krb5_set_real_time(gensec_krb5_state->krb5_context, t + time_offset + 1, 0);
428 DEBUG(1,("kinit failed (%s)\n",
429 error_message(ret)));
430 return NT_STATUS_WRONG_PASSWORD;
435 DEBUG(0, ("kerberos: %s\n",
436 error_message(ret)));
437 return NT_STATUS_UNSUCCESSFUL;
444 * Next state function for the Krb5 GENSEC mechanism
446 * @param gensec_krb5_state KRB5 State
447 * @param out_mem_ctx The TALLOC_CTX for *out to be allocated on
448 * @param in The request, as a DATA_BLOB
449 * @param out The reply, as an talloc()ed DATA_BLOB, on *out_mem_ctx
450 * @return Error, MORE_PROCESSING_REQUIRED if a reply is sent,
451 * or NT_STATUS_OK if the user is authenticated.
454 static NTSTATUS gensec_krb5_update(struct gensec_security *gensec_security,
455 TALLOC_CTX *out_mem_ctx,
456 const DATA_BLOB in, DATA_BLOB *out)
458 struct gensec_krb5_state *gensec_krb5_state = gensec_security->private_data;
459 krb5_error_code ret = 0;
463 switch (gensec_krb5_state->state_position) {
464 case GENSEC_KRB5_CLIENT_START:
467 DEBUG(1,("ads_krb5_mk_req (request ticket) failed (%s)\n",
468 error_message(ret)));
469 nt_status = NT_STATUS_LOGON_FAILURE;
471 DATA_BLOB unwrapped_out;
473 #ifndef GENSEC_SEND_UNWRAPPED_KRB5 /* This should be a switch for the torture code to set */
474 unwrapped_out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->ticket.data, gensec_krb5_state->ticket.length);
476 /* wrap that up in a nice GSS-API wrapping */
477 *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REQ);
479 *out = data_blob_talloc(out_mem_ctx, gensec_krb5_state->ticket.data, gensec_krb5_state->ticket.length);
481 gensec_krb5_state->state_position = GENSEC_KRB5_CLIENT_MUTUAL_AUTH;
482 nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
488 case GENSEC_KRB5_CLIENT_MUTUAL_AUTH:
491 krb5_ap_rep_enc_part *repl = NULL;
493 DATA_BLOB unwrapped_in;
495 if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
496 DEBUG(1,("gensec_gssapi_parse_krb5_wrap(mutual authentication) failed to parse\n"));
497 dump_data_pw("Mutual authentication message:\n", in.data, in.length);
498 return NT_STATUS_INVALID_PARAMETER;
500 /* TODO: check the tok_id */
502 inbuf.data = unwrapped_in.data;
503 inbuf.length = unwrapped_in.length;
504 ret = krb5_rd_rep(gensec_krb5_state->krb5_context,
505 gensec_krb5_state->krb5_auth_context,
508 DEBUG(1,("krb5_rd_rep (mutual authentication) failed (%s)\n",
509 error_message(ret)));
510 dump_data_pw("Mutual authentication message:\n", inbuf.data, inbuf.length);
511 nt_status = NT_STATUS_ACCESS_DENIED;
513 *out = data_blob(NULL, 0);
514 nt_status = NT_STATUS_OK;
515 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
518 krb5_free_ap_rep_enc_part(gensec_krb5_state->krb5_context, repl);
523 case GENSEC_KRB5_SERVER_START:
526 DATA_BLOB unwrapped_in;
527 DATA_BLOB unwrapped_out = data_blob(NULL, 0);
531 *out = unwrapped_out;
532 return NT_STATUS_MORE_PROCESSING_REQUIRED;
535 /* Parse the GSSAPI wrapping, if it's there... (win2k3 allows it to be omited) */
536 if (!gensec_gssapi_parse_krb5_wrap(out_mem_ctx, &in, &unwrapped_in, tok_id)) {
537 nt_status = ads_verify_ticket(out_mem_ctx,
538 gensec_krb5_state->krb5_context,
539 gensec_krb5_state->krb5_auth_context,
541 gensec_get_target_service(gensec_security), &in,
542 &principal, &pac, &unwrapped_out,
543 &gensec_krb5_state->krb5_keyblock);
545 /* TODO: check the tok_id */
546 nt_status = ads_verify_ticket(out_mem_ctx,
547 gensec_krb5_state->krb5_context,
548 gensec_krb5_state->krb5_auth_context,
550 gensec_get_target_service(gensec_security),
552 &principal, &pac, &unwrapped_out,
553 &gensec_krb5_state->krb5_keyblock);
556 if (!NT_STATUS_IS_OK(nt_status)) {
561 gensec_krb5_state->pac = data_blob_talloc_reference(gensec_krb5_state, &pac);
564 if (NT_STATUS_IS_OK(nt_status)) {
565 gensec_krb5_state->state_position = GENSEC_KRB5_DONE;
566 /* wrap that up in a nice GSS-API wrapping */
567 #ifndef GENSEC_SEND_UNWRAPPED_KRB5
568 *out = gensec_gssapi_gen_krb5_wrap(out_mem_ctx, &unwrapped_out, TOK_ID_KRB_AP_REP);
570 *out = unwrapped_out;
572 gensec_krb5_state->peer_principal = talloc_steal(gensec_krb5_state, principal);
576 case GENSEC_KRB5_DONE:
580 return NT_STATUS_INVALID_PARAMETER;
583 static NTSTATUS gensec_krb5_session_key(struct gensec_security *gensec_security,
584 DATA_BLOB *session_key)
586 struct gensec_krb5_state *gensec_krb5_state = gensec_security->private_data;
587 krb5_context context = gensec_krb5_state->krb5_context;
588 krb5_auth_context auth_context = gensec_krb5_state->krb5_auth_context;
592 if (gensec_krb5_state->session_key.data) {
593 *session_key = gensec_krb5_state->session_key;
597 switch (gensec_security->gensec_role) {
599 err = krb5_auth_con_getlocalsubkey(context, auth_context, &skey);
602 err = krb5_auth_con_getremotesubkey(context, auth_context, &skey);
605 if (err == 0 && skey != NULL) {
606 DEBUG(10, ("Got KRB5 session key of length %d\n", KRB5_KEY_LENGTH(skey)));
607 gensec_krb5_state->session_key = data_blob_talloc(gensec_krb5_state,
608 KRB5_KEY_DATA(skey), KRB5_KEY_LENGTH(skey));
609 *session_key = gensec_krb5_state->session_key;
610 dump_data_pw("KRB5 Session Key:\n", session_key->data, session_key->length);
612 krb5_free_keyblock(context, skey);
615 DEBUG(10, ("KRB5 error getting session key %d\n", err));
616 return NT_STATUS_NO_USER_SESSION_KEY;
620 static NTSTATUS gensec_krb5_session_info(struct gensec_security *gensec_security,
621 struct auth_session_info **_session_info)
624 struct gensec_krb5_state *gensec_krb5_state = gensec_security->private_data;
625 struct auth_serversupplied_info *server_info = NULL;
626 struct auth_session_info *session_info = NULL;
627 struct PAC_LOGON_INFO *logon_info;
630 const char *account_name;
633 principal = talloc_strdup(gensec_krb5_state, gensec_krb5_state->peer_principal);
634 NT_STATUS_HAVE_NO_MEMORY(principal);
636 p = strchr(principal, '@');
644 account_name = principal;
646 /* decode and verify the pac */
647 nt_status = gensec_krb5_decode_pac(gensec_krb5_state, &logon_info, gensec_krb5_state->pac,
650 /* IF we have the PAC - otherwise we need to get this
651 * data from elsewere - local ldb, or (TODO) lookup of some
654 * when heimdal can generate the PAC, we should fail if there's
658 if (NT_STATUS_IS_OK(nt_status)) {
659 union netr_Validation validation;
660 validation.sam3 = &logon_info->info3;
661 nt_status = make_server_info_netlogon_validation(gensec_krb5_state,
665 talloc_free(principal);
666 NT_STATUS_NOT_OK_RETURN(nt_status);
668 DATA_BLOB user_sess_key = data_blob(NULL, 0);
669 DATA_BLOB lm_sess_key = data_blob(NULL, 0);
670 /* TODO: should we pass the krb5 session key in here? */
671 nt_status = sam_get_server_info(gensec_krb5_state, account_name, realm,
672 user_sess_key, lm_sess_key,
674 talloc_free(principal);
675 NT_STATUS_NOT_OK_RETURN(nt_status);
678 /* references the server_info into the session_info */
679 nt_status = auth_generate_session_info(gensec_krb5_state, server_info, &session_info);
680 talloc_free(server_info);
681 NT_STATUS_NOT_OK_RETURN(nt_status);
683 nt_status = gensec_krb5_session_key(gensec_security, &session_info->session_key);
684 NT_STATUS_NOT_OK_RETURN(nt_status);
686 *_session_info = session_info;
691 static BOOL gensec_krb5_have_feature(struct gensec_security *gensec_security,
694 if (feature & GENSEC_FEATURE_SESSION_KEY) {
702 static const struct gensec_security_ops gensec_krb5_security_ops = {
704 .auth_type = DCERPC_AUTH_TYPE_KRB5,
705 .oid = GENSEC_OID_KERBEROS5,
706 .client_start = gensec_krb5_client_start,
707 .server_start = gensec_krb5_server_start,
708 .update = gensec_krb5_update,
709 .session_key = gensec_krb5_session_key,
710 .session_info = gensec_krb5_session_info,
711 .have_feature = gensec_krb5_have_feature,
715 static const struct gensec_security_ops gensec_ms_krb5_security_ops = {
717 .auth_type = DCERPC_AUTH_TYPE_KRB5,
718 .oid = GENSEC_OID_KERBEROS5_OLD,
719 .client_start = gensec_krb5_client_start,
720 .server_start = gensec_krb5_server_start,
721 .update = gensec_krb5_update,
722 .session_key = gensec_krb5_session_key,
723 .session_info = gensec_krb5_session_info,
724 .have_feature = gensec_krb5_have_feature,
729 NTSTATUS gensec_krb5_init(void)
733 ret = gensec_register(&gensec_krb5_security_ops);
734 if (!NT_STATUS_IS_OK(ret)) {
735 DEBUG(0,("Failed to register '%s' gensec backend!\n",
736 gensec_krb5_security_ops.name));
740 ret = gensec_register(&gensec_ms_krb5_security_ops);
741 if (!NT_STATUS_IS_OK(ret)) {
742 DEBUG(0,("Failed to register '%s' gensec backend!\n",
743 gensec_krb5_security_ops.name));