package gssapi

Import Path
	github.com/jcmturner/gokrb5/v8/gssapi (on go.dev)

Dependency Relation
	imports 11 packages, and imported by one package

Involved Source Files

	    MICToken.go
	    contextFlags.go
	  d gssapi.go
		Package gssapi implements Generic Security Services Application Program Interface required for SPNEGO kerberos authentication.

	    wrapToken.go
Package-Level Type Names (total 7)

	/* sort by: alphabet | popularity */
	 type ContextFlags asn1.BitString (struct)
		ContextFlags flags for GSSAPI
		DEPRECATED - do not use

		Fields (total 2)
			BitLength int
				// length in bits.

			Bytes []byte
				// bits packed into bytes.

		As Outputs Of (at least one exported)
			func NewContextFlags() ContextFlags

	 type ContextToken (interface)
		ContextToken is an interface for a GSS-API context token.

		Methods (total 4)
			( ContextToken) Context() context.Context
			( ContextToken) Marshal() ([]byte, error)
			( ContextToken) Unmarshal(b []byte) error
			( ContextToken) Verify() (bool, Status)
		Implemented By (at least 4)
			*github.com/jcmturner/gokrb5/v8/spnego.KRB5Token
			*github.com/jcmturner/gokrb5/v8/spnego.NegTokenInit
			*github.com/jcmturner/gokrb5/v8/spnego.NegTokenResp
			*github.com/jcmturner/gokrb5/v8/spnego.SPNEGOToken
		As Outputs Of (at least 2)
			func Mechanism.InitSecContext() (ContextToken, error)
			func github.com/jcmturner/gokrb5/v8/spnego.(*SPNEGO).InitSecContext() (ContextToken, error)
		As Inputs Of (at least 2)
			func Mechanism.AcceptSecContext(ct ContextToken) (bool, context.Context, Status)
			func github.com/jcmturner/gokrb5/v8/spnego.(*SPNEGO).AcceptSecContext(ct ContextToken) (bool, context.Context, Status)

	 type Mechanism (interface)
		Mechanism is the GSS-API interface for authentication mechanisms.

		Methods (total 8)
			( Mechanism) AcceptSecContext(ct ContextToken) (bool, context.Context, Status)
				// service verifies the token server side to establish a context

			( Mechanism) AcquireCred() error
				// acquire credentials for use (eg. AS exchange for KRB5)

			( Mechanism) InitSecContext() (ContextToken, error)
				// initiate outbound security context (eg TGS exchange builds AP_REQ to go into ContextToken to send to service)

			( Mechanism) MIC() MICToken
				// apply integrity check, receive as token separate from message

			( Mechanism) OID() asn1.ObjectIdentifier
			( Mechanism) Unwrap(wt WrapToken) []byte
				// decapsulate, decrypt if needed, validate integrity check

			( Mechanism) VerifyMIC(mt MICToken) (bool, error)
				// validate integrity check token along with message

			( Mechanism) Wrap(msg []byte) WrapToken
				// sign, optionally encrypt, encapsulate


	 type MICToken (struct)
		MICToken represents a GSS API MIC token, as defined in RFC 4121.
		It contains the header fields, the payload (this is not transmitted) and
		the checksum, and provides the logic for converting to/from bytes plus
		computing and verifying checksums

		Fields (total 4)
			Checksum []byte
				// checksum of { payload | header }

			Flags byte
				const GSS Token ID: 0x0404
				// contains three flags: acceptor, sealed, acceptor subkey

			Payload []byte
				// your data! :)

			SndSeqNum uint64
				const Filler: 0xFF 0xFF 0xFF 0xFF 0xFF
				// sender's sequence number. big-endian

		Methods (total 4)
			(*MICToken) Marshal() ([]byte, error)
				Marshal the MICToken into a byte slice.
				The payload should have been set and the checksum computed, otherwise an error is returned.

			(*MICToken) SetChecksum(key types.EncryptionKey, keyUsage uint32) error
				SetChecksum uses the passed encryption key and key usage to compute the checksum over the payload and
				the header, and sets the Checksum field of this MICToken.
				If the payload has not been set or the checksum has already been set, an error is returned.

			(*MICToken) Unmarshal(b []byte, expectFromAcceptor bool) error
				Unmarshal bytes into the corresponding MICToken.
				If expectFromAcceptor is true we expect the token to have been emitted by the gss acceptor,
				and will check the according flag, returning an error if the token does not match the expectation.

			(*MICToken) Verify(key types.EncryptionKey, keyUsage uint32) (bool, error)
				Verify computes the token's checksum with the provided key and usage,
				and compares it to the checksum present in the token.
				In case of any failure, (false, err) is returned, with err an explanatory error.

		As Outputs Of (at least 2)
			func NewInitiatorMICToken(payload []byte, key types.EncryptionKey) (*MICToken, error)
			func Mechanism.MIC() MICToken
		As Inputs Of (at least one exported)
			func Mechanism.VerifyMIC(mt MICToken) (bool, error)

	 type OIDName string (basic type)
		OIDName is the type for defined GSS-API OIDs.

		Methods (only one)
			( OIDName) OID() asn1.ObjectIdentifier
				OID returns the OID for the provided OID name.

		As Types Of (total 4)
			const OIDGSSIAKerb
			const OIDKRB5
			const OIDMSLegacyKRB5
			const OIDSPNEGO

	 type Status (struct)
		Status is the GSS-API status and implements the error interface.

		Fields (total 2)
			Code int
			Message string
		Methods (only one)
			( Status) Error() string
				Error returns the Status description.

		Implements (at least one exported)
			 Status : error
		As Outputs Of (at least 7)
			func ContextToken.Verify() (bool, Status)
			func Mechanism.AcceptSecContext(ct ContextToken) (bool, context.Context, Status)
			func github.com/jcmturner/gokrb5/v8/spnego.(*KRB5Token).Verify() (bool, Status)
			func github.com/jcmturner/gokrb5/v8/spnego.(*NegTokenInit).Verify() (bool, Status)
			func github.com/jcmturner/gokrb5/v8/spnego.(*NegTokenResp).Verify() (bool, Status)
			func github.com/jcmturner/gokrb5/v8/spnego.(*SPNEGO).AcceptSecContext(ct ContextToken) (bool, context.Context, Status)
			func github.com/jcmturner/gokrb5/v8/spnego.(*SPNEGOToken).Verify() (bool, Status)

	 type WrapToken (struct)
		WrapToken represents a GSS API Wrap token, as defined in RFC 4121.
		It contains the header fields, the payload and the checksum, and provides
		the logic for converting to/from bytes plus computing and verifying checksums

		Fields (total 6)
			CheckSum []byte
				// authenticated checksum of { payload | header }

			EC uint16
				const Filler: 0xFF
				// checksum length. big-endian

			Flags byte
				const GSS Token ID: 0x0504
				// contains three flags: acceptor, sealed, acceptor subkey

			Payload []byte
				// your data! :)

			RRC uint16
				// right rotation count. big-endian

			SndSeqNum uint64
				// sender's sequence number. big-endian

		Methods (total 4)
			(*WrapToken) Marshal() ([]byte, error)
				Marshal the WrapToken into a byte slice.
				The payload should have been set and the checksum computed, otherwise an error is returned.

			(*WrapToken) SetCheckSum(key types.EncryptionKey, keyUsage uint32) error
				SetCheckSum uses the passed encryption key and key usage to compute the checksum over the payload and
				the header, and sets the CheckSum field of this WrapToken.
				If the payload has not been set or the checksum has already been set, an error is returned.

			(*WrapToken) Unmarshal(b []byte, expectFromAcceptor bool) error
				Unmarshal bytes into the corresponding WrapToken.
				If expectFromAcceptor is true, we expect the token to have been emitted by the gss acceptor,
				and will check the according flag, returning an error if the token does not match the expectation.

			(*WrapToken) Verify(key types.EncryptionKey, keyUsage uint32) (bool, error)
				Verify computes the token's checksum with the provided key and usage,
				and compares it to the checksum present in the token.
				In case of any failure, (false, Err) is returned, with Err an explanatory error.

		As Outputs Of (at least 2)
			func NewInitiatorWrapToken(payload []byte, key types.EncryptionKey) (*WrapToken, error)
			func Mechanism.Wrap(msg []byte) WrapToken
		As Inputs Of (at least one exported)
			func Mechanism.Unwrap(wt WrapToken) []byte


Package-Level Functions (total 3)

	 func NewContextFlags() ContextFlags
		NewContextFlags creates a new ContextFlags instance
		DEPRECATED - do not use

	 func NewInitiatorMICToken(payload []byte, key types.EncryptionKey) (*MICToken, error)
		NewInitiatorMICToken builds a new initiator token (acceptor flag will be set to 0) and computes the authenticated checksum.
		Other flags are set to 0.
		Note that in certain circumstances you may need to provide a sequence number that has been defined earlier.
		This is currently not supported.

	 func NewInitiatorWrapToken(payload []byte, key types.EncryptionKey) (*WrapToken, error)
		NewInitiatorWrapToken builds a new initiator token (acceptor flag will be set to 0) and computes the authenticated checksum.
		Other flags are set to 0, and the RRC and sequence number are initialized to 0.
		Note that in certain circumstances you may need to provide a sequence number that has been defined earlier.
		This is currently not supported.


Package-Level Constants (total 41)

	const ContextFlagAnon = 64
		GSS-API context flags assigned numbers.

	const ContextFlagConf = 16
		GSS-API context flags assigned numbers.

	const ContextFlagDeleg = 1
		GSS-API context flags assigned numbers.

	const ContextFlagInteg = 32
		GSS-API context flags assigned numbers.

	const ContextFlagMutual = 2
		GSS-API context flags assigned numbers.

	const ContextFlagReplay = 4
		GSS-API context flags assigned numbers.

	const ContextFlagSequence = 8
		GSS-API context flags assigned numbers.

	const FillerByte byte = 255
		FillerByte is a filler in the WrapToken structure

	const HdrLen = 16
		HdrLen is the length of the Wrap Token's header

	const MICTokenFlagAcceptorSubkey = 4
		MICTokenFlagAcceptorSubkey - a subkey asserted by the context acceptor is used to protect the message

	const MICTokenFlagSealed = 2
		MICTokenFlagSealed - this flag indicates confidentiality is provided for.  It SHALL NOT be set in MIC tokens

	const MICTokenFlagSentByAcceptor = 1
		MICTokenFlagSentByAcceptor - this flag indicates the sender is the context acceptor.  When not set, it indicates the sender is the context initiator

	const OIDGSSIAKerb OIDName = "GSSIAKerb" // Indicates the client cannot get a service ticket and asks the server to serve as an intermediate to the target KDC. http://k5wiki.kerberos.org/wiki/Projects/IAKERB#IAKERB_mech
		GSS-API OID names

	const OIDKRB5 OIDName = "KRB5" // MechType OID for Kerberos 5
		GSS-API OID names

	const OIDMSLegacyKRB5 OIDName = "MSLegacyKRB5" // MechType OID for Kerberos 5
		GSS-API OID names

	const OIDSPNEGO OIDName = "SPNEGO"
		GSS-API OID names

	const StatusBadBindings = 1
		GSS-API status values

	const StatusBadMech = 2
		GSS-API status values

	const StatusBadMIC = 64
		GSS-API status values

	const StatusBadName = 4
		GSS-API status values

	const StatusBadNameType = 8
		GSS-API status values

	const StatusBadQOP = 16384
		GSS-API status values

	const StatusBadSig = 32
		GSS-API status values

	const StatusBadStatus = 16
		GSS-API status values

	const StatusComplete = 524288
		GSS-API status values

	const StatusContextExpired = 128
		GSS-API status values

	const StatusContinueNeeded = 1048576
		GSS-API status values

	const StatusCredentialsExpired = 256
		GSS-API status values

	const StatusDefectiveCredential = 512
		GSS-API status values

	const StatusDefectiveToken = 1024
		GSS-API status values

	const StatusDuplicateElement = 131072
		GSS-API status values

	const StatusDuplicateToken = 2097152
		GSS-API status values

	const StatusFailure = 2048
		GSS-API status values

	const StatusGapToken = 16777216
		GSS-API status values

	const StatusNameNotMN = 262144
		GSS-API status values

	const StatusNoContext = 4096
		GSS-API status values

	const StatusNoCred = 8192
		GSS-API status values

	const StatusOldToken = 4194304
		GSS-API status values

	const StatusUnauthorized = 32768
		GSS-API status values

	const StatusUnavailable = 65536
		GSS-API status values

	const StatusUnseqToken = 8388608
		GSS-API status values

The pages are generated with Golds v0.6.7. (GOOS=linux GOARCH=amd64)
Golds is a Go 101 project developed by Tapir Liu.
PR and bug reports are welcome and can be submitted to the issue list.
Please follow @Go100and1 (reachable from the left QR code) to get the latest news of Golds.