19 releases

0.7.0 Jan 9, 2024
0.6.4 Mar 30, 2023
0.6.3 Jul 12, 2022
0.6.1 Mar 29, 2022
0.4.0 Mar 23, 2020

#55 in Authentication

Download history 305/week @ 2023-12-22 293/week @ 2023-12-29 704/week @ 2024-01-05 494/week @ 2024-01-12 456/week @ 2024-01-19 595/week @ 2024-01-26 601/week @ 2024-02-02 785/week @ 2024-02-09 733/week @ 2024-02-16 632/week @ 2024-02-23 726/week @ 2024-03-01 452/week @ 2024-03-08 656/week @ 2024-03-15 693/week @ 2024-03-22 674/week @ 2024-03-29 555/week @ 2024-04-05

2,641 downloads per month
Used in 33 crates (4 directly)

MIT license

86KB
2K SLoC

libgssapi

A safe MIT licensed binding to gssapi

see rfc2744 for more info

gssapi is a huge and complex beast that is also very old (like Computer Chronicles old). So while this library might work for lots of mechanisms it has only been tested (so far) with Kerberos 5 using the MIT and Apple implementations.

For a simpler cross platform interface to Kerberos 5 see cross-krb5.

Example KRB5 Mutual Authentication Between Client and Server

use libgssapi::{
    name::Name,
    credential::{Cred, CredUsage},
    error::Error,
    context::{CtxFlags, ClientCtx, ServerCtx, SecurityContext},
    util::Buf,
    oid::{OidSet, GSS_NT_HOSTBASED_SERVICE, GSS_MECH_KRB5},
};

fn setup_server_ctx(
    service_name: &[u8],
    desired_mechs: &OidSet
) -> Result<(ServerCtx, Name), Error> {
    let name = Name::new(service_name, Some(&GSS_NT_HOSTBASED_SERVICE))?;
    let cname = name.canonicalize(Some(&GSS_MECH_KRB5))?;
    let server_cred = Cred::acquire(
        Some(&cname), None, CredUsage::Accept, Some(desired_mechs)
    )?;
    Ok((ServerCtx::new(&server_cred), cname))
}

fn run(service_name: &[u8]) -> Result<(), Error> {
    let desired_mechs = {
        let mut s = OidSet::new()?;
        s.add(&GSS_MECH_KRB5)?;
        s
    };
    let (server_ctx, cname) = setup_server_ctx(service_name, &desired_mechs)?;
    let client_cred = Cred::acquire(
        None, None, CredUsage::Initiate, Some(&desired_mechs)
    )?;
    let client_ctx = ClientCtx::new(
        &client_cred, service_name, CtxFlags::GSS_C_MUTUAL_FLAG, Some(&GSS_MECH_KRB5)
    ))
    let mut server_tok: Option<Buf> = None;
    loop {
        match client_ctx.step(server_tok.as_ref().map(|b| &**b))? {
            None => break,
            Some(client_tok) => match server_ctx.step(&*client_tok)? {
                None => break,
                Some(tok) => { server_tok = Some(tok); }
            }
        }
    }
    let secret_msg = client_ctx.wrap(true, b"super secret message")?;
    let decoded_msg = server_ctx.unwrap(&*secret_msg)?;
    Ok(())
}

Dependencies

~0.2–2.1MB
~42K SLoC