Class: Kerberos::Krb5

Inherits:

Object

• Object
• Kerberos::Krb5

Defined in:

ext/rkerberos/rkerberos.c

Defined Under Namespace

Classes: Context, CredentialsCache, Exception, Keytab, Principal

Constant Summary

VERSION =

The version of the custom rkerberos library

0.3.1

ENCTYPE_NULL =

None

0

ENCTYPE_DES_CBC_CRC =

DES cbc mode with CRC-32

1

ENCTYPE_DES_CBC_MD4 =

DES cbc mode with RSA-MD4

2

ENCTYPE_DES_CBC_MD5 =

DES cbc mode with RSA-MD5

3

ENCTYPE_DES_CBC_RAW =

DES cbc mode raw

4

ENCTYPE_DES3_CBC_SHA =

DES-3 cbc mode with NIST-SHA

5

ENCTYPE_DES3_CBC_RAW =

DES-3 cbc mode raw

6

ENCTYPE_DES_HMAC_SHA1 =

HMAC SHA1

8

ENCTYPE_DSA_SHA1_CMS =

DSA with SHA1, CMS signature

9

ENCTYPE_MD5_RSA_CMS =

MD5 with RSA, CMS signature

10

ENCTYPE_SHA1_RSA_CMS =

SHA1 with RSA, CMS signature

11

ENCTYPE_RC2_CBC_ENV =

RC2 cbc mode, CMS enveloped data

12

ENCTYPE_RSA_ENV =

RSA encryption, CMS enveloped data

13

ENCTYPE_RSA_ES_OAEP_ENV =

RSA w/OEAP encryption, CMS enveloped data

14

ENCTYPE_DES3_CBC_ENV =

DES-3 cbc mode, CMS enveloped data

15

ENCTYPE_DES3_CBC_SHA1 =

DES3 CBC SHA1

16

ENCTYPE_AES128_CTS_HMAC_SHA1_96 =

AES128 CTS HMAC SHA1 96

17

ENCTYPE_AES256_CTS_HMAC_SHA1_96 =

AES256 CTS HMAC SHA1 96

18

ENCTYPE_ARCFOUR_HMAC =

ARCFOUR HMAC

23

ENCTYPE_ARCFOUR_HMAC_EXP =

ARCFOUR HMAC EXP

24

ENCTYPE_UNKNOWN =

Unknown

511

Class Method Summary

• .Kerberos::Krb5.thread_safe? ⇒ Boolean

  Returns true if the Kerberos library was built with multithread support, false otherwise.

Instance Method Summary

• #authenticate!(principal:, password:, service: nil) ⇒ Object

  Convenience method that: acquires initial credentials via password and immediately verifies those credentials using verify_init_creds with AP-REQ verification enabled (ap_req_nofail).

• #change_password(v_old, v_new) ⇒ Object
• #close ⇒ Object
• #expand_hostname(v_host) ⇒ Object
• #get_default_principal ⇒ Object (also: #default_principal)
• #get_default_realm ⇒ Object (also: #default_realm)
• #get_host_realm(v_host) ⇒ Object (also: #host_realm)
• #get_init_creds_keytab(*args) ⇒ Object (also: #init_creds_keytab)
• #get_init_creds_password(*args) ⇒ Object (also: #init_creds_password)
• #get_permitted_enctypes ⇒ Object (also: #permitted_enctypes)
• #Kerberos::Krb5.new(context: nil) ⇒ Object constructor

  Creates and returns a new Kerberos::Krb5 object.

• #set_default_realm(*args) ⇒ Object (also: #default_realm=)
• #verify_init_creds(*args) ⇒ Object

Constructor Details

#Kerberos::Krb5.new(context: nil) ⇒ Object

Creates and returns a new Kerberos::Krb5 object. This initializes the context for future method calls on that object.

If a context keyword argument is provided, it must be a Kerberos::Krb5::Context object. The context will be borrowed rather than creating a new one internally via krb5_init_context. The caller is retained for the lifetime of this Krb5 instance. The Context cannot be closed normally until this object has been closed.

A block form is also supported. If a block is given, the object is yielded to the block and automatically closed when the block returns.

# File 'ext/rkerberos/rkerberos.c', line 85

static VALUE rkrb5_initialize(int argc, VALUE* argv, VALUE self){
  RUBY_KRB5* ptr;
  VALUE v_opts, v_context;
  ID kw_table[1] = { rb_intern("context") };
  VALUE kw_vals[1];
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  rb_scan_args(argc, argv, "0:", &v_opts);

  if(NIL_P(v_opts))
    v_opts = rb_hash_new();

  rb_get_kwargs(v_opts, kw_table, 0, 1, kw_vals);
  v_context = kw_vals[0] == Qundef ? Qnil : kw_vals[0];

  if(!NIL_P(v_context)){
    ptr->ctx = rkrb5_context_borrow(v_context);
    ptr->rb_context = v_context;
  }
  else{
    kerror = krb5_init_context(&ptr->ctx);

    if(kerror)
      rb_raise(cKrb5Exception, "krb5_init_context: %s", error_message(kerror));
  }

  if(rb_block_given_p()){
    rb_ensure(rb_yield, self, rkrb5_close, self);
    return Qnil;
  }

  return self;
}

Class Method Details

.Kerberos::Krb5.thread_safe? ⇒ Boolean

Returns true if the Kerberos library was built with multithread support, false otherwise.

Returns:

• (Boolean)

# File 'ext/rkerberos/rkerberos.c', line 987

static VALUE rkrb5_s_thread_safe(VALUE klass){
  return krb5_is_thread_safe() ? Qtrue : Qfalse;
}

Instance Method Details

#authenticate!(principal:, password:, service: nil) ⇒ Object

Convenience method that: acquires initial credentials via password and immediately verifies those credentials using verify_init_creds with AP-REQ verification enabled (ap_req_nofail). This protects against KDC-forging/Zanarotti-style attacks by ensuring the ticket is verified against the KDC before it's treated as authenticated.

Returns true on success and raises Kerberos::Krb5::Exception on error.

# File 'ext/rkerberos/rkerberos.c', line 561

static VALUE rkrb5_authenticate_bang(int argc, VALUE* argv, VALUE self){
  RUBY_KRB5* ptr;
  VALUE v_kwargs, v_user, v_pass, v_service;
  ID kw_table[3] = { rb_intern("principal"), rb_intern("password"), rb_intern("service") };
  VALUE kw_vals[3];
  char* user;
  char* pass;
  char* service;
  krb5_error_code kerror;
  krb5_principal server_princ = NULL;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  // Free resources from a previous call to avoid leaks on repeated use.
  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  krb5_free_cred_contents(ptr->ctx, &ptr->creds);
  memset(&ptr->creds, 0, sizeof(ptr->creds));

  rb_scan_args(argc, argv, "0:", &v_kwargs);

  if(NIL_P(v_kwargs))
    v_kwargs = rb_hash_new();

  rb_get_kwargs(v_kwargs, kw_table, 2, 1, kw_vals);
  v_user = kw_vals[0];
  v_pass = kw_vals[1];
  v_service = kw_vals[2] == Qundef ? Qnil : kw_vals[2];

  Check_Type(v_user, T_STRING);
  Check_Type(v_pass, T_STRING);
  user = StringValueCStr(v_user);
  pass = StringValueCStr(v_pass);

  if(NIL_P(v_service)){
    service = NULL;
  }
  else{
    Check_Type(v_service, T_STRING);
    service = StringValueCStr(v_service);
  }

  // Acquire initial credentials (same as get_init_creds_password)
  kerror = krb5_parse_name(ptr->ctx, user, &ptr->princ);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_parse_name: %s", error_message(kerror));

  kerror = krb5_get_init_creds_password(
    ptr->ctx,
    &ptr->creds,
    ptr->princ,
    pass,
    0,
    NULL,
    0,
    service,
    NULL
  );

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_get_init_creds_password: %s", error_message(kerror));

  krb5_verify_init_creds_opt vicopt;

  krb5_verify_init_creds_opt_init(&vicopt);
  krb5_verify_init_creds_opt_set_ap_req_nofail(&vicopt, TRUE);

  // If caller supplied a service principal string, use it for verification.
  if(service){
    kerror = krb5_parse_name(ptr->ctx, service, &server_princ);

    if(kerror)
      rb_raise(cKrb5Exception, "krb5_parse_name(service): %s", error_message(kerror));
  }

  kerror = krb5_verify_init_creds(ptr->ctx, &ptr->creds, server_princ, NULL, NULL, &vicopt);

  if(kerror){
    if(server_princ)
      krb5_free_principal(ptr->ctx, server_princ);
    rb_raise(cKrb5Exception, "krb5_verify_init_creds: %s", error_message(kerror));
  }

  if(server_princ)
    krb5_free_principal(ptr->ctx, server_princ);

  return Qtrue;
}

#change_password(v_old, v_new) ⇒ Object

# File 'ext/rkerberos/rkerberos.c', line 365

static VALUE rkrb5_change_password(VALUE self, VALUE v_old, VALUE v_new){

  RUBY_KRB5* ptr;
  krb5_data result_string;
  krb5_data pw_result_string;
  krb5_error_code kerror;
  char *old_passwd;
  char *new_passwd;

  int pw_result;

  Check_Type(v_old, T_STRING);
  Check_Type(v_new, T_STRING);

  old_passwd = StringValueCStr(v_old);
  new_passwd = StringValueCStr(v_new);

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  if(!ptr->princ)
    rb_raise(cKrb5Exception, "no principal has been established");

  memset(&result_string, 0, sizeof(result_string));
  memset(&pw_result_string, 0, sizeof(pw_result_string));

  krb5_free_cred_contents(ptr->ctx, &ptr->creds);
  memset(&ptr->creds, 0, sizeof(ptr->creds));

  kerror = krb5_get_init_creds_password(
    ptr->ctx,
    &ptr->creds,
    ptr->princ,
    old_passwd,
    NULL,
    NULL,
    0,
    "kadmin/changepw",
    NULL
  );

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_get_init_creds_password: %s", error_message(kerror));

  kerror = krb5_change_password(
    ptr->ctx,
    &ptr->creds,
    new_passwd,
    &pw_result,
    &pw_result_string,
    &result_string
  );

  if(kerror){
    krb5_free_data_contents(ptr->ctx, &result_string);
    krb5_free_data_contents(ptr->ctx, &pw_result_string);
    rb_raise(cKrb5Exception, "krb5_change_password: %s", error_message(kerror));
  }

  if(pw_result){
    VALUE v_msg = (result_string.length > 0)
      ? rb_str_new(result_string.data, result_string.length)
      : rb_str_new_cstr("password change rejected");
    krb5_free_data_contents(ptr->ctx, &result_string);
    krb5_free_data_contents(ptr->ctx, &pw_result_string);
    rb_raise(cKrb5Exception, "krb5_change_password: %s", StringValueCStr(v_msg));
  }

  krb5_free_data_contents(ptr->ctx, &result_string);
  krb5_free_data_contents(ptr->ctx, &pw_result_string);

  return Qtrue;
}

#close ⇒ Object

# File 'ext/rkerberos/rkerberos.c', line 664

static VALUE rkrb5_close(VALUE self){
  RUBY_KRB5* ptr;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(ptr->keytab){
    krb5_kt_close(ptr->ctx, ptr->keytab);
    ptr->keytab = NULL;
  }

  if(ptr->ctx)
    krb5_free_cred_contents(ptr->ctx, &ptr->creds);

  if(ptr->princ)
    krb5_free_principal(ptr->ctx, ptr->princ);

  if(ptr->ctx && ptr->rb_context == Qnil)
    krb5_free_context(ptr->ctx);
  else if(ptr->rb_context != Qnil)
    rkrb5_context_release(ptr->rb_context);

  ptr->ctx = NULL;
  ptr->princ = NULL;
  ptr->rb_context = Qnil;

  return Qtrue;
}

#expand_hostname(v_host) ⇒ Object

# File 'ext/rkerberos/rkerberos.c', line 957

static VALUE rkrb5_expand_hostname(VALUE self, VALUE v_host){
  RUBY_KRB5* ptr;
  char* canonical;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  Check_Type(v_host, T_STRING);

  kerror = krb5_expand_hostname(ptr->ctx, StringValueCStr(v_host), &canonical);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_expand_hostname: %s", error_message(kerror));

  VALUE v_result = rb_str_new2(canonical);
  krb5_free_string(ptr->ctx, canonical);

  return v_result;
}

#get_default_principal ⇒ Object Also known as: default_principal

# File 'ext/rkerberos/rkerberos.c', line 701

static VALUE rkrb5_get_default_principal(VALUE self){
  char* princ_name;
  RUBY_KRB5* ptr;
  krb5_ccache ccache;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  // Free previous principal to avoid leaks on repeated calls.
  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  // Get the default credentials cache
  kerror = krb5_cc_default(ptr->ctx, &ccache);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_cc_default: %s", error_message(kerror));

  kerror = krb5_cc_get_principal(ptr->ctx, ccache, &ptr->princ);

  if(kerror){
    krb5_cc_close(ptr->ctx, ccache);
    rb_raise(cKrb5Exception, "krb5_cc_get_principal: %s", error_message(kerror));
  }

  krb5_cc_close(ptr->ctx, ccache);

  kerror = krb5_unparse_name(ptr->ctx, ptr->princ, &princ_name);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_unparse_name: %s", error_message(kerror));

  VALUE v_name = rb_str_new2(princ_name);
  krb5_free_unparsed_name(ptr->ctx, princ_name);

  return v_name;
}

#get_default_realm ⇒ Object Also known as: default_realm

# File 'ext/rkerberos/rkerberos.c', line 127

static VALUE rkrb5_get_default_realm(VALUE self){
  RUBY_KRB5* ptr;
  char* realm;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  kerror = krb5_get_default_realm(ptr->ctx, &realm);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_get_default_realm: %s", error_message(kerror));

  VALUE v_realm = rb_str_new2(realm);
  krb5_free_default_realm(ptr->ctx, realm);

  return v_realm;
}

#get_host_realm(v_host) ⇒ Object Also known as: host_realm

# File 'ext/rkerberos/rkerberos.c', line 922

static VALUE rkrb5_get_host_realm(VALUE self, VALUE v_host){
  RUBY_KRB5* ptr;
  char** realms;
  char** p;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  Check_Type(v_host, T_STRING);

  kerror = krb5_get_host_realm(ptr->ctx, StringValueCStr(v_host), &realms);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_get_host_realm: %s", error_message(kerror));

  VALUE v_array = rb_ary_new();

  for(p = realms; p && *p; p++)
    rb_ary_push(v_array, rb_str_new2(*p));

  krb5_free_host_realm(ptr->ctx, realms);

  return v_array;
}

#get_init_creds_keytab(*args) ⇒ Object Also known as: init_creds_keytab

# File 'ext/rkerberos/rkerberos.c', line 197

static VALUE rkrb5_get_init_creds_keytab(int argc, VALUE* argv, VALUE self){
  RUBY_KRB5* ptr;
  VALUE v_user = Qnil, v_keytab_name = Qnil, v_service = Qnil, v_ccache = Qnil;
  VALUE v_kwargs = Qnil;
  ID kw_table[4] = { rb_intern("principal"), rb_intern("keytab"), rb_intern("service"), rb_intern("ccache") };
  VALUE kw_vals[4];
  char* user;
  char* service;
  char keytab_name[MAX_KEYTAB_NAME_LEN];

  krb5_error_code kerror;
  krb5_get_init_creds_opt* opt;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  // Free resources from a previous call to avoid leaks on repeated use.
  if(ptr->keytab){
    krb5_kt_close(ptr->ctx, ptr->keytab);
    ptr->keytab = NULL;
  }

  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  krb5_free_cred_contents(ptr->ctx, &ptr->creds);
  memset(&ptr->creds, 0, sizeof(ptr->creds));

  rb_scan_args(argc, argv, "0:", &v_kwargs);

  if(NIL_P(v_kwargs))
    v_kwargs = rb_hash_new();

  rb_get_kwargs(v_kwargs, kw_table, 0, 4, kw_vals);
  if(kw_vals[0] != Qundef) v_user = kw_vals[0];
  if(kw_vals[1] != Qundef) v_keytab_name = kw_vals[1];
  if(kw_vals[2] != Qundef) v_service = kw_vals[2];
  if(kw_vals[3] != Qundef) v_ccache = kw_vals[3];

  // Validate argument types before allocating opt, so type errors don't leak it.
  if(!NIL_P(v_user))
    Check_Type(v_user, T_STRING);

  if(!NIL_P(v_keytab_name))
    Check_Type(v_keytab_name, T_STRING);

  if(!NIL_P(v_service))
    Check_Type(v_service, T_STRING);

  kerror = krb5_get_init_creds_opt_alloc(ptr->ctx, &opt);
  if(kerror)
    rb_raise(cKrb5Exception, "krb5_get_init_creds_opt_alloc: %s", error_message(kerror));

  // We need the service information for later.
  if(NIL_P(v_service)){
    service = NULL;
  }
  else{
    service = StringValueCStr(v_service);
  }

  // Convert the name (or service name) to a kerberos principal.
  if(NIL_P(v_user)){
    kerror = krb5_sname_to_principal(
      ptr->ctx,
      NULL,
      service,
      KRB5_NT_SRV_HST,
      &ptr->princ
    );

    if(kerror) {
      krb5_get_init_creds_opt_free(ptr->ctx, opt);
      rb_raise(cKrb5Exception, "krb5_sname_to_principal: %s", error_message(kerror));
    }
  }
  else{
    user = StringValueCStr(v_user);

    kerror = krb5_parse_name(ptr->ctx, user, &ptr->princ);

    if(kerror) {
      krb5_get_init_creds_opt_free(ptr->ctx, opt);
      rb_raise(cKrb5Exception, "krb5_parse_name: %s", error_message(kerror));
    }
  }

  // Use the default keytab if none is specified.
  if(NIL_P(v_keytab_name)){
    kerror = krb5_kt_default_name(ptr->ctx, keytab_name, MAX_KEYTAB_NAME_LEN);

    if(kerror) {
      krb5_get_init_creds_opt_free(ptr->ctx, opt);
      rb_raise(cKrb5Exception, "krb5_kt_default_name: %s", error_message(kerror));
    }
  }
  else{
    strncpy(keytab_name, StringValueCStr(v_keytab_name), MAX_KEYTAB_NAME_LEN - 1);
    keytab_name[MAX_KEYTAB_NAME_LEN - 1] = '\0';
  }

  kerror = krb5_kt_resolve(
    ptr->ctx,
    keytab_name,
    &ptr->keytab
  );

  if(kerror) {
    krb5_get_init_creds_opt_free(ptr->ctx, opt);
    rb_raise(cKrb5Exception, "krb5_kt_resolve: %s", error_message(kerror));
  }

  // Set the credential cache from the supplied Kerberos::Krb5::CredentialsCache
  if(!NIL_P(v_ccache)){
    RUBY_KRB5_CCACHE* ccptr;
    TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, ccptr);

    if(!ccptr->ctx || !ccptr->ccache){
      krb5_get_init_creds_opt_free(ptr->ctx, opt);
      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");
    }

    kerror = krb5_get_init_creds_opt_set_out_ccache(ptr->ctx, opt, ccptr->ccache);
    if(kerror) {
      krb5_get_init_creds_opt_free(ptr->ctx, opt);
      rb_raise(cKrb5Exception, "krb5_get_init_creds_opt_set_out_ccache: %s", error_message(kerror));
    }
  }

  kerror = krb5_get_init_creds_keytab(
    ptr->ctx,
    &ptr->creds,
    ptr->princ,
    ptr->keytab,
    0,
    service,
    opt
  );

  if(kerror) {
    krb5_get_init_creds_opt_free(ptr->ctx, opt);
    rb_raise(cKrb5Exception, "krb5_get_init_creds_keytab: %s", error_message(kerror));
  }

  krb5_get_init_creds_opt_free(ptr->ctx, opt);

  return self;
}

#get_init_creds_password(*args) ⇒ Object Also known as: init_creds_password

# File 'ext/rkerberos/rkerberos.c', line 452

static VALUE rkrb5_get_init_creds_passwd(int argc, VALUE* argv, VALUE self){
  RUBY_KRB5* ptr;
  VALUE v_user = Qnil, v_pass = Qnil, v_service = Qnil, v_ccache = Qnil;
  VALUE v_kwargs = Qnil;
  ID kw_table[4] = { rb_intern("principal"), rb_intern("password"), rb_intern("service"), rb_intern("ccache") };
  VALUE kw_vals[4];
  char* user;
  char* pass;
  char* service;
  krb5_error_code kerror;
  krb5_get_init_creds_opt* opt = NULL;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  // Free resources from a previous call to avoid leaks on repeated use.
  if(ptr->princ){
    krb5_free_principal(ptr->ctx, ptr->princ);
    ptr->princ = NULL;
  }

  krb5_free_cred_contents(ptr->ctx, &ptr->creds);
  memset(&ptr->creds, 0, sizeof(ptr->creds));

  rb_scan_args(argc, argv, "0:", &v_kwargs);

  if(NIL_P(v_kwargs))
    v_kwargs = rb_hash_new();

  rb_get_kwargs(v_kwargs, kw_table, 0, 4, kw_vals);
  if(kw_vals[0] != Qundef) v_user = kw_vals[0];
  if(kw_vals[1] != Qundef) v_pass = kw_vals[1];
  if(kw_vals[2] != Qundef) v_service = kw_vals[2];
  if(kw_vals[3] != Qundef) v_ccache = kw_vals[3];

  if(NIL_P(v_user) || NIL_P(v_pass))
    rb_raise(rb_eArgError, "principal and password are required");

  Check_Type(v_user, T_STRING);
  Check_Type(v_pass, T_STRING);
  user = StringValueCStr(v_user);
  pass = StringValueCStr(v_pass);

  if(NIL_P(v_service)){
    service = NULL;
  }
  else{
    Check_Type(v_service, T_STRING);
    service = StringValueCStr(v_service);
  }

  kerror = krb5_parse_name(ptr->ctx, user, &ptr->princ);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_parse_name: %s", error_message(kerror));

  if(!NIL_P(v_ccache)){
    RUBY_KRB5_CCACHE* ccptr;
    TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, ccptr);

    if(!ccptr->ctx || !ccptr->ccache)
      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");

    kerror = krb5_get_init_creds_opt_alloc(ptr->ctx, &opt);
    if(kerror)
      rb_raise(cKrb5Exception, "krb5_get_init_creds_opt_alloc: %s", error_message(kerror));

    kerror = krb5_get_init_creds_opt_set_out_ccache(ptr->ctx, opt, ccptr->ccache);
    if(kerror){
      krb5_get_init_creds_opt_free(ptr->ctx, opt);
      rb_raise(cKrb5Exception, "krb5_get_init_creds_opt_set_out_ccache: %s", error_message(kerror));
    }
  }

  kerror = krb5_get_init_creds_password(
    ptr->ctx,
    &ptr->creds,
    ptr->princ,
    pass,
    0,
    NULL,
    0,
    service,
    opt
  );

  if(opt)
    krb5_get_init_creds_opt_free(ptr->ctx, opt);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_get_init_creds_password: %s", error_message(kerror));

  return Qtrue;
}

#get_permitted_enctypes ⇒ Object Also known as: permitted_enctypes

# File 'ext/rkerberos/rkerberos.c', line 766

static VALUE rkrb5_get_permitted_enctypes(VALUE self){
  RUBY_KRB5* ptr;
  VALUE v_enctypes;
  krb5_enctype* ktypes;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  kerror = krb5_get_permitted_enctypes(ptr->ctx, &ktypes);

  if(kerror){
    rb_raise(cKrb5Exception, "krb5_get_permitted_types: %s", error_message(kerror));
  }
  else{
    int i;
    char encoding[128];
    v_enctypes = rb_hash_new();

    for(i = 0; ktypes[i]; i++){
      krb5_error_code enc_err = krb5_enctype_to_string(ktypes[i], encoding, 128);
      if(enc_err){
        krb5_free_enctypes(ptr->ctx, ktypes);
        rb_raise(cKrb5Exception, "krb5_enctype_to_string: %s", error_message(enc_err));
      }
      rb_hash_aset(v_enctypes, INT2FIX(ktypes[i]), rb_str_new2(encoding));
    }

    krb5_free_enctypes(ptr->ctx, ktypes);
  }

  return v_enctypes;
}

#set_default_realm(*args) ⇒ Object Also known as: default_realm=

# File 'ext/rkerberos/rkerberos.c', line 155

static VALUE rkrb5_set_default_realm(int argc, VALUE* argv, VALUE self){
  RUBY_KRB5* ptr;
  VALUE v_realm;
  char* realm;
  krb5_error_code kerror;

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  rb_scan_args(argc, argv, "01", &v_realm);

  if(NIL_P(v_realm)){
    realm = NULL;
  }
  else{
    Check_Type(v_realm, T_STRING);
    realm = StringValueCStr(v_realm);
  }

  kerror = krb5_set_default_realm(ptr->ctx, realm);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_set_default_realm: %s", error_message(kerror));

  return self;
}

#verify_init_creds(*args) ⇒ Object

# File 'ext/rkerberos/rkerberos.c', line 812

static VALUE rkrb5_verify_init_creds(int argc, VALUE* argv, VALUE self){
  RUBY_KRB5* ptr;
  VALUE v_server = Qnil, v_keytab = Qnil, v_ccache = Qnil;
  VALUE v_kwargs = Qnil;
  ID kw_table[3] = { rb_intern("server"), rb_intern("keytab"), rb_intern("ccache") };
  VALUE kw_vals[3];
  krb5_error_code kerror;
  krb5_principal server_princ = NULL;
  RUBY_KRB5_KEYTAB* ktptr = NULL;
  RUBY_KRB5_CCACHE* ccptr = NULL;
  krb5_keytab keytab = NULL;
  krb5_ccache *ccache_ptr = NULL;

  rb_scan_args(argc, argv, "0:", &v_kwargs);

  if(NIL_P(v_kwargs))
    v_kwargs = rb_hash_new();

  rb_get_kwargs(v_kwargs, kw_table, 0, 3, kw_vals);
  if(kw_vals[0] != Qundef) v_server = kw_vals[0];
  if(kw_vals[1] != Qundef) v_keytab = kw_vals[1];
  if(kw_vals[2] != Qundef) v_ccache = kw_vals[2];

  TypedData_Get_Struct(self, RUBY_KRB5, &rkrb5_data_type, ptr);

  if(!ptr->ctx)
    rb_raise(cKrb5Exception, "no context has been established");

  // Validate argument types first so callers get TypeError before other errors
  if(!NIL_P(v_server)){
    Check_Type(v_server, T_STRING);
  }

  if(!NIL_P(v_keytab)){
    // Will raise TypeError if object isn't the expected Keytab typed data
    TypedData_Get_Struct(v_keytab, RUBY_KRB5_KEYTAB, &rkrb5_keytab_data_type, ktptr);

    if(!ktptr->ctx || !ktptr->keytab)
      rb_raise(cKrb5Exception, "keytab is closed");

    keytab = ktptr->keytab;
  }

  if(!NIL_P(v_ccache)){
    // Will raise TypeError if object isn't the expected CCache typed data
    TypedData_Get_Struct(v_ccache, RUBY_KRB5_CCACHE, &rkrb5_ccache_data_type, ccptr);

    if(!ccptr->ctx || !ccptr->ccache)
      rb_raise(cKrb5Exception, "credentials cache is closed or destroyed");

    ccache_ptr = &ccptr->ccache;
  }

  // Ensure we have credentials to verify (check after validating args)
  if(ptr->creds.client == NULL)
    rb_raise(cKrb5Exception, "no credentials have been acquired");

  /* A resolved FILE cache may not exist on disk yet. Create it before
     krb5_verify_init_creds attempts to store any credentials it fetches. */
  if(ccache_ptr && *ccache_ptr){
    krb5_principal cache_princ = NULL;

    kerror = krb5_cc_get_principal(ptr->ctx, *ccache_ptr, &cache_princ);

    if(kerror == KRB5_CC_NOTFOUND || kerror == KRB5_FCC_NOFILE)
      kerror = krb5_cc_initialize(ptr->ctx, *ccache_ptr, ptr->creds.client);
    else if(!kerror)
      krb5_free_principal(ptr->ctx, cache_princ);

    if(kerror)
      rb_raise(cKrb5Exception, "credentials cache setup: %s", error_message(kerror));
  }

  // Optional server principal (parse after context & arg validation)
  if(!NIL_P(v_server)){
    kerror = krb5_parse_name(ptr->ctx, StringValueCStr(v_server), &server_princ);
    if(kerror)
      rb_raise(cKrb5Exception, "krb5_parse_name: %s", error_message(kerror));
  }

  kerror = krb5_verify_init_creds(ptr->ctx, &ptr->creds, server_princ, keytab, ccache_ptr, NULL);

  if(server_princ)
    krb5_free_principal(ptr->ctx, server_princ);

  if(kerror)
    rb_raise(cKrb5Exception, "krb5_verify_init_creds: %s", error_message(kerror));

  /* Include the initial credential in addition to any credentials fetched
     and stored by krb5_verify_init_creds. */
  if(ccache_ptr && *ccache_ptr){
    krb5_error_code k2;

    k2 = krb5_cc_store_cred(ptr->ctx, *ccache_ptr, &ptr->creds);

    if(k2)
      rb_raise(cKrb5Exception, "krb5_cc_store_cred: %s", error_message(k2));
  }

  return Qtrue;
}