sigma/gssproxy
1
0
Fork 0
mirror of https://github.com/gssapi/gssproxy.git synced 2026-03-07 02:30:41 +00:00
Code Releases Activity
A proxy for GSSAPI | Docs at https://github.com/gssapi/gssproxy/tree/main/docs
748 commits 1 branch 27 tags 1.5 MiB
Find a file
Exact
yixiangzhike d0a066023b Try to obtain new cred if the cred from rpc.gssd or other apps is defective. 
Rpc.gssd or other applications may use the cache configured with default_ccache_name(krb5. conf). If the cache file of gssproxy (cred_store=ccache: FILE: xxxxxx) is deleted, the gssproxy service returns an empty credential when processing a GSSX_ARG-ACQUIRE_CRED request, unless the user clears the default_ccache_name cache. However, users may not even be aware of the existence of the default_ccache_name cache. In this situation, it may be better for gssproxy to try to obtain new credentials.

Signed-off-by: yixiangzhike <yixiangzhike007@163.com>
2026-02-23 09:36:34 -05:00
.github/workflows Debian sid seem to have chaned to libselinux-dev 2026-01-29 10:05:14 -05:00
contrib Update URLs to project page, fedorahosted.org got retired 2024-03-20 11:32:38 -04:00
docs Add note about libnfsidmap to NFS docs 2024-05-03 12:36:01 -04:00
examples Always install the gss module configuration 2022-05-23 12:05:28 -04:00
external Don't check for libref_array explicitly 2026-01-29 10:23:19 -05:00
man Fix gssproxy.conf manpage about comments 2025-03-26 18:52:14 -04:00
po Intial skeleton gssproxy daemon 2012-01-04 19:19:54 -05:00
rpcgen Change declaration of function map 2025-02-10 21:30:58 -05:00
src Try to obtain new cred if the cred from rpc.gssd or other apps is defective. 2026-02-23 09:36:34 -05:00
systemd Revert "Remove the NoNewPrivileges because it breaks the ability to open socket" 2025-03-06 09:07:46 -05:00
tests Fix various issues detected by static analysis 2024-08-07 12:29:07 -04:00
x-files Official IANA Assigned RPC Program Number 2012-03-30 08:16:41 -04:00
.gitignore Add test for userproxy mode 2022-05-23 18:56:56 -04:00
BUILD.txt Update test and krb5 dependency list in BUILD.txt 2017-08-11 13:46:27 -04:00
build_macros.m4 Intial skeleton gssproxy daemon 2012-01-04 19:19:54 -05:00
conf_macros.m4 Always install the gss module configuration 2022-05-23 12:05:28 -04:00
configure.ac Don't check for libref_array explicitly 2026-01-29 10:23:19 -05:00
COPYING Fix formatting on noncompliant copyright lines 2015-09-04 16:34:42 -04:00
Makefile.am Move runtime management function to gp_mgmt.c 2022-05-26 12:36:13 -04:00
NOTES add note about how to deal with ccache files 2012-04-05 11:20:33 -04:00
README.md Add a few badges rendered on github 2022-06-05 14:40:08 -04:00
STYLE.txt Rename README.style -> STYLE.txt so pagure stops picking it up 2018-05-09 13:14:53 -04:00
version.m4 Version 0.9.2 2023-10-19 12:09:32 -04:00

README.md

Changelog Build Status

This is the gss-proxy project.

Documentation lives in the docs folder of this repository.

The goal is to have a GSS-API proxy, with standardizable protocol and a (somewhat portable) reference client and server implementation. There are several motivations for this some of which are:

  • Kernel-mode GSS-API applications (CIFS, NFS, AFS, ...) need to be able to leave all complexity of GSS_Init/Accept_sec_context() out of the kernel by upcalling to a daemon that does all the dirty work.

  • Isolation and privilege separation for user-mode applications. For example: letting HTTP servers use but not see the keytabe entries for HTTP/* principals for accepting security contexts.

  • Possibly an ssh-agent-like SSH agent for GSS credentials -- a gss-agent.

gss-proxy uses libverto for dealing with event loops. Note that you need to have at least one libverto event library installed (e.g. libverto-tevent).

We have a mailing list and an IRC channel (#gssapi on libera.chat).