GNU Simple Authentication and Security Layer 1.0

Less

Simon Josefsson Datakonsult
Hagagatan 24
113 47 Stockholm
Sweden

E-mail: simon@josefsson.org

     $ wget -q ftp://alpha.gnu.org/pub/gnu/gsasl/gsasl-1.0.tar.gz
     $ tar xfz gsasl-1.0.tar.gz
     $ cd gsasl-1.0/
     $ ./configure
     ...
     $ make
     ...
     $ make install
     ...

     #include <gsasl.h>

     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     ...
       rc = gsasl_init (&ctx);
       if (rc != GSASL_OK)
         {
           printf ("SASL initialization failure (%d): %s\n",
                   rc, gsasl_strerror (rc));
           return 1;
         }
     ...

     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     ...
       setlocale (LC_ALL, "");
     ...
       rc = gsasl_init (&ctx);
       if (rc != GSASL_OK)
         {
           printf (gettext ("SASL initialization failure (%d): %s\n"),
                   rc, gsasl_strerror (rc));
           return 1;
         }
     ...

     #include <gcrypt.h>
     ...
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     ...
       /* Check version of libgcrypt. */
       if (!gcry_check_version (GCRYPT_VERSION))
         die ("version mismatch\n");
     
       /* Allocate a pool of 16k secure memory.  This also drops priviliges
          on some systems. */
       gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
     
       /* Tell Libgcrypt that initialization has completed. */
       gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
     ...
       rc = gsasl_init (&ctx);
       if (rc != GSASL_OK)
         {
           printf ("SASL initialization failure (%d): %s\n",
                   rc, gsasl_strerror (rc));
           return 1;
         }
     ...

       if (!gsasl_check_version (GSASL_VERSION))
         {
           printf ("gsasl_check_version failed:\n"
                   "Header file incompatible with shared library.\n");
           exit(1);
         }

     gcc -c foo.c `pkg-config libgsasl --cflags`

     gcc -o foo foo.o `pkg-config libgsasl --libs`

     gcc -o foo foo.c `pkg-config libgsasl --cflags --libs`

     AC_ARG_ENABLE(gsasl,
     	AC_HELP_STRING([--disable-gsasl], [don't use GNU SASL]),
     	gsasl=$enableval)
     if test "$gsal" != "no" ; then
     	PKG_CHECK_MODULES(GSASL, libgsasl >= 1.0,
     			[gsasl=yes],
                             [gsasl=no])
     	if test "$gsasl" != "yes" ; then
     		sal=no
     		AC_MSG_WARN([Cannot find GNU SASL, disabling])
     	else
     		gsasl=yes
     		AC_DEFINE(USE_GSASL, 1, [Define to 1 if you want GNU SASL.])
     	fi
     fi
     AC_MSG_CHECKING([if GNU SASL should be used])
     AC_MSG_RESULT($gsasl)

     AC_CHECK_HEADER(gsasl.h,
     	AC_CHECK_LIB(gsasl, gsasl_check_version,
     		[gsasl=yes AC_SUBST(GSASL_LIBS, -lgsasl)],
     		gsasl=no),
     	gsasl=no)
     AC_ARG_ENABLE(gsasl,
     	AC_HELP_STRING([--disable-gsasl], [don't use GNU SASL]),
     	gsasl=$enableval)
     if test "$gsasl" != "no" ; then
     	AC_DEFINE(USE_SASL, 1, [Define to 1 if you want GNU SASL.])
     else
     	AC_MSG_WARN([Cannot find GNU SASL, diabling])
     fi
     AC_MSG_CHECKING([if GNU SASL should be used])
     AC_MSG_RESULT($gsasl)

     int main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s",
                   rc, gsasl_strerror (rc));
           return 1;
         }
     
       client (ctx);
     
       gsasl_done (ctx);
     
       return 0;
     }

     void client (Gsasl *ctx)
     {
       Gsasl_session *session;
       const char *mech = "PLAIN";
       int rc;
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n",
                   rc, gsasl_strerror (rc));
           return;
         }
     
       /* Set username and password in session handle.  This info will be
          lost when this session is deallocated below.  */
       gsasl_property_set (session, GSASL_AUTHID, "jas");
       gsasl_property_set (session, GSASL_PASSWORD, "secret");
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }

     void client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the server get to send data
          first. */
     
       do
         {
           printf ("Input base64 encoded data from server:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           if (buf[strlen (buf) - 1] == '\n')
             buf[strlen (buf) - 1] = '\0';
     
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
             {
               printf ("Output:\n%s\n", p);
               free (p);
             }
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n",
                   rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the
          server let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }

     const char *client_mechanism (Gsasl *ctx)
     {
       static char mech[GSASL_MAX_MECHANISM_SIZE + 1] = "";
       char mechlist[BUFSIZ] = "";
       const char *suggestion;
     
       printf ("Enter list of mechanism that server support, separate by SPC:\n");
       fgets (mechlist, sizeof (mechlist) - 1, stdin);
     
       suggestion = gsasl_client_suggest_mechanism (ctx, mechlist);
       if (suggestion)
         printf ("Library suggest use of `%s'.\n", suggestion);
     
       printf ("Enter mechanism to use:\n");
       fgets (mech, sizeof (mech) - 1, stdin);
       mech[strlen (mech) - 1] = '\0';
     
       return mech;
     }

     Enter list of mechanism that server support, separate by SPC:
     CRAM-MD5 DIGEST-MD5 GSSAPI FOO BAR
     Library suggest use of `GSSAPI'.
     Enter mechanism to use:
     CRAM-MD5
     Input base64 encoded data from server:
     Zm5vcmQ=
     Output:
     amFzIDkyY2U1NWE5MTM2ZTY4NzEyMTUyZTFjYmFmNjVkZjgx
     
     If server accepted us, we're done.

       gsasl_property_set (ctx, GSASL_AUTHID, "jas");
       gsasl_property_set (ctx, GSASL_PASSWORD, "secret");

       /* Set the callback handler for the library. */
       gsasl_callback_set (ctx, callback);

     int callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop)
     {
       char buf[BUFSIZ] = "";
       int rc = GSASL_NO_CALLBACK;
     
       /* Get user info from user. */
     
       printf ("Callback invoked, for property %d.\n", prop);
     
       switch (prop)
         {
         case GSASL_PASSCODE:
           printf ("Enter passcode:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           buf[strlen (buf) - 1] = '\0';
     
           gsasl_property_set (sctx, GSASL_PASSCODE, buf);
           rc = GSASL_OK;
           break;
     
         case GSASL_AUTHID:
           printf ("Enter username:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           buf[strlen (buf) - 1] = '\0';
     
           gsasl_property_set (sctx, GSASL_AUTHID, buf);
           rc = GSASL_OK;
           break;
     
         default:
           printf ("Unknown property!  Don't worry.\n");
           break;
         }
     
       return rc;
     }

     /* client.c --- Example SASL client.
      * Copyright (C) 2004, 2005, 2007  Simon Josefsson
      *
      * This file is part of GNU SASL.
      *
      * This program is free software: you can redistribute it and/or modify
      * it under the terms of the GNU General Public License as published by
      * the Free Software Foundation, either version 3 of the License, or
      * (at your option) any later version.
      *
      * This program is distributed in the hope that it will be useful,
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      * GNU General Public License for more details.
      *
      * You should have received a copy of the GNU General Public License
      * along with this program.  If not, see <http://www.gnu.org/licenses/>.
      *
      */
     
     #include <stdarg.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     
     #include <gsasl.h>
     
     static void
     client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the client send data first. */
     
       do
         {
           /* Generate client output. */
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
     	{
     	  /* If sucessful, print it. */
     	  printf ("Output:\n%s\n", p);
     	  free (p);
     	}
     
           if (rc == GSASL_NEEDS_MORE)
     	{
     	  /* If the client need more data from server, get it here. */
     	  printf ("Input base64 encoded data from server:\n");
     	  fgets (buf, sizeof (buf) - 1, stdin);
     	  if (buf[strlen (buf) - 1] == '\n')
     	    buf[strlen (buf) - 1] = '\0';
     	}
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the server
          let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }
     
     static void
     client (Gsasl * ctx)
     {
       Gsasl_session *session;
       const char *mech = "PLAIN";
       int rc;
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* Set username and password in session handle.  This info will be
          lost when this session is deallocated below.  */
       gsasl_property_set (session, GSASL_AUTHID, "jas");
       gsasl_property_set (session, GSASL_PASSWORD, "secret");
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }
     
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       /* Initialize library. */
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
           return 1;
         }
     
       /* Do it. */
       client (ctx);
     
       /* Cleanup. */
       gsasl_done (ctx);
     
       return 0;
     }

     /* client-serverfirst.c --- Example SASL client, where server send data first.
      * Copyright (C) 2004, 2005, 2007  Simon Josefsson
      *
      * This file is part of GNU SASL.
      *
      * This program is free software: you can redistribute it and/or modify
      * it under the terms of the GNU General Public License as published by
      * the Free Software Foundation, either version 3 of the License, or
      * (at your option) any later version.
      *
      * This program is distributed in the hope that it will be useful,
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      * GNU General Public License for more details.
      *
      * You should have received a copy of the GNU General Public License
      * along with this program.  If not, see <http://www.gnu.org/licenses/>.
      *
      */
     
     #include <stdarg.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     
     #include <gsasl.h>
     
     static void
     client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the server get to send data first. */
     
       do
         {
           printf ("Input base64 encoded data from server:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           if (buf[strlen (buf) - 1] == '\n')
     	buf[strlen (buf) - 1] = '\0';
     
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
     	{
     	  printf ("Output:\n%s\n", p);
     	  free (p);
     	}
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the server
          let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }
     
     static void
     client (Gsasl * ctx)
     {
       Gsasl_session *session;
       const char *mech = "CRAM-MD5";
       int rc;
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* Set username and password in session handle.  This info will be
          lost when this session is deallocated below.  */
       gsasl_property_set (session, GSASL_AUTHID, "jas");
       gsasl_property_set (session, GSASL_PASSWORD, "secret");
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }
     
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       /* Initialize library. */
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
           return 1;
         }
     
       /* Do it. */
       client (ctx);
     
       /* Cleanup. */
       gsasl_done (ctx);
     
       return 0;
     }

     /* client-mech.c --- Example SASL client, with a choice of mechanism to use.
      * Copyright (C) 2004, 2005, 2007  Simon Josefsson
      *
      * This file is part of GNU SASL.
      *
      * This program is free software: you can redistribute it and/or modify
      * it under the terms of the GNU General Public License as published by
      * the Free Software Foundation, either version 3 of the License, or
      * (at your option) any later version.
      *
      * This program is distributed in the hope that it will be useful,
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      * GNU General Public License for more details.
      *
      * You should have received a copy of the GNU General Public License
      * along with this program.  If not, see <http://www.gnu.org/licenses/>.
      *
      */
     
     #include <stdarg.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     
     #include <gsasl.h>
     
     static void
     client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the server get to send data first. */
     
       do
         {
           printf ("Input base64 encoded data from server:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           if (buf[strlen (buf) - 1] == '\n')
     	buf[strlen (buf) - 1] = '\0';
     
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
     	{
     	  printf ("Output:\n%s\n", p);
     	  free (p);
     	}
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the server
          let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }
     
     static const char *
     client_mechanism (Gsasl * ctx)
     {
       static char mech[GSASL_MAX_MECHANISM_SIZE + 1] = "";
       char mechlist[BUFSIZ] = "";
       const char *suggestion;
     
       printf ("Enter list of mechanism that server support, separate by SPC:\n");
       fgets (mechlist, sizeof (mechlist) - 1, stdin);
     
       suggestion = gsasl_client_suggest_mechanism (ctx, mechlist);
       if (suggestion)
         printf ("Library suggest use of `%s'.\n", suggestion);
     
       printf ("Enter mechanism to use:\n");
       fgets (mech, sizeof (mech) - 1, stdin);
       mech[strlen (mech) - 1] = '\0';
     
       return mech;
     }
     
     static void
     client (Gsasl * ctx)
     {
       Gsasl_session *session;
       const char *mech;
       int rc;
     
       /* Find out which mechanism to use. */
       mech = client_mechanism (ctx);
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* Set username and password in session handle.  This info will be
          lost when this session is deallocated below.  */
       gsasl_property_set (session, GSASL_AUTHID, "jas");
       gsasl_property_set (session, GSASL_PASSWORD, "secret");
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }
     
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       /* Initialize library. */
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
           return 1;
         }
     
       /* Do it. */
       client (ctx);
     
       /* Cleanup. */
       gsasl_done (ctx);
     
       return 0;
     }

     /* client-callback.c --- Example SASL client, with callback for user info.
      * Copyright (C) 2004, 2005, 2007  Simon Josefsson
      *
      * This file is part of GNU SASL.
      *
      * This program is free software: you can redistribute it and/or modify
      * it under the terms of the GNU General Public License as published by
      * the Free Software Foundation, either version 3 of the License, or
      * (at your option) any later version.
      *
      * This program is distributed in the hope that it will be useful,
      * but WITHOUT ANY WARRANTY; without even the implied warranty of
      * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      * GNU General Public License for more details.
      *
      * You should have received a copy of the GNU General Public License
      * along with this program.  If not, see <http://www.gnu.org/licenses/>.
      *
      */
     
     #include <stdarg.h>
     #include <stdio.h>
     #include <stdlib.h>
     #include <string.h>
     
     #include <gsasl.h>
     
     static void
     client_authenticate (Gsasl * ctx, Gsasl_session * session)
     {
       char buf[BUFSIZ] = "";
       char *p;
       int rc;
     
       /* This loop mimic a protocol where the server get to send data first. */
     
       do
         {
           printf ("Input base64 encoded data from server:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           if (buf[strlen (buf) - 1] == '\n')
     	buf[strlen (buf) - 1] = '\0';
     
           rc = gsasl_step64 (session, buf, &p);
     
           if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK)
     	{
     	  printf ("Output:\n%s\n", p);
     	  free (p);
     	}
         }
       while (rc == GSASL_NEEDS_MORE);
     
       printf ("\n");
     
       if (rc != GSASL_OK)
         {
           printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* The client is done.  Here you would typically check if the server
          let the client in.  If not, you could try again. */
     
       printf ("If server accepted us, we're done.\n");
     }
     
     static void
     client (Gsasl * ctx)
     {
       Gsasl_session *session;
       const char *mech = "SECURID";
       int rc;
     
       /* Create new authentication session. */
       if ((rc = gsasl_client_start (ctx, mech, &session)) != GSASL_OK)
         {
           printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc));
           return;
         }
     
       /* Do it. */
       client_authenticate (ctx, session);
     
       /* Cleanup. */
       gsasl_finish (session);
     }
     
     static int
     callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop)
     {
       char buf[BUFSIZ] = "";
       int rc = GSASL_NO_CALLBACK;
     
       /* Get user info from user. */
     
       printf ("Callback invoked, for property %d.\n", prop);
     
       switch (prop)
         {
         case GSASL_PASSCODE:
           printf ("Enter passcode:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           buf[strlen (buf) - 1] = '\0';
     
           gsasl_property_set (sctx, GSASL_PASSCODE, buf);
           rc = GSASL_OK;
           break;
     
         case GSASL_AUTHID:
           printf ("Enter username:\n");
           fgets (buf, sizeof (buf) - 1, stdin);
           buf[strlen (buf) - 1] = '\0';
     
           gsasl_property_set (sctx, GSASL_AUTHID, buf);
           rc = GSASL_OK;
           break;
     
         default:
           printf ("Unknown property!  Don't worry.\n");
           break;
         }
     
       return rc;
     }
     
     int
     main (int argc, char *argv[])
     {
       Gsasl *ctx = NULL;
       int rc;
     
       /* Initialize library. */
       if ((rc = gsasl_init (&ctx)) != GSASL_OK)
         {
           printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc));
           return 1;
         }
     
       /* Set the callback handler for the library. */
       gsasl_callback_set (ctx, callback);
     
       /* Do it. */
       client (ctx);
     
       /* Cleanup. */
       gsasl_done (ctx);
     
       return 0;
     }

  -c, --client               Act as client (the default).
      --client-mechanisms    Write name of supported client mechanisms
                             separated by space to stdout.
  -s, --server               Act as server.
      --server-mechanisms    Write name of supported server mechanisms
                             separated by space to stdout.

      --connect=HOSTNAME[:SERVICE]
                             Connect to TCP server and negotiate on stream
                             instead of stdin/stdout. SERVICE is the protocol
                             service, or an integer denoting the port, and
                             defaults to 143 (imap) if not specified. Also sets
                             the --hostname default.

  -d, --application-data     After authentication, read data from stdin and run
                             it through the mechanism's security layer and
                             print it base64 encoded to stdout. The default is
                             to terminate after authentication.
      --imap                 Use a IMAP-like logon procedure (client only).
                             Also sets the --service default to "imap".
  -m, --mechanism=STRING     Mechanism to use.
      --no-client-first      Disallow client to send data first (client only).

  -n, --anonymous-token=STRING    Token for anonymous authentication, usually
                                  mail address (ANONYMOUS only).
  -a, --authentication-id=STRING  Identity of credential owner.
  -z, --authorization-id=STRING   Identity to request service for.
      --disable-cleartext-validate
                             Disable cleartext validate hook, forcing server to
                             prompt for password.
      --enable-cram-md5-validate  Validate CRAM-MD5 challenge and response
                                  interactively.
      --hostname=STRING      Set the name of the server with the requested
                             service.
  -p, --password=STRING      Password for authentication (insecure for
                             non-testing purposes).
      --passcode=NUMBER      Passcode for authentication (SECURID only).
      --quality-of-protection=<auth | auth-int | auth-conf>
                             How application payload will be protected.  "auth"
                             means no protection, "auth-int" means integrity
                             protection, "auth-conf" means integrity and
                             confidentialiy protection.  Currently only used by
                             DIGEST-MD5, where the default is "auth-conf".
  -r, --realm=STRING         Realm. Defaults to hostname.
      --service=STRING       Set the requested service name (should be a
                             registered GSSAPI host based service name).
      --service-name=STRING  Set the generic server name in case of a
                             replicated server (DIGEST-MD5 only).
  -x, --maxbuf=NUMBER        Indicate maximum buffer size (DIGEST-MD5 only).

      --starttls                Force use of STARTTLS.  The default is to use
                                  STARTTLS when available.  (default=off)
      --no-starttls             Unconditionally disable STARTTLS.
                                  (default=off)
      --x509-ca-file=FILE       File containing one or more X.509 Certificate
                                  Authorities certificates in PEM format, used
                                  to verify the certificate received from the
                                  server.  If not specified, no verification of
                                  the remote server certificate will be done.
      --x509-cert-file=FILE     File containing client X.509 certificate in PEM
                                  format.  Used together with --x509-key-file
                                  to specify the certificate/key pair.
      --x509-key-file=FILE      Private key for the client X.509 certificate in
                                  PEM format.  Used together with
                                  --x509-key-file to specify the
                                  certificate/key pair.
      --priority                Cipher priority string.

  -q, --quiet, --silent      Don't produce any diagnostic output.
  -v, --verbose              Produce verbose output.

  -?, --help                 Give this help list
      --usage                Give a short usage message
  -V, --version              Print program version

          int
          callback_gssapi (Gsasl_session_ctx *ctx,
          		 char *clientname,
          		 char *authentication_id)
          {
            int rc = GSASL_AUTHENTICATION_ERROR;
          
            krb5_principal p;
            krb5_context kcontext;
          
            krb5_init_context (&kcontext);
          
            if (krb5_parse_name (kcontext, clientname, &p) != 0)
              return -1;
            if (krb5_kuserok (kcontext, p, authentication_id))
              rc = GSASL_OK;
            krb5_free_principal (kcontext, p);
          
            return rc;
          }

     Copyright © 2000, 2001, 2002, 2007, 2008 Free Software Foundation, Inc.
     http://fsf.org/
     
     Everyone is permitted to copy and distribute verbatim copies
     of this license document, but changing it is not allowed.

       Copyright (C)  year  your name.
       Permission is granted to copy, distribute and/or modify this document
       under the terms of the GNU Free Documentation License, Version 1.3
       or any later version published by the Free Software Foundation;
       with no Invariant Sections, no Front-Cover Texts, and no Back-Cover
       Texts.  A copy of the license is included in the section entitled ``GNU
       Free Documentation License''.

         with the Invariant Sections being list their titles, with
         the Front-Cover Texts being list, and with the Back-Cover Texts
         being list.

     Copyright © 1991, 1999 Free Software Foundation, Inc.
     51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
     
     Everyone is permitted to copy and distribute verbatim copies
     of this license document, but changing it is not allowed.
     
     [This is the first released version of the Lesser GPL.  It also counts
     as the successor of the GNU Library Public License, version 2, hence the
     version number 2.1.]

     one line to give the library's name and an idea of what it does.
     Copyright (C) year  name of author
     
     This library is free software; you can redistribute it and/or modify it
     under the terms of the GNU Lesser General Public License as published by
     the Free Software Foundation; either version 2.1 of the License, or (at
     your option) any later version.
     
     This library is distributed in the hope that it will be useful, but
     WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Lesser General Public License for more details.
     
     You should have received a copy of the GNU Lesser General Public
     License along with this library; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
     USA.

     Yoyodyne, Inc., hereby disclaims all copyright interest in the library
     `Frob' (a library for tweaking knobs) written by James Random Hacker.
     
     signature of Ty Coon, 1 April 1990
     Ty Coon, President of Vice

     Copyright © 2007 Free Software Foundation, Inc. http://fsf.org/
     
     Everyone is permitted to copy and distribute verbatim copies of this
     license document, but changing it is not allowed.

     one line to give the program's name and a brief idea of what it does.
     Copyright (C) year name of author
     
     This program is free software: you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
     the Free Software Foundation, either version 3 of the License, or (at
     your option) any later version.
     
     This program is distributed in the hope that it will be useful, but
     WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     General Public License for more details.
     
     You should have received a copy of the GNU General Public License
     along with this program.  If not, see http://www.gnu.org/licenses/.

     program Copyright (C) year name of author
     This program comes with ABSOLUTELY NO WARRANTY; for details type ‘show w’.
     This is free software, and you are welcome to redistribute it
     under certain conditions; type ‘show c’ for details.

GNU Simple Authentication and Security Layer 1.0

Table of Contents

GNU Simple Authentication and Security Layer

1 Introduction

1.1 Getting Started

1.2 Features

1.3 SASL Overview

1.4 Requirements

1.5 Supported Platforms

1.6 Getting help

1.7 Commercial Support

1.8 Downloading and Installing

1.8.1 Installing under Windows

1.9 Bug Reports

1.10 Contributing

2 Preparation

2.1 Header

2.2 Initialization

2.3 Version Check

gsasl_check_version

2.4 Building the source

2.5 Autoconf tests

2.5.1 Autoconf test via ‘pkg-config’

2.5.2 Standalone Autoconf test using Libtool

3 Using the Library

3.1 Choosing a mechanism

3.2 Using a callback

4 Properties

5 Mechanisms

5.1 The EXTERNAL mechanism

5.2 The ANONYMOUS mechanism

5.3 The PLAIN mechanism

5.4 The LOGIN mechanism

5.5 The CRAM-MD5 mechanism

5.6 The DIGEST-MD5 mechanism

5.7 The NTLM mechanism

5.8 The SECURID mechanism

5.9 The GSSAPI mechanism

5.10 The KERBEROS_V5 mechanism

6 Global Functions

gsasl_init

gsasl_done

gsasl_client_mechlist

gsasl_server_mechlist

gsasl_client_support_p

gsasl_server_support_p

gsasl_client_suggest_mechanism

gsasl_register

7 Callback Functions

gsasl_callback_set

gsasl_callback

gsasl_callback_hook_set

gsasl_callback_hook_get

gsasl_session_hook_set

gsasl_session_hook_get

8 Property Functions

gsasl_property_set

gsasl_property_set_raw

gsasl_property_fast

gsasl_property_get

9 Session Functions

gsasl_client_start

gsasl_server_start

gsasl_step

gsasl_step64

gsasl_finish

gsasl_encode

gsasl_decode

gsasl_mechanism_name

10 Utilities

gsasl_saslprep

gsasl_base64_to

gsasl_base64_from

gsasl_simple_getpass

gsasl_nonce

gsasl_random

gsasl_md5

gsasl_hmac_md5

11 Memory Handling

gsasl_free

2.5.1 Autoconf test via ‘`pkg-config`’