---
name: "krb5_auth_con_removeflags"
section: "3"
platform: "linux"
package: "heimdal-dev"
version: "7.8.git20221117.28daf24+dfsg-9+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/krb5_auth_con_removeflags"
---

# krb5\_auth\_con\_removeflags(3)

manage authentication on connection level

## NAME

**krb5\_auth\_con\_addflags**, **krb5\_auth\_con\_free**, **krb5\_auth\_con\_genaddrs**, **krb5\_auth\_con\_generatelocalsubkey**, **krb5\_auth\_con\_getaddrs**, **krb5\_auth\_con\_getauthenticator**, **krb5\_auth\_con\_getflags**, **krb5\_auth\_con\_getkey**, **krb5\_auth\_con\_getlocalsubkey**, **krb5\_auth\_con\_getrcache**, **krb5\_auth\_con\_getremotesubkey**, **krb5\_auth\_con\_getuserkey**, **krb5\_auth\_con\_init**, **krb5\_auth\_con\_initivector**, **krb5\_auth\_con\_removeflags**, **krb5\_auth\_con\_setaddrs**, **krb5\_auth\_con\_setaddrs\_from\_fd**, **krb5\_auth\_con\_setflags**, **krb5\_auth\_con\_setivector**, **krb5\_auth\_con\_setkey**, **krb5\_auth\_con\_setlocalsubkey**, **krb5\_auth\_con\_setrcache**, **krb5\_auth\_con\_setremotesubkey**, **krb5\_auth\_con\_setuserkey**, **krb5\_auth\_context**, **krb5\_auth\_getcksumtype**, **krb5\_auth\_getkeytype**, **krb5\_auth\_getlocalseqnumber**, **krb5\_auth\_getremoteseqnumber**, **krb5\_auth\_setcksumtype**, **krb5\_auth\_setkeytype**, **krb5\_auth\_setlocalseqnumber**, **krb5\_auth\_setremoteseqnumber**, **krb5\_free\_authenticator** – manage authentication on connection level

## LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

## SYNOPSIS

**#include \<krb5.h\>**

*krb5\_error\_code*\

**krb5\_auth\_con\_init**(*krb5\_context context*, *krb5\_auth\_context \*auth\_context*);

*void*\

**krb5\_auth\_con\_free**(*krb5\_context context*, *krb5\_auth\_context auth\_context*);

*krb5\_error\_code*\

**krb5\_auth\_con\_setflags**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *int32\_t flags*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getflags**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *int32\_t \*flags*);

*krb5\_error\_code*\

**krb5\_auth\_con\_addflags**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *int32\_t addflags*, *int32\_t \*flags*);

*krb5\_error\_code*\

**krb5\_auth\_con\_removeflags**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *int32\_t removelags*, *int32\_t \*flags*);

*krb5\_error\_code*\

**krb5\_auth\_con\_setaddrs**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_address \*local\_addr*, *krb5\_address \*remote\_addr*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getaddrs**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_address \*\*local\_addr*, *krb5\_address \*\*remote\_addr*);

*krb5\_error\_code*\

**krb5\_auth\_con\_genaddrs**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *int fd*, *int flags*);

*krb5\_error\_code*\

**krb5\_auth\_con\_setaddrs\_from\_fd**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *void \*p\_fd*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getkey**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_keyblock \*\*keyblock*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getlocalsubkey**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_keyblock \*\*keyblock*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getremotesubkey**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_keyblock \*\*keyblock*);

*krb5\_error\_code*\

**krb5\_auth\_con\_generatelocalsubkey**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_keyblock*, *\*key"*);

*krb5\_error\_code*\

**krb5\_auth\_con\_initivector**(*krb5\_context context*, *krb5\_auth\_context auth\_context*);

*krb5\_error\_code*\

**krb5\_auth\_con\_setivector**(*krb5\_context context*, *krb5\_auth\_context \*auth\_context*, *krb5\_pointer ivector*);

*void*\

**krb5\_free\_authenticator**(*krb5\_context context*, *krb5\_authenticator \*authenticator*);

## DESCRIPTION

The **krb5\_auth\_context** structure holds all context related to an authenticated connection, in a similar way to **krb5\_context** that holds the context for the thread or process. **krb5\_auth\_context** is used by various functions that are directly related to authentication between the server/client. Example of data that this structure contains are various flags, addresses of client and server, port numbers, keyblocks (and subkeys), sequence numbers, replay cache, and checksum-type.

**krb5\_auth\_con\_init**() allocates and initializes the **krb5\_auth\_context** structure. Default values can be changed with **krb5\_auth\_con\_setcksumtype**() and **krb5\_auth\_con\_setflags**(). The **auth\_context** structure must be freed by **krb5\_auth\_con\_free**().

**krb5\_auth\_con\_getflags**(), **krb5\_auth\_con\_setflags**(), **krb5\_auth\_con\_addflags**() and **krb5\_auth\_con\_removeflags**() gets and modifies the flags for a **krb5\_auth\_context** structure. Possible flags to set are:

- KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE

  Generate and check sequence-number on each packet.

- KRB5\_AUTH\_CONTEXT\_DO\_TIME

  Check timestamp on incoming packets.

- KRB5\_AUTH\_CONTEXT\_RET\_SEQUENCE, KRB5\_AUTH\_CONTEXT\_RET\_TIME

  Return sequence numbers and time stamps in the outdata parameters.

- KRB5\_AUTH\_CONTEXT\_CLEAR\_FORWARDED\_CRED

  will force **krb5\_get\_forwarded\_creds**() and **krb5\_fwd\_tgt\_creds**() to create unencrypted ) KRB5\_ENCTYPE\_NULL) credentials. This is for use with old MIT server and JAVA based servers as they can't handle encrypted KRB-CRED. Note that sending such KRB-CRED is clear exposes crypto keys and tickets and is insecure, make sure the packet is encrypted in the protocol. krb5\_rd\_cred(3), [krb5\_rd\_priv(3)](/krb5_rd_priv/3.md), [krb5\_rd\_safe(3)](/krb5_rd_safe/3.md), [krb5\_mk\_priv(3)](/krb5_mk_priv/3.md) and [krb5\_mk\_safe(3)](/krb5_mk_safe/3.md). Setting this flag requires that parameter to be passed to these functions.

  The flags KRB5\_AUTH\_CONTEXT\_DO\_TIME also modifies the behavior the function **krb5\_get\_forwarded\_creds**() by removing the timestamp in the forward credential message, this have backward compatibility problems since not all versions of the heimdal supports timeless credentional messages. Is very useful since it always the sender of the message to cache forward message and thus avoiding a round trip to the KDC for each time a credential is forwarded. The same functionality can be obtained by using address-less tickets.

**krb5\_auth\_con\_setaddrs**(), **krb5\_auth\_con\_setaddrs\_from\_fd**() and **krb5\_auth\_con\_getaddrs**() gets and sets the addresses that are checked when a packet is received. It is mandatory to set an address for the remote host. If the local address is not set, it iss deduced from the underlaying operating system. **krb5\_auth\_con\_getaddrs**() will call **krb5\_free\_address**() on any address that is passed in *local\_addr* or *remote\_addr*. **krb5\_auth\_con\_setaddr**() allows passing in a NULL pointer as *local\_addr* and *remote\_addr*, in that case it will just not set that address.

**krb5\_auth\_con\_setaddrs\_from\_fd**() fetches the addresses from a file descriptor.

**krb5\_auth\_con\_genaddrs**() fetches the address information from the given file descriptor *fd* depending on the bitmap argument *flags*.

Possible values on *flags* are:

- *KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_ADDR*

  fetches the local address from *fd*.

- *KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_ADDR*

  fetches the remote address from *fd*.

**krb5\_auth\_con\_setkey**(), **krb5\_auth\_con\_setuserkey**() and **krb5\_auth\_con\_getkey**() gets and sets the key used for this auth context. The keyblock returned by **krb5\_auth\_con\_getkey**() should be freed with **krb5\_free\_keyblock**(). The keyblock send into **krb5\_auth\_con\_setkey**() is copied into the **krb5\_auth\_context**, and thus no special handling is needed. NULL is not a valid keyblock to **krb5\_auth\_con\_setkey**().

**krb5\_auth\_con\_setuserkey**() is only useful when doing user to user authentication. **krb5\_auth\_con\_setkey**() is equivalent to **krb5\_auth\_con\_setuserkey**().

**krb5\_auth\_con\_getlocalsubkey**(), **krb5\_auth\_con\_setlocalsubkey**(), **krb5\_auth\_con\_getremotesubkey**() and **krb5\_auth\_con\_setremotesubkey**() gets and sets the keyblock for the local and remote subkey. The keyblock returned by **krb5\_auth\_con\_getlocalsubkey**() and **krb5\_auth\_con\_getremotesubkey**() must be freed with **krb5\_free\_keyblock**().

**krb5\_auth\_setcksumtype**() and **krb5\_auth\_getcksumtype**() sets and gets the checksum type that should be used for this connection.

**krb5\_auth\_con\_generatelocalsubkey**() generates a local subkey that have the same encryption type as *key*.

**krb5\_auth\_getremoteseqnumber**() **krb5\_auth\_setremoteseqnumber**(), **krb5\_auth\_getlocalseqnumber**() and **krb5\_auth\_setlocalseqnumber**() gets and sets the sequence-number for the local and remote sequence-number counter.

**krb5\_auth\_setkeytype**() and **krb5\_auth\_getkeytype**() gets and gets the keytype of the keyblock in **krb5\_auth\_context**.

**krb5\_auth\_con\_getauthenticator**() Retrieves the authenticator that was used during mutual authentication. The authenticator returned should be freed by calling **krb5\_free\_authenticator**().

**krb5\_auth\_con\_getrcache**() and **krb5\_auth\_con\_setrcache**() gets and sets the replay-cache.

**krb5\_auth\_con\_initivector**() allocates memory for and zeros the initial vector in the *auth\_context* keyblock.

**krb5\_auth\_con\_setivector**() sets the i\_vector portion of *auth\_context* to *ivector*.

**krb5\_free\_authenticator**() free the content of *authenticator* and *authenticator* itself.

## SEE ALSO

[krb5\_context(3)](/krb5_context/3.md), [kerberos(8)](/kerberos/8.md)