---
name: "krb5_auth_getauthenticator"
section: "3"
platform: "linux"
package: "heimdal-dev"
version: "0.6.3-10sarge2"
release: "Debian 3.1 (Sarge)"
platforms: ["linux"]
url: "https://new.carta.tech/krb5_auth_context"
---

# krb5\_auth\_getauthenticator(3)

manage authentication on connection level

Part of [krb5\_auth\_context(3)](/krb5_auth_context/3.md).

## NAME

**krb5\_auth\_context**, **krb5\_auth\_con\_init**, **krb5\_auth\_con\_free**, **krb5\_auth\_con\_setflags**, **krb5\_auth\_con\_getflags**, **krb5\_auth\_con\_setaddrs**, **krb5\_auth\_con\_setaddrs\_from\_fd**, **krb5\_auth\_con\_getaddrs**, **krb5\_auth\_con\_genaddrs**, **krb5\_auth\_con\_getkey**, **krb5\_auth\_con\_setkey**, **krb5\_auth\_con\_getuserkey**, **krb5\_auth\_con\_setuserkey**, **krb5\_auth\_con\_getlocalsubkey**, **krb5\_auth\_con\_setlocalsubkey**, **krb5\_auth\_con\_getremotesubkey**, **krb5\_auth\_con\_setremotesubkey**, **krb5\_auth\_setcksumtype**, **krb5\_auth\_getcksumtype**, **krb5\_auth\_setkeytype**, **krb5\_auth\_getkeytype**, **krb5\_auth\_getlocalseqnumber**, **krb5\_auth\_setlocalseqnumber**, **krb5\_auth\_getremoteseqnumber**, **krb5\_auth\_setremoteseqnumber**, **krb5\_auth\_getauthenticator**, **krb5\_auth\_con\_getrcache**, **krb5\_auth\_con\_setrcache**, **krb5\_auth\_con\_initivector**, **krb5\_auth\_con\_setivector** – manage authentication on connection level

## LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

## SYNOPSIS

**#include \<krb5.h\>**

*krb5\_error\_code*\

**krb5\_auth\_con\_init**(*krb5\_context context*, *krb5\_auth\_context \*auth\_context*);

*void*\

**krb5\_auth\_con\_free**(*krb5\_context context*, *krb5\_auth\_context auth\_context*);

*krb5\_error\_code*\

**krb5\_auth\_con\_setflags**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *int32\_t flags*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getflags**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *int32\_t \*flags*);

*krb5\_error\_code*\

**krb5\_auth\_con\_setaddrs**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_address \*local\_addr*, *krb5\_address \*remote\_addr*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getaddrs**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_address \*\*local\_addr*, *krb5\_address \*\*remote\_addr*);

*krb5\_error\_code*\

**krb5\_auth\_con\_genaddrs**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *int fd*, *int flags*);

*krb5\_error\_code*\

**krb5\_auth\_con\_setaddrs\_from\_fd**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *void \*p\_fd*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getkey**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_keyblock \*\*keyblock*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getlocalsubkey**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_keyblock \*\*keyblock*);

*krb5\_error\_code*\

**krb5\_auth\_con\_getremotesubkey**(*krb5\_context context*, *krb5\_auth\_context auth\_context*, *krb5\_keyblock \*\*keyblock*);

*krb5\_error\_code*\

**krb5\_auth\_con\_initivector**(*krb5\_context context*, *krb5\_auth\_context auth\_context*);

*krb5\_error\_code*\

**krb5\_auth\_con\_setivector**(*krb5\_context context*, *krb5\_auth\_context \*auth\_context*, *krb5\_pointer ivector*);

## DESCRIPTION

The **krb5\_auth\_context** structure holds all context related to an authenticated connection, in a similar way to **krb5\_context** that holds the context for the thread or process. **krb5\_auth\_context** is used by various functions that are directly related to authentication between the server/client. Example of data that this structure contains are various flags, addresses of client and server, port numbers, keyblocks (and subkeys), sequence numbers, replay cache, and checksum-type.

**krb5\_auth\_con\_init**() allocates and initializes the **krb5\_auth\_context** structure. Default values can be changed with **krb5\_auth\_con\_setcksumtype**() and **krb5\_auth\_con\_setflags**(). The **auth\_context** structure must be freed by **krb5\_auth\_con\_free**().

**krb5\_auth\_con\_getflags**() and **krb5\_auth\_con\_setflags**() gets and modifies the flags for a **krb5\_auth\_context** structure. Possible flags to set are:

- KRB5\_AUTH\_CONTEXT\_DO\_TIME

  check timestamp on incoming packets.

- KRB5\_AUTH\_CONTEXT\_DO\_SEQUENCE

  Generate and check sequence-number on each packet.

**krb5\_auth\_con\_setaddrs**(), **krb5\_auth\_con\_setaddrs\_from\_fd**() and **krb5\_auth\_con\_getaddrs**() gets and sets the addresses that are checked when a packet is received. It is mandatory to set an address for the remote host. If the local address is not set, it iss deduced from the underlaying operating system. **krb5\_auth\_con\_getaddrs**() will call **krb5\_free\_address**() on any address that is passed in *local\_addr* or *remote\_addr*. **krb5\_auth\_con\_setaddr**() allows passing in a NULL pointer as *local\_addr* and *remote\_addr*, in that case it will just not set that address.

**krb5\_auth\_con\_setaddrs\_from\_fd**() fetches the addresses from a file descriptor.

**krb5\_auth\_con\_genaddrs**() fetches the address information from the given file descriptor *fd* depending on the bitmap argument *flags*.

Possible values on *flags* are:

- *KRB5\_AUTH\_CONTEXT\_GENERATE\_LOCAL\_ADDR*

  fetches the local address from *fd*.

- *KRB5\_AUTH\_CONTEXT\_GENERATE\_REMOTE\_ADDR*

  fetches the remote address from *fd*.

**krb5\_auth\_con\_setkey**(), **krb5\_auth\_con\_setuserkey**() and **krb5\_auth\_con\_getkey**() gets and sets the key used for this auth context. The keyblock returned by **krb5\_auth\_con\_getkey**() should be freed with **krb5\_free\_keyblock**(). The keyblock send into **krb5\_auth\_con\_setkey**() is copied into the **krb5\_auth\_context**, and thus no special handling is needed. NULL is not a valid keyblock to **krb5\_auth\_con\_setkey**().

**krb5\_auth\_con\_setuserkey**() is only useful when doing user to user authentication. **krb5\_auth\_con\_setkey**() is equivalent to **krb5\_auth\_con\_setuserkey**().

**krb5\_auth\_con\_getlocalsubkey**(), **krb5\_auth\_con\_setlocalsubkey**(), **krb5\_auth\_con\_getremotesubkey**() and **krb5\_auth\_con\_setremotesubkey**() gets and sets the keyblock for the local and remote subkey. The keyblock returned by **krb5\_auth\_con\_getlocalsubkey**() and **krb5\_auth\_con\_getremotesubkey**() must be freed with **krb5\_free\_keyblock**().

**krb5\_auth\_setcksumtype**() and **krb5\_auth\_getcksumtype**() sets and gets the checksum type that should be used for this connection.

**krb5\_auth\_getremoteseqnumber**() **krb5\_auth\_setremoteseqnumber**(), **krb5\_auth\_getlocalseqnumber**() and **krb5\_auth\_setlocalseqnumber**() gets and sets the sequence-number for the local and remote sequence-number counter.

**krb5\_auth\_setkeytype**() and **krb5\_auth\_getkeytype**() gets and gets the keytype of the keyblock in **krb5\_auth\_context**.

**krb5\_auth\_getauthenticator**() Retrieves the authenticator that was used during mutual authentication. The authenticator returned should be freed by calling **krb5\_free\_authenticator**().

**krb5\_auth\_con\_getrcache**() and **krb5\_auth\_con\_setrcache**() gets and sets the replay-cache.

**krb5\_auth\_con\_initivector**() allocates memory for and zeros the initial vector in the *auth\_context* keyblock.

**krb5\_auth\_con\_setivector**() sets the i\_vector portion of *auth\_context* to *ivector*.

## SEE ALSO

[krb5\_context(3)](/krb5_context/3.md), [kerberos(8)](/kerberos/8.md)