---
name: "krb5_get_credentials"
section: "3"
platform: "linux"
package: "heimdal-dev"
version: "7.8.git20221117.28daf24+dfsg-9+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/krb5_get_credentials"
---

# krb5\_get\_credentials(3)

get credentials from the KDC using krbtgt

## NAME

**krb5\_get\_credentials**, **krb5\_get\_credentials\_with\_flags**, **krb5\_get\_kdc\_cred**, **krb5\_get\_renewed\_creds** – get credentials from the KDC using krbtgt

## LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

## SYNOPSIS

**#include \<krb5.h\>**

*krb5\_error\_code*\

**krb5\_get\_credentials**(*krb5\_context context*, *krb5\_flags options*, *krb5\_ccache ccache*, *krb5\_creds \*in\_creds*, *krb5\_creds \*\*out\_creds*);

*krb5\_error\_code*\

**krb5\_get\_credentials\_with\_flags**(*krb5\_context context*, *krb5\_flags options*, *krb5\_kdc\_flags flags*, *krb5\_ccache ccache*, *krb5\_creds \*in\_creds*, *krb5\_creds \*\*out\_creds*);

*krb5\_error\_code*\

**krb5\_get\_kdc\_cred**(*krb5\_context context*, *krb5\_ccache id*, *krb5\_kdc\_flags flags*, *krb5\_addresses \*addresses*, *Ticket  \*second\_ticket*, *krb5\_creds \*in\_creds*, *krb5\_creds \*\*out\_creds*);

*krb5\_error\_code*\

**krb5\_get\_renewed\_creds**(*krb5\_context context*, *krb5\_creds \*creds*, *krb5\_const\_principal client*, *krb5\_ccache ccache*, *const char \*in\_tkt\_service*);

## DESCRIPTION

**krb5\_get\_credentials\_with\_flags**() get credentials specified by *in\_creds-\>server* and *in\_creds-\>client* (the rest of the *in\_creds* structure is ignored) by first looking in the *ccache* and if doesn't exists or is expired, fetch the credential from the KDC using the krbtgt in *ccache*. The credential is returned in *out\_creds* and should be freed using the function **krb5\_free\_creds**().

Valid flags to pass into *options* argument are:

- KRB5\_GC\_CACHED

  Only check the *ccache*, don't got out on network to fetch credential.

- KRB5\_GC\_USER\_USER

  Request a user to user ticket. This option doesn't store the resulting user to user credential in the *ccache*.

- KRB5\_GC\_EXPIRED\_OK

  returns the credential even if it is expired, default behavior is trying to refetch the credential from the KDC.

*Flags* are KDCOptions, note the caller must fill in the bit-field and not use the integer associated structure.

**krb5\_get\_credentials**() works the same way as **krb5\_get\_credentials\_with\_flags**() except that the *flags* field is missing.

**krb5\_get\_kdc\_cred**() does the same as the functions above, but the caller must fill in all the information andits closer to the wire protocol.

**krb5\_get\_renewed\_creds**() renews a credential given by *in\_tkt\_service* (if NULL the default krbtgt) using the credential cache *ccache*. The result is stored in *creds* and should be freed using *krb5\_free\_creds*.

## EXAMPLES

Here is a example function that get a credential from a credential cache *id* or the KDC and returns it to the caller.

```
#include <krb5.h>
int
getcred(krb5_context context, krb5_ccache id, krb5_creds **creds)
{
    krb5_error_code ret;
    krb5_creds in;
    ret = krb5_parse_name(context, "client@EXAMPLE.COM",
			  &in.client);
    if (ret)
	krb5_err(context, 1, ret, "krb5_parse_name");
    ret = krb5_parse_name(context, "host/server.example.com@EXAMPLE.COM",
			  &in.server);
    if (ret)
	krb5_err(context, 1, ret, "krb5_parse_name");
    ret = krb5_get_credentials(context, 0, id, &in, creds);
    if (ret)
	krb5_err(context, 1, ret, "krb5_get_credentials");
    return 0;
}
```

## SEE ALSO

[krb5(3)](/krb5/3.md), [krb5\_get\_forwarded\_creds(3)](/krb5_get_forwarded_creds/3.md), [krb5.conf(5)](/krb5.conf/5.md)