---
name: "krb5_mk_rep_extended"
section: "3"
platform: "linux"
package: "heimdal-dev"
version: "7.8.git20221117.28daf24+dfsg-9+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/krb5_mk_rep_extended"
---

# krb5\_mk\_rep\_extended(3)

create and read application authentication request

## NAME

**krb5\_mk\_req**, **krb5\_mk\_req\_exact**, **krb5\_mk\_req\_extended**, **krb5\_rd\_req**, **krb5\_rd\_req\_with\_keyblock**, **krb5\_mk\_rep**, **krb5\_mk\_rep\_exact**, **krb5\_mk\_rep\_extended**, **krb5\_rd\_rep**, **krb5\_build\_ap\_req**, **krb5\_verify\_ap\_req** – create and read application authentication request

## LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

## SYNOPSIS

**#include \<krb5.h\>**

*krb5\_error\_code*\

**krb5\_mk\_req**(*krb5\_context context*, *krb5\_auth\_context \*auth\_context*, *const krb5\_flags ap\_req\_options*, *const char \*service*, *const char \*hostname*, *krb5\_data \*in\_data*, *krb5\_ccache ccache*, *krb5\_data \*outbuf*);

*krb5\_error\_code*\

**krb5\_mk\_req\_extended**(*krb5\_context context*, *krb5\_auth\_context \*auth\_context*, *const krb5\_flags ap\_req\_options*, *krb5\_data \*in\_data*, *krb5\_creds \*in\_creds*, *krb5\_data \*outbuf*);

*krb5\_error\_code*\

**krb5\_rd\_req**(*krb5\_context context*, *krb5\_auth\_context \*auth\_context*, *const krb5\_data \*inbuf*, *krb5\_const\_principal server*, *krb5\_keytab keytab*, *krb5\_flags \*ap\_req\_options*, *krb5\_ticket \*\*ticket*);

*krb5\_error\_code*\

**krb5\_build\_ap\_req**(*krb5\_context context*, *krb5\_enctype enctype*, *krb5\_creds \*cred*, *krb5\_flags ap\_options*, *krb5\_data authenticator*, *krb5\_data \*retdata*);

*krb5\_error\_code*\

**krb5\_verify\_ap\_req**(*krb5\_context context*, *krb5\_auth\_context \*auth\_context*, *krb5\_ap\_req \*ap\_req*, *krb5\_const\_principal server*, *krb5\_keyblock \*keyblock*, *krb5\_flags flags*, *krb5\_flags \*ap\_req\_options*, *krb5\_ticket \*\*ticket*);

## DESCRIPTION

The functions documented in this manual page document the functions that facilitates the exchange between a Kerberos client and server. They are the core functions used in the authentication exchange between the client and the server.

The **krb5\_mk\_req** and **krb5\_mk\_req\_extended** creates the Kerberos message KRB\_AP\_REQ that is sent from the client to the server as the first packet in a client/server exchange.  The result that should be sent to server is stored in *outbuf*.

*auth\_context* should be allocated with **krb5\_auth\_con\_init**() or NULL passed in, in that case, it will be allocated and freed internally.

The input data *in\_data* will have a checksum calculated over it and checksum will be transported in the message to the server.

*ap\_req\_options* can be set to one or more of the following flags:

- AP\_OPTS\_USE\_SESSION\_KEY

  Use the session key when creating the request, used for user to user authentication.

- AP\_OPTS\_MUTUAL\_REQUIRED

  Mark the request as mutual authenticate required so that the receiver returns a mutual authentication packet.

The **krb5\_rd\_req** read the AP\_REQ in *inbuf* and verify and extract the content. If *server* is specified, that server will be fetched from the *keytab* and used unconditionally. If *server* is NULL, the *keytab* will be search for a matching principal.

The *keytab* argument specifies what keytab to search for receiving principals. The arguments *ap\_req\_options* and *ticket* returns the content.

When the AS-REQ is a user to user request, neither of *keytab* or *principal* are used, instead **krb5\_rd\_req**() expects the session key to be set in *auth\_context*.

The **krb5\_verify\_ap\_req** and **krb5\_build\_ap\_req** both constructs and verify the AP\_REQ message, should not be used by external code.

## SEE ALSO

[krb5(3)](/krb5/3.md), [krb5.conf(5)](/krb5.conf/5.md)