---
name: "krb5_verify_init_creds_opt_init"
section: "3"
platform: "linux"
package: "heimdal-dev"
version: "7.8.git20221117.28daf24+dfsg-9+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/krb5_verify_init_creds_opt_init"
---

# krb5\_verify\_init\_creds\_opt\_init(3)

verifies a credential cache is correct by using a local keytab

## NAME

**krb5\_verify\_init\_creds\_opt\_init**, **krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail**, **krb5\_verify\_init\_creds** – verifies a credential cache is correct by using a local keytab

## LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

## SYNOPSIS

**#include \<krb5.h\>**

struct krb5\_verify\_init\_creds\_opt;

*void*\

**krb5\_verify\_init\_creds\_opt\_init**(*krb5\_verify\_init\_creds\_opt \*options*);

*void*\

**krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail**(*krb5\_verify\_init\_creds\_opt \*options*, *int ap\_req\_nofail*);

*krb5\_error\_code*\

**krb5\_verify\_init\_creds**(*krb5\_context context*, *krb5\_creds \*creds*, *krb5\_principal ap\_req\_server*, *krb5\_ccache \*ccache*, *krb5\_verify\_init\_creds\_opt \*options*);

## DESCRIPTION

The **krb5\_verify\_init\_creds** function verifies the initial tickets with the local keytab to make sure the response of the KDC was spoof-ed.

**krb5\_verify\_init\_creds** will use principal *ap\_req\_server* from the local keytab, if NULL is passed in, the code will guess the local hostname and use that to form host/hostname/GUESSED-REALM-FOR-HOSTNAME. *creds* is the credential that **krb5\_verify\_init\_creds** should verify. If *ccache* is given **krb5\_verify\_init\_creds**() stores all credentials it fetched from the KDC there, otherwise it will use a memory credential cache that is destroyed when done.

**krb5\_verify\_init\_creds\_opt\_init**() cleans the the structure, must be used before trying to pass it in to **krb5\_verify\_init\_creds**().

**krb5\_verify\_init\_creds\_opt\_set\_ap\_req\_nofail**() controls controls the behavior if *ap\_req\_server* doesn't exists in the local keytab or in the KDC's database, if it's true, the error will be ignored.  Note that this use is possible insecure.

## SEE ALSO

[krb5(3)](/krb5/3.md), [krb5\_get\_init\_creds(3)](/krb5_get_init_creds/3.md), [krb5\_verify\_user(3)](/krb5_verify_user/3.md), [krb5.conf(5)](/krb5.conf/5.md)