3 .\" Copyright (c) 2005 Doug Rabson
4 .\" All rights reserved.
6 .\" Redistribution and use in source and binary forms, with or without
7 .\" modification, are permitted provided that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\" 2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
15 .\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
16 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
19 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
20 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
21 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
22 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
23 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
24 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 .\" The following commands are required for all man pages.
29 .Dt GSS_EXPORT_SEC_CONTEXT 3 PRM
32 .Nm gss_export_sec_context
33 .Nd Transfer a security context to another process
34 .\" This next command is for sections 2 and 3 only.
39 .Fo gss_export_sec_context
40 .Fa "OM_uint32 *minor_status"
41 .Fa "gss_ctx_id_t *context_handle"
42 .Fa "gss_buffer_t interprocess_token"
45 Provided to support the sharing of work between multiple processes.
46 This routine will typically be used by the context-acceptor,
47 in an application where a single process receives incoming connection
48 requests and accepts security contexts over them,
49 then passes the established context to one or more other processes for
51 .Fn gss_export_sec_context
52 deactivates the security context for the calling process and creates
53 an interprocess token which,
55 .Fn gss_import_sec_context
57 will re-activate the context in the second process.
58 Only a single instantiation of a given context may be active at any
60 a subsequent attempt by a context exporter to access the exported security context will fail.
62 The implementation may constrain the set of processes by which the
63 interprocess token may be imported,
64 either as a function of local security policy,
65 or as a result of implementation decisions.
67 some implementations may constrain contexts to be passed only between
68 processes that run under the same account,
69 or which are part of the same process group.
71 The interprocess token may contain security-sensitive information
72 (for example cryptographic keys).
73 While mechanisms are encouraged to either avoid placing such sensitive
74 information within interprocess tokens,
75 or to encrypt the token before returning it to the application,
76 in a typical object-library GSS-API implementation this may not be
78 Thus the application must take care to protect the interprocess token,
79 and ensure that any process to which the token is transferred is
82 If creation of the interprocess token is successful,
83 the implementation shall deallocate all process-wide resources
84 associated with the security context,
85 and set the context_handle to
86 .Dv GSS_C_NO_CONTEXT .
87 In the event of an error that makes it impossible to complete the
88 export of the security context,
89 the implementation must not return an interprocess token,
90 and should strive to leave the security context referenced by the
93 If this is impossible,
94 it is permissible for the implementation to delete the security
96 providing it also sets the
99 .Dv GSS_C_NO_CONTEXT .
101 .Bl -tag -width ".It interprocess_token"
103 Mechanism specific status code.
105 Context handle identifying the context to transfer.
106 .It interprocess_token
107 Token to be transferred to target process.
108 Storage associated with this token must be freed by the application
109 after use with a call to
110 .Fn gss_release_buffer .
113 .Bl -tag -width ".It GSS_S_CONTEXT_EXPIRED"
115 Successful completion
116 .It GSS_S_CONTEXT_EXPIRED
117 The context has expired
119 The context was invalid
120 .It GSS_S_UNAVAILABLE
121 The operation is not supported
124 .Xr gss_import_sec_context 3 ,
125 .Xr gss_release_buffer 3
127 .Bl -tag -width ".It RFC 2743"
129 Generic Security Service Application Program Interface Version 2, Update 1
131 Generic Security Service API Version 2 : C-bindings
136 function first appeared in
139 John Wray, Iris Associates
141 Copyright (C) The Internet Society (2000). All Rights Reserved.
143 This document and translations of it may be copied and furnished to
144 others, and derivative works that comment on or otherwise explain it
145 or assist in its implementation may be prepared, copied, published
146 and distributed, in whole or in part, without restriction of any
147 kind, provided that the above copyright notice and this paragraph are
148 included on all such copies and derivative works. However, this
149 document itself may not be modified in any way, such as by removing
150 the copyright notice or references to the Internet Society or other
151 Internet organizations, except as needed for the purpose of
152 developing Internet standards in which case the procedures for
153 copyrights defined in the Internet Standards process must be
154 followed, or as required to translate it into languages other than
157 The limited permissions granted above are perpetual and will not be
158 revoked by the Internet Society or its successors or assigns.
160 This document and the information contained herein is provided on an
161 "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING
162 TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING
163 BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION
164 HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF
165 MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.