Kerberos Class

Properties   Methods   Events   Config Settings   Errors  

The Kerberos class can be used to authenticate users using Kerberos 5.0.

Syntax

Kerberos

Remarks

The Kerberos class implements the Kerberos protocol defined in RFC 1510 and RFC 4120. The class provides a simple interface to easily authenticate users.

Authentication

When Authenticate is called the class will attempt to authenticate the user with the Key Distribution Center (KDC). The class will communicate with the KDCHost to obtain a service ticket and populate AuthToken. The following properties are required when calling this method:

• SPN (required)
• User (required)
• Password (required)
• KDCHost (required)

A typical sequence of messages would be:

• KRB_AS_REQ -> KDC
• KRB_AS_REP <- KDC
• KRB_TGS_REQ -> KDC
• KRB_TGS_REP <- KDC
• AuthToken is populated with the constructed KRB_AP_REP message.

Communication with the KDCHost can be seen through the PITrail event.

Property List

The following is the full list of the properties of the class with short descriptions. Click on the links for further details.

Method List

The following is the full list of the methods of the class with short descriptions. Click on the links for further details.

Event List

The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.

Config Settings

The following is a list of config settings for the class with short descriptions. Click on the links for further details.

AuthToken Property (Kerberos Class)

The authentication token.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int GetAuthToken(char* &lpAuthToken, int &lenAuthToken);

Unicode (Windows)
INT GetAuthToken(LPSTR &lpAuthToken, INT &lenAuthToken);

int ipworksauth_kerberos_getauthtoken(void* lpObj, char** lpAuthToken, int* lenAuthToken);

QByteArray GetAuthToken();

Default Value

""

Remarks

This property holds the authentication token.

This property will be populated after calling Authenticate. This may be used in by another entity to authenticate to the service. For instance this may be used in HTTP to authenticate to a web service.

The content of this property is a KRB_AP_REQ message. This is sometimes referred to as an "Authentication Header". It is comprised of the service ticket that was obtained from the TGS and an encrypted authenticator.

This property is read-only.

Data Type

Binary String

KDCHost Property (Kerberos Class)

The domain name or IP address of the Key Distribution Center (KDC).

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetKDCHost();
int SetKDCHost(const char* lpszKDCHost);

Unicode (Windows)
LPWSTR GetKDCHost();
INT SetKDCHost(LPCWSTR lpszKDCHost);

char* ipworksauth_kerberos_getkdchost(void* lpObj);
int ipworksauth_kerberos_setkdchost(void* lpObj, const char* lpszKDCHost);

QString GetKDCHost();
int SetKDCHost(QString qsKDCHost);

Default Value

""

Remarks

This property specifies the IP address (IP number in dotted internet format) or Domain Name of the Key Distribution Center (KDC).

If this property is set to a Domain Name, a DNS request is initiated and upon successful termination of the request, this property is set to the corresponding address. If the search is not successful, an error is returned.

Data Type

String

KDCPort Property (Kerberos Class)

The port for the Key Distribution Center (KDC).

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int GetKDCPort();
int SetKDCPort(int iKDCPort);

Unicode (Windows)
INT GetKDCPort();
INT SetKDCPort(INT iKDCPort);

int ipworksauth_kerberos_getkdcport(void* lpObj);
int ipworksauth_kerberos_setkdcport(void* lpObj, int iKDCPort);

int GetKDCPort();
int SetKDCPort(int iKDCPort);

Default Value

88

Remarks

This property specifies the port for the Key Distribution Center (KDC). The default value is 88.

Data Type

Integer

KeytabFile Property (Kerberos Class)

The Kerberos Keytab file.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetKeytabFile();
int SetKeytabFile(const char* lpszKeytabFile);

Unicode (Windows)
LPWSTR GetKeytabFile();
INT SetKeytabFile(LPCWSTR lpszKeytabFile);

char* ipworksauth_kerberos_getkeytabfile(void* lpObj);
int ipworksauth_kerberos_setkeytabfile(void* lpObj, const char* lpszKeytabFile);

QString GetKeytabFile();
int SetKeytabFile(QString qsKeytabFile);

Default Value

""

Remarks

This property specifies the path to a Kerberos Keytab file. If specified, the credentials are read from this file.

Data Type

String

Password Property (Kerberos Class)

The user's password.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetPassword();
int SetPassword(const char* lpszPassword);

Unicode (Windows)
LPWSTR GetPassword();
INT SetPassword(LPCWSTR lpszPassword);

char* ipworksauth_kerberos_getpassword(void* lpObj);
int ipworksauth_kerberos_setpassword(void* lpObj, const char* lpszPassword);

QString GetPassword();
int SetPassword(QString qsPassword);

Default Value

""

Remarks

This property specifies the user's password. This must be set before calling Authenticate.

Data Type

String

SPN Property (Kerberos Class)

The Service Principal Name (SPN).

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetSPN();
int SetSPN(const char* lpszSPN);

Unicode (Windows)
LPWSTR GetSPN();
INT SetSPN(LPCWSTR lpszSPN);

char* ipworksauth_kerberos_getspn(void* lpObj);
int ipworksauth_kerberos_setspn(void* lpObj, const char* lpszSPN);

QString GetSPN();
int SetSPN(QString qsSPN);

Default Value

""

Remarks

This property specifies the Service Principal Name (SPN). This must be set before calling Authenticate.

Data Type

String

Timeout Property (Kerberos Class)

A timeout for the class.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int GetTimeout();
int SetTimeout(int iTimeout);

Unicode (Windows)
INT GetTimeout();
INT SetTimeout(INT iTimeout);

int ipworksauth_kerberos_gettimeout(void* lpObj);
int ipworksauth_kerberos_settimeout(void* lpObj, int iTimeout);

int GetTimeout();
int SetTimeout(int iTimeout);

Default Value

60

Remarks

If the Timeout property is set to 0, all operations will run uninterrupted until successful completion or an error condition is encountered.

If Timeout is set to a positive value, the class will wait for the operation to complete before returning control.

The class will use DoEvents to enter an efficient wait loop during any potential waiting period, making sure that all system events are processed immediately as they arrive. This ensures that the host application does not "freeze" and remains responsive.

If Timeout expires, and the operation is not yet complete, the class fails with an error.

Please note that by default, all timeouts are inactivity timeouts, i.e. the timeout period is extended by Timeout seconds when any amount of data is successfully sent or received.

The default value for the Timeout property is 60 seconds.

Data Type

Integer

User Property (Kerberos Class)

The name and domain of the user to authenticate.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* GetUser();
int SetUser(const char* lpszUser);

Unicode (Windows)
LPWSTR GetUser();
INT SetUser(LPCWSTR lpszUser);

char* ipworksauth_kerberos_getuser(void* lpObj);
int ipworksauth_kerberos_setuser(void* lpObj, const char* lpszUser);

QString GetUser();
int SetUser(QString qsUser);

Default Value

""

Remarks

This property specifies the name and realm/domain of the user. The value specified must be in one of the following formats:

• user@domain
• domain/user

Data Type

String

UseTCP Property (Kerberos Class)

Whether TCP is used when establishing the connection.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int GetUseTCP();
int SetUseTCP(int bUseTCP);

Unicode (Windows)
BOOL GetUseTCP();
INT SetUseTCP(BOOL bUseTCP);

int ipworksauth_kerberos_getusetcp(void* lpObj);
int ipworksauth_kerberos_setusetcp(void* lpObj, int bUseTCP);

bool GetUseTCP();
int SetUseTCP(bool bUseTCP);

Default Value

FALSE

Remarks

This property specifies whether TCP is used as the transport protocol when establishing the connection. By default this property is False and UDP will be used.

Data Type

Boolean

Authenticate Method (Kerberos Class)

Authenticates the user.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Authenticate();

Unicode (Windows)
INT Authenticate();

int ipworksauth_kerberos_authenticate(void* lpObj);

int Authenticate();

Remarks

This method authenticates the User.

Authentication

When Authenticate is called the class will attempt to authenticate the user with the Key Distribution Center (KDC). The class will communicate with the KDCHost to obtain a service ticket and populate AuthToken. The following properties are required when calling this method:

• SPN (required)
• User (required)
• Password (required)
• KDCHost (required)

A typical sequence of messages would be:

• KRB_AS_REQ -> KDC
• KRB_AS_REP <- KDC
• KRB_TGS_REQ -> KDC
• KRB_TGS_REP <- KDC
• AuthToken is populated with the constructed KRB_AP_REP message.

Communication with the KDCHost can be seen through the PITrail event.

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Config Method (Kerberos Class)

Sets or retrieves a configuration setting.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
char* Config(const char* lpszConfigurationString);

Unicode (Windows)
LPWSTR Config(LPCWSTR lpszConfigurationString);

char* ipworksauth_kerberos_config(void* lpObj, const char* lpszConfigurationString);

QString Config(const QString& qsConfigurationString);

Remarks

Config is a generic method available in every class. It is used to set and retrieve configuration settings for the class.

These settings are similar in functionality to properties, but they are rarely used. In order to avoid "polluting" the property namespace of the class, access to these internal properties is provided through the Config method.

To set a configuration setting named PROPERTY, you must call Config("PROPERTY=VALUE"), where VALUE is the value of the setting expressed as a string. For boolean values, use the strings "True", "False", "0", "1", "Yes", or "No" (case does not matter).

To read (query) the value of a configuration setting, you must call Config("PROPERTY"). The value will be returned as a string.

Error Handling (C++)

This method returns a String value; after it returns, call the GetLastErrorCode() method to obtain its result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message.

DoEvents Method (Kerberos Class)

Processes events from the internal message queue.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int DoEvents();

Unicode (Windows)
INT DoEvents();

int ipworksauth_kerberos_doevents(void* lpObj);

int DoEvents();

Remarks

When DoEvents is called, the class processes any available events. If no events are available, it waits for a preset period of time, and then returns.

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Interrupt Method (Kerberos Class)

Interrupt the current method.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Interrupt();

Unicode (Windows)
INT Interrupt();

int ipworksauth_kerberos_interrupt(void* lpObj);

int Interrupt();

Remarks

If there is no method in progress, Interrupt simply returns, doing nothing.

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Reset Method (Kerberos Class)

Resets the class properties to their default values.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
int Reset();

Unicode (Windows)
INT Reset();

int ipworksauth_kerberos_reset(void* lpObj);

int Reset();

Remarks

This method resets the properties to their default values.

Error Handling (C++)

This method returns a result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. If an error occurs, the GetLastError() method can be called to retrieve the associated error message. (Note: This method's result code can also be obtained by calling the GetLastErrorCode() method after it returns.)

Error Event (Kerberos Class)

Information about errors during data delivery.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
virtual int FireError(KerberosErrorEventParams *e);

typedef struct {
  int ErrorCode;
  const char *Description;
  int reserved;
} KerberosErrorEventParams;


Unicode (Windows)
virtual INT FireError(KerberosErrorEventParams *e);

typedef struct {
  INT ErrorCode;
  LPCWSTR Description;
  INT reserved;
} KerberosErrorEventParams;

#define EID_KERBEROS_ERROR 1

virtual INT IPWORKSAUTH_CALL FireError(INT &iErrorCode, LPSTR &lpszDescription);

class KerberosErrorEventParams {
public:
  int ErrorCode();

  const QString &Description();

  int EventRetVal();
  void SetEventRetVal(int iRetVal);
};

// To handle, connect one or more slots to this signal.
void Error(KerberosErrorEventParams *e);

// Or, subclass Kerberos and override this emitter function.
virtual int FireError(KerberosErrorEventParams *e) {...}

Remarks

The Error event is fired in case of exceptional conditions during message processing. Normally the class fails with an error.

The ErrorCode parameter contains an error code, and the Description parameter contains a textual description of the error. For a list of valid error codes and their descriptions, please refer to the Error Codes section.

Log Event (Kerberos Class)

Fires once for each log message.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
virtual int FireLog(KerberosLogEventParams *e);

typedef struct {
  int LogLevel;
  const char *Message;
  const char *LogType;
  int reserved;
} KerberosLogEventParams;


Unicode (Windows)
virtual INT FireLog(KerberosLogEventParams *e);

typedef struct {
  INT LogLevel;
  LPCWSTR Message;
  LPCWSTR LogType;
  INT reserved;
} KerberosLogEventParams;

#define EID_KERBEROS_LOG 2

virtual INT IPWORKSAUTH_CALL FireLog(INT &iLogLevel, LPSTR &lpszMessage, LPSTR &lpszLogType);

class KerberosLogEventParams {
public:
  int LogLevel();

  const QString &Message();

  const QString &LogType();

  int EventRetVal();
  void SetEventRetVal(int iRetVal);
};

// To handle, connect one or more slots to this signal.
void Log(KerberosLogEventParams *e);

// Or, subclass Kerberos and override this emitter function.
virtual int FireLog(KerberosLogEventParams *e) {...}

Remarks

This event fires once for each log message generated by the class. The verbosity is controlled by the LogLevel setting.

LogLevel indicates the level of the Message. Possible values are:

The value 1 (Info) logs basic information, including the URL, HTTP version, and status details.

The value 2 (Verbose) logs additional information about the request and response.

The value 3 (Debug) logs the headers and body for both the request and response, as well as additional debug information (if any).

LogType identifies the type of log entry. Possible values are:

• Info
• Verbose
• Debug

PITrail Event (Kerberos Class)

Traces the messages sent to the server, and the respective replies.

Syntax

• C++
• C
• Qt

ANSI (Cross Platform)
virtual int FirePITrail(KerberosPITrailEventParams *e);

typedef struct {
  int Direction;
  const char *Message;
  int reserved;
} KerberosPITrailEventParams;


Unicode (Windows)
virtual INT FirePITrail(KerberosPITrailEventParams *e);

typedef struct {
  INT Direction;
  LPCWSTR Message;
  INT reserved;
} KerberosPITrailEventParams;

#define EID_KERBEROS_PITRAIL 3

virtual INT IPWORKSAUTH_CALL FirePITrail(INT &iDirection, LPSTR &lpszMessage);

class KerberosPITrailEventParams {
public:
  int Direction();

  const QString &Message();

  int EventRetVal();
  void SetEventRetVal(int iRetVal);
};

// To handle, connect one or more slots to this signal.
void PITrail(KerberosPITrailEventParams *e);

// Or, subclass Kerberos and override this emitter function.
virtual int FirePITrail(KerberosPITrailEventParams *e) {...}

Remarks

The PITrail event is useful for debugging purposes. It shows all the interaction between the client and the server. To include the raw packets set LogKerberosPackets to True.

The Message parameter contains the full text of the message. The Direction parameter shows the originator of the message:

Config Settings (Kerberos Class)

KERBEROS Config Settings

UDP Config Settings

Socket Config Settings

Base Config Settings

Trappable Errors (Kerberos Class)

Error Handling (C++)

Call the GetLastErrorCode() method to obtain the last called method's result code; 0 indicates success, while a non-zero error code indicates that this method encountered an error during its execution. Known error codes are listed below. If an error occurs, the GetLastError() method can be called to retrieve the associated error message.

kerberos Errors

UDP Errors

TCP/IP Errors