how to use gss_import_name correctly?

问题:

I am using gss_import_name on the client side using GSS_C_NT_HOSTBASED_SERVICE to get a principal like service/server-host@realm.

I am calling like this,

gss_import_name(status, "SERVICE", GSS_C_HOSTBASED_SERVICE, output_name);

But i get the principal like, service/local-machine@realm. From the man page I have learned it internally uses krb5_sname_to_principal to get the hostname, if NULL it takes the localhost name. Now my question is how do pass the correct host name (server-host) to gss-api to create the principal?

回答1:

I overlooked into it. To get the principal in the form 'service/server-host@realm' I should call

gss_import_name(status, "service@server-host", GSS_C_HOSTBASED_SERVICE, output_name);

instead of

gss_import_name(status, "service", GSS_C_HOSTBASED_SERVICE, output_name);

If the host name is missing then it assumes to be the local host name.