-
Notifications
You must be signed in to change notification settings - Fork 45
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add documentation for cred store common values
Signed-off-by: Simo Sorce <simo@redhat.com>
- Loading branch information
Showing
4 changed files
with
79 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,73 @@ | ||
Common Values for Credentials Store Extensions | ||
============================================== | ||
|
||
.. py:module:: gssapi.raw | ||
The credentials store extension is an extension introduced by the MIT krb5 | ||
library implementation of GSSAPI. It allows for finer control of creedntials | ||
from within a GSSAPI application. | ||
Each mechanism can define keywords to manipulate various aspects of their | ||
credentials for storage or retrieval operations. | ||
|
||
.. note: | ||
Only mechanisms that implement keywords can use them, some mechanism may | ||
share the same or similar keywords, but their meaning is always local to | ||
a specific mechanism. | ||
The krb5 mechanism in MIT libraries | ||
----------------------------------- | ||
|
||
The krb5 mechanism as implemented by MIT libraries supports the credentials | ||
store extension with a number of keywords. | ||
|
||
client_keytab | ||
""""""""""""" | ||
|
||
The `client_keytab` keyword can be used in a credential store when it is used | ||
with the :func:`gssapi.raw.ext_cred_store.acquire_cred_from` / | ||
:func:`gssapi.raw.ext_cred_store.add_cred_from` functions, to indicate a | ||
custom location for a keytab containing client keys. | ||
It is not used in the context of calls used to store credentials. | ||
The value is a string in the form "type:residual" where type can be any | ||
keytab storage type understood by the implementation. If a simple path is | ||
provided then the type is assumed to be the `FILE` type. | ||
|
||
keytab | ||
"""""" | ||
|
||
The `keytab` keyword can be used in a credential store when it is used with | ||
the :func:`gssapi.raw.ext_cred_store.acquire_cred_from` / | ||
:func:`gssapi.raw.ext_cred_store.add_cred_from` functions, to indicate a | ||
custom location for a keytab containing service keys. | ||
It is not used in the context of calls used to store credentials. | ||
The value is a string in the form "type:residual" where type can be any | ||
keytab storage type understood by the implementation. If a simple path is | ||
provided then the type is assumed to be the `FILE` type. | ||
|
||
ccache | ||
"""""" | ||
|
||
The `ccache` keyword can be used to reference a specific credential storage. | ||
It can be used both to indicate the source of existing credentials for the | ||
:func:`gssapi.raw.ext_cred_store.acquire_cred_from` / | ||
:func:`gssapi.raw.ext_cred_store.add_cred_from` functions, as well as the | ||
destination storage for the :func:`gssapi.raw.ext_cred_store.store_cred_into` | ||
function. | ||
The value is a string in the form "type:residual" where type can be any | ||
credential cache storage type understood by the implementation. If a simple | ||
path is provided then the type is assumed to be the `FILE` type. Other | ||
commonly used types are `DIR`, `KEYRING`, `KCM`. Each type has a different | ||
format for residuals; refer to the MIT krb5 documentation for more details. | ||
|
||
rcache | ||
"""""" | ||
|
||
The `rcache` keyword can be used to reference a custom replay cache storage. | ||
It is used only with the :func:`gssapi.raw.ext_cred_store.acquire_cred_from` / | ||
:func:`gssapi.raw.ext_cred_store.add_cred_from` functions for credentials used | ||
to accept context establishments, not to initiate contexts. | ||
The value is a string in the form "type:residual" where type can be any | ||
replay cache storage type understood by the implementation. If a simple path | ||
is provided then the type is assumed to be the `FILE` type. | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters