Struct ServerCtx 

pub struct ServerCtx(/* private fields */);

A Kerberos server context

Implementations

impl ServerCtx

pub fn new( flags: AcceptFlags, principal: Option<&str>, channel_bindings: Option<&[u8]>, ) -> Result<PendingServerCtx>

Create a new server context for principal, which should be the service principal name assigned to the service the client will be requesting. If it is left as None it will use the user running the current process. The returned pending context must be initiaized by exchanging one or more tokens with the client before it can be used.

If present, channel_bindings must match the bindings the client supplied to ClientCtx::new; the mechanism rejects the context otherwise. Note that with a None acceptor binding the mechanism generally accepts whatever the client sent, so to actually enforce channel binding the server must pass its own expected bindings here.

Examples found in repository

examples/auth.rs (line 22)

fn server(spn: String, input: mpsc::Receiver<Msg>, output: mpsc::Sender<Msg>) {
    let mut server = ServerCtx::new(AcceptFlags::empty(), Some(&spn), None).expect("new");
    let mut server = loop {
        let token = match input.recv().expect("expected data") {
            Msg::Msg(_) => panic!("server not finished initializing"),
            Msg::Token(t) => t,
        };
        match server.step(&*token).expect("step") {
            Step::Finished((ctx, token)) => {
                if let Some(token) = token {
                    output
                        .send(Msg::Token(Bytes::copy_from_slice(&*token)))
                        .expect("send");
                }
                break ctx;
            }
            Step::Continue((ctx, token)) => {
                output.send(Msg::Token(Bytes::copy_from_slice(&*token))).expect("send");
                server = ctx;
            }
        }
    };
    match input.recv().expect("expected data msg") {
        Msg::Token(_) => panic!("unexpected extra token"),
        Msg::Msg(secret_msg) => println!(
            "{}",
            String::from_utf8_lossy(&server.unwrap(&*secret_msg).expect("unwrap"))
        ),
    }
}

pub fn new_with_cred( flags: AcceptFlags, cred: Cred, channel_bindings: Option<&[u8]>, ) -> Result<PendingServerCtx>

Trait Implementations

impl Debug for ServerCtx

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl K5Ctx for ServerCtx

type Buffer = <ServerCtx as K5Ctx>::Buffer

type IOVBuffer = <ServerCtx as K5Ctx>::IOVBuffer

fn wrap(&mut self, encrypt: bool, msg: &[u8]) -> Result<Self::Buffer>

Wrap the specified message for sending to the other side. If encrypt is true then the contents will be encrypted. Even if encrypt is false the integrity of the contents are protected, if the message is altered in transit the other side will know.

fn wrap_iov(&mut self, encrypt: bool, msg: BytesMut) -> Result<Self::IOVBuffer>

Wrap data in place using the underlying wrap_iov facility. If encrypt is true then the contents of data will be encrypted in place. The returned buffer is NOT contiguous, and as such you must use some kind of writev implementation to properly send it. You can use tokio’s write_buf directly, or you can extract the iovecs for a direct call to writev using bytes::Buf::chunks_vectored.

fn unwrap(&mut self, msg: &[u8]) -> Result<Self::Buffer>

Unwrap the specified message returning it’s decrypted and verified contents

fn unwrap_iov(&mut self, len: usize, msg: &mut BytesMut) -> Result<BytesMut>

Unwrap in place the message at the beginning of the specified BytesMut and then split it off and return it. This won’t copy or allocate, it just looks that way because the bytes crate is awesome.

fn ttl(&mut self) -> Result<Duration>

Return the remaining time this session has to live

impl K5ServerCtx for ServerCtx

fn client(&mut self) -> Result<String>

Return the user principal name of the client context associated with this server context.