Struct KerberosAuth

pub struct KerberosAuth {
    gss_cred: Cred,
    ongoing_exchanges: HashMap<String, SpnegoContext>,
}

Kerberos authentication handler using SPNEGO RFC 4559.

Fields

gss_cred: Cred

ongoing_exchanges: HashMap<String, SpnegoContext>

Implementations

impl KerberosAuth

pub fn new() -> Result<Self, GCHubRestServerError>

fn get_or_start_gss_ctx( &mut self, conn_id: &str, ) -> Result<&mut ServerCtx, SpnegoError>

Retrieves an existing GSSAPI context for the connection ID or creates a new one if it doesn’t exist. If the existing context has exceeded the maximum ticket negotiation duration, it is removed and an error is returned.

fn set_spnego_cookie(req: &mut Response, conn_id: String)

Sets a cookie in the response with the connection ID

fn create_negotiation_request( gss_api_data: Option<&[u8]>, spnego_session_id: Option<String>, ) -> Box<Response>

Creates a 401 response with the WWW-Authenticate header set to “Negotiate”. If gss_api_data is not None, it will be encoded in a BASE64 and sent int he negotiate header.

If spnego_session_id is not None, it will be set as a cookie in the response.

fn remove_expired_negotiations(&mut self)

Removes any negotiations that have expired

fn negotiation_step( &mut self, conn_data: &mut ConnectionToken<'_>, ) -> Result<String, SpnegoError>

pub fn authenticate(&mut self, req: &Request) -> Result<String, Box<Response>>

Retrieves a Kerberos principal name upon successful authentication. Otherwise it returns a response that should be sent to the client to continue or restart the negotiation.