Problem - Kevin Tafuro

After the authentication is successful, you should maintain the pam_handle_t object
returned by spc_pam_login( ) until the user logs out from your application, at which
point you should call spc_pam_logout( ) to allow PAM to perform anything it needs
to do to log the user out.
void spc_pam_logout(pam_handle_t *hndl) {
if (!hndl) return;
pam_close_session(hndl, 0);
pam_end(hndl, PAM_SUCCESS);
}
See Also
• “Pluggable Authentication Modules” by A. G. Morgan: http://www.kernel.org/
pub/linux/libs/pam/pre/doc/current-draft.txt
• OpenPAM home page: http://openpam.sourceforge.net
• Linux PAM home page: http://www.kernel.org/pub/linux/libs/pam/
• Solaris PAM home page: http://wwws.sun.com/software/solaris/pam/
8.13 Authenticating with Kerberos
Problem
You need to authenticate using Kerberos.
Solution
If the client and the server are operating within the same Kerberos realm (or in separate
realms, but cross-realm authentication is possible), you can use the user’s credentials
to authenticate from the client with the server. Both the client and the server
must support this authentication method.
The code presented in this recipe assumes you are using either the Heimdal or the
MIT Kerberos implementation. It further assumes you are using Version 5, which we
consider reasonable because Version 4 has been obsolete for so many years. We do
not cover the Windows interface to Kerberos in this book because of the significant
difference in the API compared to Heimdal and MIT implementations, as well as the
complexity of the SSPI API that is required on Windows. We do, however, present
an equivalent recipe for Windows on the book’s web site.
Discussion
First, we define a structure primarily for convenience. After a successful authentication,
several pieces of information are passed back from the Kerberos API. We store
414 | Chapter 8: Authentication and Key Exchange
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.