The Generic Security Service Application Programming Interface (GSSAPI, also GSS-API) is an

application programming interface An application programming interface (API) is a connection between computers or between computer programs. It is a type of software Interface (computing), interface, offering a service to other pieces of software. A document or standard that des ...

for programs to access

security Security is protection from, or resilience against, potential harm (or other unwanted coercion). Beneficiaries (technically referents) of security may be persons and social groups, objects and institutions, ecosystems, or any other entity or ...

services. The GSSAPI is an

IETF The Internet Engineering Task Force (IETF) is a standards organization for the Internet standard, Internet and is responsible for the technical standards that make up the Internet protocol suite (TCP/IP). It has no formal membership roster ...

standard that addresses the problem of many similar but incompatible security services in use .

Operation

The GSSAPI, by itself, does not provide any security. Instead, security-service vendors provide GSSAPI ''implementations'' - usually in the form of

libraries A library is a collection of Book, books, and possibly other Document, materials and Media (communication), media, that is accessible for use by its members and members of allied institutions. Libraries provide physical (hard copies) or electron ...

installed with their security software. These libraries present a GSSAPI-compatible interface to application writers who can write their application to use only the vendor-independent GSSAPI. If the security implementation ever needs replacing, the application need not be rewritten. The definitive feature of GSSAPI applications is the exchange of opaque messages (''tokens'') which hide the implementation detail from the higher-level application. The client and server sides of the application are written to convey the tokens given to them by their respective GSSAPI implementations. GSSAPI tokens can usually travel over an insecure network as the mechanisms provide inherent message security. After the exchange of some number of tokens, the GSSAPI implementations at both ends inform their local application that a ''security context'' is established. Once a security context is established, sensitive application messages can be wrapped (encrypted) by the GSSAPI for secure communication between client and server. Typical protections guaranteed by GSSAPI wrapping include

confidentiality Confidentiality involves a set of rules or a promise sometimes executed through confidentiality agreements that limits the access to or places restrictions on the distribution of certain types of information. Legal confidentiality By law, la ...

(secrecy) and

integrity Integrity is the quality of being honest and having a consistent and uncompromising adherence to strong moral and ethical principles and values. In ethics, integrity is regarded as the honesty and Honesty, truthfulness or of one's actions. Integr ...

(authenticity). The GSSAPI can also provide local guarantees about the identity of the remote user or remote host. The GSSAPI describes about 45 procedure calls. Significant ones include: ; GSS_Acquire_cred: Obtains the user's identity proof, often a secret cryptographic key ; GSS_Import_name: Converts a username or hostname into a form that identifies a security entity ; GSS_Init_sec_context: Generates a client token to send to the server, usually a challenge ; GSS_Accept_sec_context: Processes a token from GSS_Init_sec_context and can generate a response token to return ; GSS_Wrap: Converts application data into a secure message token (typically encrypted) ; GSS_Unwrap: Converts a secure message token back into application data The GSSAPI is standardized for the C (RFC 2744) language.

Java Java is one of the Greater Sunda Islands in Indonesia. It is bordered by the Indian Ocean to the south and the Java Sea (a part of Pacific Ocean) to the north. With a population of 156.9 million people (including Madura) in mid 2024, proje ...

implements the GSSAPI as JGSS, the Java Generic Security Services Application Program Interface. Some limitations of GSSAPI are: # standardizing only

authentication Authentication (from ''authentikos'', "real, genuine", from αὐθέντης ''authentes'', "author") is the act of proving an Logical assertion, assertion, such as the Digital identity, identity of a computer system user. In contrast with iden ...

, rather not

authorization Authorization or authorisation (see American and British English spelling differences#-ise, -ize (-isation, -ization), spelling differences), in information security, computer security and identity management, IAM (Identity and Access Managemen ...

too; # assuming a client–server architecture. Anticipating new security mechanisms, the GSSAPI includes a negotiating ''pseudo mechanism'', SPNEGO, that can discover and use new mechanisms not present when the original application was built.

Relationship to Kerberos

The dominant GSSAPI mechanism implementation in use is Kerberos. Unlike the GSSAPI, the Kerberos API has not been standardized and various existing implementations use incompatible APIs. The GSSAPI allows Kerberos implementations to be API compatible.

Related technologies

RADIUS In classical geometry, a radius (: radii or radiuses) of a circle or sphere is any of the line segments from its Centre (geometry), center to its perimeter, and in more modern usage, it is also their length. The radius of a regular polygon is th ...

* SASL * TLS *

SSPI Security Support Provider Interface (SSPI) is a component of Windows API that performs security-related operations such as authentication. SSPI functions as a common interface to several Security Support Providers (SSPs): A Security Support Provi ...

* SPNEGO * RPCSEC GSS

Key concepts

;Name :A binary string that labels a security principal (i.e., user or service program) - see

access control In physical security and information security, access control (AC) is the action of deciding whether a subject should be granted or denied access to an object (for example, a place or a resource). The act of ''accessing'' may mean consuming ...

and identity. For example, Kerberos uses names like ''user@REALM'' for users and ''service/hostname@REALM'' for programs. ;

Credential A credential is a piece of any document that details a qualification, competence, or authority issued to an individual by a third party with a relevant or ''de facto'' authority or assumed competence to do so. Examples of credentials include aca ...

s :Information that proves an identity; used by an entity to act as the named principal. Credentials typically involve a secret cryptographic key. ;Context :The state of one end of the authenticating/authenticated protocol. May provide message protection services, which can be used to compose a

secure channel In cryptography, a secure channel is a means of data transmission that is resistant to overhearing and tampering. A confidential channel is a means of data transmission that is resistant to overhearing, or eavesdropping (e.g., reading the conten ...

. ;Tokens :Opaque messages exchanged either as part of the initial authentication protocol (context-level tokens), or as part of a protected communication (per-message tokens) ;Mechanism :An underlying GSSAPI implementation that provides actual names, tokens and credentials. Known mechanisms include Kerberos,

NTLM In a Windows network, NT (New Technology) LAN Manager (NTLM) is a suite of Microsoft security protocols intended to provide authentication, integrity, and confidentiality to users. NTLM is the successor to the authentication protocol in Microsoft ...

, Distributed Computing Environment (DCE), SESAME, SPKM, LIPKEY. ;Initiator/acceptor :The peer that sends the first token is the initiator; the other is the acceptor. Generally, the client program is the initiator while the server is the acceptor.

History

* July 1991: IETF Common Authentication Technology (CAT) Working Group meets in Atlanta, led by John Linn * September 1993: GSSAPI version 1 (RFC 1508, RFC 1509) * May 1995: Windows NT 3.51 released, includes SSPI * June 1996: Kerberos mechanism for GSSAPI (RFC 1964) * January 1997: GSSAPI version 2 (RFC 2078) * October 1997: SASL published, includes GSSAPI mechanism (RFC 2222) * January 2000: GSSAPI version 2 update 1 (RFC 2743, RFC 2744) * August 2004: KITTEN working group meets to continue CAT activities * May 2006: Secure Shell use of GSSAPI standardised (RFC 4462)

References

External links

* The Generic Security Service API Version 2 update 1 * The Generic Security Service API Version 2: C-Bindings * The Kerberos 5 GSS-API mechanism * The Kerberos 5 GSS-API mechanism: Version 2 * The Simple and Protected GSS-API Negotiation Mechanism (SPNEGO) * The Simple Public-Key GSS-API Mechanism (SPKM) * LIPKEY - A Low Infrastructure Public Key Mechanism Using SPKM * * * {{Authentication APIs Operating system security Internet Standards