NAME

       shishi_tkt_transited_policy_checked_p - API function

SYNOPSIS

       #include <shishi.h>

       int shishi_tkt_transited_policy_checked_p(Shishi_tkt * tkt);

ARGUMENTS

       Shishi_tkt * tkt
                   input variable with ticket info.

DESCRIPTION

       Determine if ticket has been policy checked for transit.

       The  application  server  is  ultimately responsible for accepting or rejecting authentication and SHOULD
       check that only suitably trusted KDCs are relied upon to authenticate a principal.  The  transited  field
       in  the  ticket identifies which realms (and thus which KDCs) were involved in the authentication process
       and an application server would normally check this field. If any of these are untrusted to  authenticate
       the  indicated client principal (probably determined by a realm-based policy), the authentication attempt
       MUST be rejected. The presence of trusted KDCs in this list does not provide any guarantee; an  untrusted
       KDC may have fabricated the list.

       While  the  end  server  ultimately decides whether authentication is valid, the KDC for the end server's
       realm MAY apply a realm specific policy for validating the transited field and accepting credentials  for
       cross-realm  authentication. When the KDC applies such checks and accepts such cross-realm authentication
       it will set the TRANSITED-POLICY-CHECKED flag in the service tickets it issues based on  the  cross-realm
       TGT.   A   client   MAY   request   that   the  KDCs  not  check  the  transited  field  by  setting  the
       DISABLE-TRANSITED-CHECK flag. KDCs are encouraged but not required to honor this flag.

       Application servers MUST either do the transited-realm checks themselves, or reject  cross-realm  tickets
       without TRANSITED-POLICY- CHECKED set.

RETURN VALUE

       Returns non-0 iff transited-policy-checked flag is set in ticket.

REPORTING BUGS

       Report bugs to <bug-shishi@gnu.org>.

COPYRIGHT

       Copyright © 2002-2010 Simon Josefsson.
       Copying  and distribution of this file, with or without modification, are permitted in any medium without
       royalty provided the copyright notice and this notice are preserved.

SEE ALSO

       The full documentation for shishi is maintained as a Texinfo manual.  If the info and shishi programs are
       properly installed at your site, the command

              info shishi

       should give you access to the complete manual.