 | This article includes a list ofgeneral references, butit lacks sufficient correspondinginline citations. Please help toimprove this article byintroducing more precise citations.(October 2013) (Learn how and when to remove this message) |
TheGeneric Security Service Application Programming Interface (GSSAPI, alsoGSS-API) is anapplication programming interface for programs to accesssecurity services.
The GSSAPI is anIETF standard that addresses the problem of many similar but incompatible security services in use as of 2005[update].
The GSSAPI, by itself, does not provide any security. Instead, security-service vendors provide GSSAPIimplementations - usually in the form oflibraries installed with their security software. These libraries present a GSSAPI-compatible interface to application writers who can write their application to use only thevendor-independent GSSAPI.If the security implementation ever needs replacing, the application need not be rewritten.
The definitive feature of GSSAPI applications is the exchange of opaque messages (tokens) which hide the implementation detail from the higher-level application.The client and server sides of the application are written to convey the tokens given to them bytheir respective GSSAPI implementations.GSSAPI tokens can usually travel over an insecure network as the mechanisms provide inherent message security.After the exchange of some number of tokens, the GSSAPI implementations at both ends inform their local application that asecurity context is established.
Once a security context is established, sensitive application messages can be wrapped (encrypted) by the GSSAPI for secure communication between client and server.Typical protections guaranteed by GSSAPI wrapping includeconfidentiality (secrecy) andintegrity (authenticity). The GSSAPI can also provide local guarantees about the identity of the remote user or remote host.
The GSSAPI describes about 45 procedure calls. Significant ones include:
The GSSAPI is standardized for theC (RFC 2744) language.Java implements the GSSAPI[1]as JGSS,[2]the Java Generic Security Services Application Program Interface.[3]
Some limitations of GSSAPI are:
Anticipating new security mechanisms, the GSSAPI includes a negotiatingpseudo mechanism,SPNEGO, that can discover and use new mechanisms not present when the original application was built.
The dominant GSSAPI mechanism implementation in use isKerberos.Unlike the GSSAPI, the Kerberos API has not been standardizedand various existing implementations use incompatible APIs.The GSSAPI allows Kerberos implementations to be API compatible.
JGSS is the JAVA implementation of the GSSAPI.
Java Generic Security Services Application Program Interface (JGSS) API for uniform access to security services atop a variety of underlying security mechanism, including Kerberos, which are building blocks for single sign-on and data encryption.
