shishi_tkt_transited_policy_checked_p(3)			      shishi				  shishi_tkt_transited_policy_checked_p(3)

NAME

       shishi_tkt_transited_policy_checked_p - API function

SYNOPSIS

       #include <shishi.h>

       int shishi_tkt_transited_policy_checked_p(Shishi_tkt * tkt);

ARGUMENTS

       Shishi_tkt * tkt
		   input variable with ticket info.

DESCRIPTION

       Determine if ticket has been policy checked for transit.

       The application server is ultimately responsible for accepting or rejecting authentication and SHOULD check that only suitably trusted KDCs
       are relied upon to authenticate a principal.  The transited field in the ticket identifies which realms (and thus which KDCs) were involved
       in  the authentication process and an application server would normally check this field. If any of these are untrusted to authenticate the
       indicated client principal (probably determined by a realm-based policy), the authentication attempt MUST  be  rejected.  The  presence	of
       trusted KDCs in this list does not provide any guarantee; an untrusted KDC may have fabricated the list.

       While the end server ultimately decides whether authentication is valid, the KDC for the end server's realm MAY apply a realm specific pol-
       icy for validating the transited field and accepting credentials for cross-realm authentication. When  the  KDC	applies  such  checks  and
       accepts	such  cross-realm  authentication  it  will  set  the  TRANSITED-POLICY-CHECKED flag in the service tickets it issues based on the
       cross-realm TGT. A client MAY request that the KDCs not check the transited field by setting the  DISABLE-TRANSITED-CHECK  flag.  KDCs  are
       encouraged but not required to honor this flag.

       Application  servers  MUST either do the transited-realm checks themselves, or reject cross-realm tickets without TRANSITED-POLICY- CHECKED
       set.

RETURN VALUE

       Returns non-0 iff transited-policy-checked flag is set in ticket.

REPORTING BUGS

       Report bugs to <bug-shishi@gnu.org>.

COPYRIGHT

       Copyright (C) 2002-2010 Simon Josefsson.
       Copying and distribution of this file, with or without modification, are permitted in any medium without  royalty  provided  the  copyright
       notice and this notice are preserved.

SEE ALSO

       The  full documentation for shishi is maintained as a Texinfo manual.  If the info and shishi programs are properly installed at your site,
       the command

	      info shishi

       should give you access to the complete manual.

shishi								       1.0.1				  shishi_tkt_transited_policy_checked_p(3)