OSF DCE Application Development Guide--Core Components

OSF DCE Application Development Guide—Core Components
sequence, the routine uses the rpc_c_protect_level_pkt level instead.
rpc_c_protect_level_pkt
Ensures that all data received is from the expected client. This level
attaches a verifier to each message.
rpc_c_protect_level_pkt_integrity
Ensures and verifies that none of the data transferred between client and
server has been modified. This level computes a cryptographic
checksum of each message to verify that none of the data transferred
between the client and server has been modified in transit.
This is the highest protection level that is guaranteed to be present in the
RPC runtime.
rpc_c_protect_level_pkt_privacy
Performs protection as specified by all of the previous levels and also
encrypts each remote procedure call argument and return values. This
level encrypts all user data in each call.
This is the highest protection level, but it may not be available in the
RPC runtime.
If a client wants to use the default protection level but does not know what this level is,
it can use the rpc_mgmt_inq_dflt_protect_level() routine to determine what the
default level is.
14.2.2 Authorization
Authorization is the process of checking a client’s permissions to an object that is
controlled by the server. Access checking is entirely a server responsibility and involves
matching the client’s credentials against the permissions associated with the object. A
client’s credentials consist of the principal ID and group memberships contained in the
client’s network login context.
Authenticated RPC supports the following options for making client authorization
information available to servers for access checking:
rpc_c_authz_none
No authorization information is provided to the server, usually because
the server does not perform access checking.
rpc_c_authz_name
Only the client principal name is provided to the server. The server can
then perform authorization based on the provided name. This form of
authorization is sometimes referred to as name-based authorization.
rpc_c_authz_dce
The client’s credentials (DCE Privilege Attribute Certificate or PAC) is
provided to the server with each remote procedure call that is made
using the binding parameter. The server performs authorization by using
the client credentials. Generally, access is checked against DCE ACLs.
14 − 10 Tandem Computers Incorporated 124245