169  *   1. Get a TGT for the service principal's realm (STATE_GET_TGT).
171  *   3. In some cases, get a TGT for the fallback realm (STATE_GET_TGT again).
176  * after successfully obtaining the TGT, and the end_get_tgt() function
185     STATE_GET_TGT,              /* Getting TGT for service realm */
186     STATE_GET_TGT_OFFPATH,      /* Getting TGT via off-path referrals */
202     krb5_data start_realm;      /* Realm of starting TGT in ccache */
210     krb5_creds *cur_tgt;        /* TGT to be used for next query */
214     krb5_principal tgt_princ;   /* Storage for TGT principal */
215     krb5_creds tgt_in_creds;    /* Container for TGT matching creds */
319 /* Set up a request for a TGT for realm, using ctx->cur_tgt. */
326     /* Construct the principal krbtgt/<realm>@<cur-tgt-realm>. */  in make_request_for_tgt()
371      * a TGT.  We'll ask again with context enctypes if we get the actual  in make_request_for_service()
528     /* If the fallback realm isn't any different, use the existing TGT. */  in try_fallback()
540     /* Obtain a TGT for the new service realm. */  in try_fallback()
593     /* Active Directory may return a TGT to the local realm.  Try a  in step_referrals()
602         /* The authdata in this TGT will be copied into subsequent TGTs or the  in step_referrals()
619     /* Use the referral TGT for the next request. */  in step_referrals()
637  * Begin the referrals request loop.  Expects ctx->cur_tgt to be a TGT for
657  * Foreign TGT acquisition can happen either before the referrals loop, if the
673  * the KDCs in the expected path, a TGT for a realm not in the path.  This may
675  * it happens, we repeatedly ask the KDC of the TGT we have for a destination
676  * realm TGT, until we get it, fail, or give up.
690     /* Verify that we got a TGT. */  in step_get_tgt_offpath()
694     /* Use this tgt for the next request. */  in step_get_tgt_offpath()
708         /* We received the server realm TGT we asked for. */  in step_get_tgt_offpath()
731  * To obtain a foreign TGT, we first construct a path of realms R1..Rn between
738  * TGT for next_realm; if not, we ask cur_realm to give us a TGT for
741  * we can, and have to give up.  If we do get back a TGT, it may or may not be
743  * the TGT we get back becomes cur_realm, and next_realm is reset to the target
748  * In some cases we may get back a TGT for a realm not in the path.  In that
754  * cross-realm TGT for realm retrieved from ctx->ccache.  Accept any issuing
755  * realm (i.e. match only the service principal name).  If the TGT is not found
775     /* Construct the TGT principal name (the realm part doesn't matter). */  in get_cached_tgt()
787     /* Fetch the TGT credential. */  in get_cached_tgt()
796  * TGT retrieved from ctx->ccache. */
806     krb5_creds *tgt;  in get_cached_local_tgt()  local
825     /* Fetch the TGT credential. */  in get_cached_local_tgt()
827     code = cache_get(context, ctx->ccache, flags, &mcreds, &tgt);  in get_cached_local_tgt()
833     /* Check if the TGT is expired before bothering the KDC with it. */  in get_cached_local_tgt()
834     if (ts_after(now, tgt->times.endtime)) {  in get_cached_local_tgt()
835         krb5_free_creds(context, tgt);  in get_cached_local_tgt()
839     *tgt_out = tgt;  in get_cached_local_tgt()
843 /* Initialize the realm path fields for getting a TGT for
885  * Generate the next request in the path traversal.  If a cached TGT for the
886  * target realm appeared in the ccache since we started the TGT acquisition
896         /* Check if we have a cached TGT for the target realm. */  in get_tgt_request()
916 /* Process a TGS reply and advance the path traversal to get a foreign TGT. */
934         /* Verify that we got a TGT. */  in step_get_tgt()
938         /* Use this tgt for the next request regardless of what it is. */  in step_get_tgt()
952             /* Only cache the TGT if we asked for it, to avoid duplicates. */  in step_get_tgt()
956                 /* We received a TGT for the target realm. */  in step_get_tgt()
980  * Begin the process of getting a foreign TGT, either for the explicitly
982  * ctx->server->realm is the realm of the desired TGT, and that
984  * desired TGT.
997         /* See if we have a cached TGT for the server realm. */  in begin_get_tgt()
1009     /* Start with the local tgt. */  in begin_get_tgt()
1074     /* If the server realm is unspecified, start with the TGT realm. */  in begin()
1085     /* Obtain a TGT for the service realm. */  in begin()