This transfer of rights is termed delegation, and is achieved by creating a set of credentials, similar to those used by the originating application, but which may be used by the responder. The routines are listed in figure 4-1. Applications are encouraged to use the generic routines wherever possible on portability grounds. The length field contains the number of bytes in this value. In particular, the application should not attempt to deallocate them.
Credentials describe a principal, and they give their holder the ability to act as that principal.
Thus the credential handle contains no security-relavent information, and requires no special protection by the application. Certain routines allow credential handle parameters to be omitted to indicate the use of a default credential. It may be implemented as either an arithmetic or a pointer type. The security context holds state information about each end of a peer communication, including cryptographic state information. Two distinct sorts of status codes are returned.