<!--
{
  "documentType" : "article",
  "framework" : "GSS",
  "identifier" : "/documentation/GSS/context-services",
  "metadataVersion" : "0.1.0",
  "role" : "collectionGroup",
  "title" : "Context Services"
}
-->

# Context Services

Use context services to manage secure operations between endpoints.

## Discussion

You use these flags as input to [`gss_init_sec_context(_:_:_:_:_:_:_:_:_:_:_:_:_:)`](/documentation/GSS/gss_init_sec_context(_:_:_:_:_:_:_:_:_:_:_:_:_:)) to request certain context services. You also receive them as output from both that function and [`gss_accept_sec_context(_:_:_:_:_:_:_:_:_:_:_:)`](/documentation/GSS/gss_accept_sec_context(_:_:_:_:_:_:_:_:_:_:_:)), indicating which services are actually engaged. Requesting a service does not guarantee its availability.

Because these flags represent the bits of an integer, you combine them with a bitwise `OR` and pull them apart using bitwise `AND`, as shown below.

```objc
OM_uint32 req_flags = GSS_C_DELEG_FLAG | GSS_C_MUTUAL_FLAG;
OM_uint32 ret_flags = 0;
//
// Call gss_init_sec_context() with req_flags; get ret_flags back
//
BOOL deleg  = (ret_flags & GSS_C_DELEG_FLAG)  ? YES : NO;
BOOL mutual = (ret_flags & GSS_C_MUTUAL_FLAG) ? YES : NO;
```

## Topics

### Flags

[`GSS_C_DELEG_FLAG`](/documentation/GSS/GSS_C_DELEG_FLAG)

A flag that permits delegation of the initiator’s credentials by the acceptor.

[`GSS_C_MUTUAL_FLAG`](/documentation/GSS/GSS_C_MUTUAL_FLAG)

A flag that authenticates the credentials of both initiator and acceptor.

[`GSS_C_REPLAY_FLAG`](/documentation/GSS/GSS_C_REPLAY_FLAG)

A flag that detects repeated messages.

[`GSS_C_SEQUENCE_FLAG`](/documentation/GSS/GSS_C_SEQUENCE_FLAG)

A flag that detects out of sequence messages.

[`GSS_C_CONF_FLAG`](/documentation/GSS/GSS_C_CONF_FLAG)

A flag that makes confidentiality services (that is, encryption) available for transferred messages.

[`GSS_C_INTEG_FLAG`](/documentation/GSS/GSS_C_INTEG_FLAG)

A flag that makes integrity services (that is, cryptographic signatures) available for transferred messages.

[`GSS_C_ANON_FLAG`](/documentation/GSS/GSS_C_ANON_FLAG)

A flag that ensures the initiator remains anonymous to the acceptor.

[`GSS_C_PROT_READY_FLAG`](/documentation/GSS/GSS_C_PROT_READY_FLAG)

A flag that provides an early indication of the availability of confidentiality and integrity services.

[`GSS_C_TRANS_FLAG`](/documentation/GSS/GSS_C_TRANS_FLAG)

A flag that indicates that a context can is exportable, for example to transfer it to another process on the same machine.

[`GSS_C_DCE_STYLE`](/documentation/GSS/GSS_C_DCE_STYLE)

A flag that causes an extra AP reply to be sent from the client back to the server after receiving the server’s AP reply.

[`GSS_C_IDENTIFY_FLAG`](/documentation/GSS/GSS_C_IDENTIFY_FLAG)

A flag that indicates identification of the client by name and ID only.

[`GSS_C_EXTENDED_ERROR_FLAG`](/documentation/GSS/GSS_C_EXTENDED_ERROR_FLAG)

A flag that indicates that the client wants to be informed of extended error information.

[`GSS_C_DELEG_POLICY_FLAG`](/documentation/GSS/GSS_C_DELEG_POLICY_FLAG)

A flag that indicates delegation is permissible if the mechanism policy allows it.

### Address Families

The constant definitions for channel-binding address families.

[`GSS_C_AF_NS`](/documentation/GSS/GSS_C_AF_NS)

The Xerox NS address type.

[`GSS_C_AF_BSC`](/documentation/GSS/GSS_C_AF_BSC)

The BISYNC 2780/3780 address type.

[`GSS_C_AF_DLI`](/documentation/GSS/GSS_C_AF_DLI)

The direct data link interface address type.

[`GSS_C_AF_DSS`](/documentation/GSS/GSS_C_AF_DSS)

The distributed system services address type.

[`GSS_C_AF_LAT`](/documentation/GSS/GSS_C_AF_LAT)

The LAT address type.

[`GSS_C_AF_NBS`](/documentation/GSS/GSS_C_AF_NBS)

The nbs address type.

[`GSS_C_AF_OSI`](/documentation/GSS/GSS_C_AF_OSI)

The OSI TP4 address type.

[`GSS_C_AF_PUP`](/documentation/GSS/GSS_C_AF_PUP)

The PUP protocols (for example, BSP) address type.

[`GSS_C_AF_SNA`](/documentation/GSS/GSS_C_AF_SNA)

The IBM SNA address type.

[`GSS_C_AF_X25`](/documentation/GSS/GSS_C_AF_X25)

The X.25 address type.

[`GSS_C_AF_ECMA`](/documentation/GSS/GSS_C_AF_ECMA)

The ECMA address type.

[`GSS_C_AF_INET`](/documentation/GSS/GSS_C_AF_INET)

The Internet (for example, IP) address type.

[`GSS_C_AF_CCITT`](/documentation/GSS/GSS_C_AF_CCITT)

The CCITT protocols address type.

[`GSS_C_AF_CHAOS`](/documentation/GSS/GSS_C_AF_CHAOS)

The MIT CHAOS protocol address type.

[`GSS_C_AF_INET6`](/documentation/GSS/GSS_C_AF_INET6)

The IPv6 address type.

[`GSS_C_AF_LOCAL`](/documentation/GSS/GSS_C_AF_LOCAL)

The host-local address type.

[`GSS_C_AF_DECnet`](/documentation/GSS/GSS_C_AF_DECnet)

The DECnet address type.

[`GSS_C_AF_HYLINK`](/documentation/GSS/GSS_C_AF_HYLINK)

The NSC Hyperchannel address type.

[`GSS_C_AF_UNSPEC`](/documentation/GSS/GSS_C_AF_UNSPEC)

The unspecified address type.

[`GSS_C_AF_DATAKIT`](/documentation/GSS/GSS_C_AF_DATAKIT)

The datakit protocols address type.

[`GSS_C_AF_IMPLINK`](/documentation/GSS/GSS_C_AF_IMPLINK)

ARPAnet IMP address type.

[`GSS_C_AF_NULLADDR`](/documentation/GSS/GSS_C_AF_NULLADDR)

No address specified.

[`GSS_C_AF_APPLETALK`](/documentation/GSS/GSS_C_AF_APPLETALK)

The AppleTalk address type.

### Apple Source App Keys

The keys used in the dictionary specified by the [`kGSSICAppleSourceApp`](/documentation/GSS/kGSSICAppleSourceApp)

The value is a dictionary indicating attributes of the app that the credential is for (only applies to AppVPN). key.

[`kGSSICAppleSourceAppPID`](/documentation/GSS/kGSSICAppleSourceAppPID)

A number that indicates the process ID of the app.

[`kGSSICAppleSourceAppAuditToken`](/documentation/GSS/kGSSICAppleSourceAppAuditToken)

The audit token of the app’s process.

[`kGSSICAppleSourceAppSigningIdentity`](/documentation/GSS/kGSSICAppleSourceAppSigningIdentity)

The bundle signing identity of the app.

### Channel Bindings

[`GSS_C_NO_CHANNEL_BINDINGS`](/documentation/GSS/GSS_C_NO_CHANNEL_BINDINGS)

Indicates a `NULL` [`gss_channel_bindings_t`](/documentation/GSS/gss_channel_bindings_t) object.

[`GSS_C_NO_CONTEXT`](/documentation/GSS/GSS_C_NO_CONTEXT)

A macro that indicates an empty context id object.

[`gss_const_ctx_id_t`](/documentation/GSS/gss_const_ctx_id_t)

A pointer to an immutable opaque type that you use to communicate context pointers with GSS-API functions.

[`gss_ctx_id_t`](/documentation/GSS/gss_ctx_id_t)

A pointer to an opaque type that you use to communicate context pointers with GSS-API functions.

[`gss_channel_bindings_struct`](/documentation/GSS/gss_channel_bindings_struct)

The structure defining a channel bindings descriptor that specifies the communications channel used to carry a context.

[`gss_channel_bindings_t`](/documentation/GSS/gss_channel_bindings_t)

A pointer to a channel bindings descriptor that specifies the communications channel used to carry a context.

[`gss_const_channel_bindings_t`](/documentation/GSS/gss_const_channel_bindings_t)

A pointer to an immutable channel bindings descriptor that you use to specify the communications channel used to carry a context.

### Creation and Deletion

[`gss_init_sec_context`](/documentation/GSS/gss_init_sec_context(_:_:_:_:_:_:_:_:_:_:_:_:_:))

Initiates a security context with a peer.

[`gss_accept_sec_context`](/documentation/GSS/gss_accept_sec_context(_:_:_:_:_:_:_:_:_:_:_:))

Accepts a security context initiated by a peer.

[`gss_delete_sec_context`](/documentation/GSS/gss_delete_sec_context(_:_:_:))

Deletes a security context.

[`gss_release_cred`](/documentation/GSS/gss_release_cred(_:_:))

Releases the memory of a credential.

[`gss_process_context_token`](/documentation/GSS/gss_process_context_token(_:_:_:))

Processes a token from a peer asynchronously.

[`gss_set_sec_context_option`](/documentation/GSS/gss_set_sec_context_option(_:_:_:_:))

Sets an option on a context.

### Inquiry and Limits

[`gss_context_time`](/documentation/GSS/gss_context_time(_:_:_:))

Returns the amount of time remaining before a context expires.

[`gss_inquire_context`](/documentation/GSS/gss_inquire_context(_:_:_:_:_:_:_:_:_:))

Returns information about a security context.

[`gss_inquire_sec_context_by_oid`](/documentation/GSS/gss_inquire_sec_context_by_oid(_:_:_:_:))

Returns information about a particular part of a context.

[`gss_wrap_size_limit`](/documentation/GSS/gss_wrap_size_limit(_:_:_:_:_:_:))

Returns the largest allowable wrap size for a given set of constraints.

### Import and Export

[`gss_export_sec_context`](/documentation/GSS/gss_export_sec_context(_:_:_:))

Transfers a security context to another process.

[`gss_import_sec_context`](/documentation/GSS/gss_import_sec_context(_:_:_:))

Imports a security context from another process.


---

Copyright &copy; 2026 Apple Inc. All rights reserved. | [Terms of Use](https://www.apple.com/legal/internet-services/terms/site.html) | [Privacy Policy](https://www.apple.com/privacy/privacy-policy)