kuser/klist.c

   1 /*
   2  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kuser_locl.h"
  37 #include "parse_units.h"
  38 #include "heimtools-commands.h"
  39 #undef HC_DEPRECATED_CRYPTO
  40
  41 static char*
  42 printable_time_internal(time_t t, int x)
  43 {
  44     static char s[128];
  45     char *p;
  46
  47     if ((p = ctime(&t)) == NULL)
  48         strlcpy(s, "?", sizeof(s));
  49     else
  50         strlcpy(s, p + 4, sizeof(s));
  51     s[x] = 0;
  52     return s;
  53 }
  54
  55 static char*
  56 printable_time(time_t t)
  57 {
  58     return printable_time_internal(t, 20);
  59 }
  60
  61 static char*
  62 printable_time_long(time_t t)
  63 {
  64     return printable_time_internal(t, 20);
  65 }
  66
  67 #define COL_ISSUED              NP_("  Issued","")
  68 #define COL_EXPIRES             NP_("  Expires", "")
  69 #define COL_FLAGS               NP_("Flags", "")
  70 #define COL_NAME                NP_("  Name", "")
  71 #define COL_PRINCIPAL           NP_("  Principal", "in klist output")
  72 #define COL_PRINCIPAL_KVNO      NP_("  Principal (kvno)", "in klist output")
  73 #define COL_CACHENAME           NP_("  Cache name", "name in klist output")
  74 #define COL_DEFCACHE            NP_("", "")
  75
  76 static void
  77 print_cred(krb5_context context, krb5_creds *cred, rtbl_t ct, int do_flags)
  78 {
  79     char *str;
  80     krb5_error_code ret;
  81     krb5_timestamp sec;
  82
  83     krb5_timeofday (context, &sec);
  84
  85
  86     if(cred->times.starttime)
  87         rtbl_add_column_entry(ct, COL_ISSUED,
  88                               printable_time(cred->times.starttime));
  89     else
  90         rtbl_add_column_entry(ct, COL_ISSUED,
  91                               printable_time(cred->times.authtime));
  92
  93     if(cred->times.endtime > sec)
  94         rtbl_add_column_entry(ct, COL_EXPIRES,
  95                               printable_time(cred->times.endtime));
  96     else
  97         rtbl_add_column_entry(ct, COL_EXPIRES, N_(">>>Expired<<<", ""));
  98     ret = krb5_unparse_name (context, cred->server, &str);
  99     if (ret)
 100         krb5_err(context, 1, ret, "krb5_unparse_name");
 101     rtbl_add_column_entry(ct, COL_PRINCIPAL, str);
 102     if(do_flags) {
 103         char s[16], *sp = s;
 104         if(cred->flags.b.forwardable)
 105             *sp++ = 'F';
 106         if(cred->flags.b.forwarded)
 107             *sp++ = 'f';
 108         if(cred->flags.b.proxiable)
 109             *sp++ = 'P';
 110         if(cred->flags.b.proxy)
 111             *sp++ = 'p';
 112         if(cred->flags.b.may_postdate)
 113             *sp++ = 'D';
 114         if(cred->flags.b.postdated)
 115             *sp++ = 'd';
 116         if(cred->flags.b.renewable)
 117             *sp++ = 'R';
 118         if(cred->flags.b.initial)
 119             *sp++ = 'I';
 120         if(cred->flags.b.invalid)
 121             *sp++ = 'i';
 122         if(cred->flags.b.pre_authent)
 123             *sp++ = 'A';
 124         if(cred->flags.b.hw_authent)
 125             *sp++ = 'H';
 126         if(cred->flags.b.transited_policy_checked)
 127             *sp++ = 'T';
 128         if(cred->flags.b.ok_as_delegate)
 129             *sp++ = 'O';
 130         if(cred->flags.b.anonymous)
 131             *sp++ = 'a';
 132         *sp = '\0';
 133         rtbl_add_column_entry(ct, COL_FLAGS, s);
 134     }
 135     free(str);
 136 }
 137
 138 static void
 139 print_cred_verbose(krb5_context context, krb5_creds *cred, int do_json)
 140 {
 141     size_t j;
 142     char *str;
 143     krb5_error_code ret;
 144     krb5_timestamp sec;
 145
 146     if (do_json) { /* XXX support more json formating later */
 147         printf("{ \"verbose-supported\" : false }");
 148         return;
 149     }
 150
 151     krb5_timeofday (context, &sec);
 152
 153     ret = krb5_unparse_name(context, cred->server, &str);
 154     if(ret)
 155         exit(1);
 156     printf(N_("Server: %s\n", ""), str);
 157     free (str);
 158
 159     ret = krb5_unparse_name(context, cred->client, &str);
 160     if(ret)
 161         exit(1);
 162     printf(N_("Client: %s\n", ""), str);
 163     free (str);
 164
 165     if (krb5_is_config_principal(context, cred->server)) {
 166         if (krb5_principal_get_num_comp(context, cred->server) > 1) {
 167             const char *s;
 168
 169             /* If the payload is text and not secret/sensitive, print it */
 170             s = krb5_principal_get_comp_string(context, cred->server, 1);
 171             if (strcmp(s, "start_realm") == 0 ||
 172                 strcmp(s, "anon_pkinit_realm") == 0 ||
 173                 strcmp(s, "default-ntlm-domain") == 0 ||
 174                 strcmp(s, "FriendlyName") == 0 ||
 175                 strcmp(s, "fast_avail") == 0 ||
 176                 strcmp(s, "kx509store") == 0 ||
 177                 strcmp(s, "kx509_service_realm") == 0 ||
 178                 strcmp(s, "kx509_service_status") == 0)
 179                 printf(N_("Configuration item payload: %.*s\n", ""),
 180                        (int)cred->ticket.length,
 181                        (const char *)cred->ticket.data);
 182             else
 183                 printf(N_("Configuration item payload length: %lu\n", ""),
 184                        (unsigned long)cred->ticket.length);
 185         } /* else... this is a meaningless entry; nothing would create it */
 186     } else {
 187         Ticket t;
 188         size_t len;
 189         char *s;
 190
 191         decode_Ticket(cred->ticket.data, cred->ticket.length, &t, &len);
 192         ret = krb5_enctype_to_string(context, t.enc_part.etype, &s);
 193         printf(N_("Ticket etype: ", ""));
 194         if (ret == 0) {
 195             printf("%s", s);
 196             free(s);
 197         } else {
 198             printf(N_("unknown-enctype(%d)", ""), t.enc_part.etype);
 199         }
 200         if(t.enc_part.kvno)
 201             printf(N_(", kvno %d", ""), *t.enc_part.kvno);
 202         printf("\n");
 203         if(cred->session.keytype != t.enc_part.etype) {
 204             ret = krb5_enctype_to_string(context, cred->session.keytype, &str);
 205             if(ret)
 206                 krb5_warn(context, ret, "session keytype");
 207             else {
 208                 printf(N_("Session key: %s\n", "enctype"), str);
 209                 free(str);
 210             }
 211         }
 212         free_Ticket(&t);
 213         printf(N_("Ticket length: %lu\n", ""),
 214                (unsigned long)cred->ticket.length);
 215         printf(N_("Auth time:  %s\n", ""),
 216                printable_time_long(cred->times.authtime));
 217         if(cred->times.authtime != cred->times.starttime)
 218             printf(N_("Start time: %s\n", ""),
 219                    printable_time_long(cred->times.starttime));
 220         printf(N_("End time:   %s", ""),
 221                printable_time_long(cred->times.endtime));
 222         if(sec > cred->times.endtime)
 223             printf(N_(" (expired)", ""));
 224         printf("\n");
 225         if(cred->flags.b.renewable)
 226             printf(N_("Renew till: %s\n", ""),
 227                    printable_time_long(cred->times.renew_till));
 228         {
 229             char flags[1024];
 230             int result = unparse_flags(TicketFlags2int(cred->flags.b),
 231                                        asn1_TicketFlags_units(),
 232                                        flags, sizeof(flags));
 233             if (result > 0) {
 234                 printf(N_("Ticket flags: %s\n", ""), flags);
 235             }
 236         }
 237         printf(N_("Addresses: ", ""));
 238         if (cred->addresses.len != 0) {
 239             for(j = 0; j < cred->addresses.len; j++){
 240                 char buf[128];
 241                 if(j) printf(", ");
 242                 ret = krb5_print_address(&cred->addresses.val[j],
 243                                          buf, sizeof(buf), &len);
 244
 245                 if(ret == 0)
 246                     printf("%s", buf);
 247             }
 248         } else {
 249             printf(N_("addressless", ""));
 250         }
 251     }
 252     printf("\n\n");
 253 }
 254
 255 /*
 256  * Print all tickets in `ccache' on stdout, verbosely if do_verbose.
 257  */
 258
 259 static void
 260 print_tickets(krb5_context context,
 261               krb5_ccache ccache,
 262               krb5_principal principal,
 263               int do_verbose,
 264               int do_flags,
 265               int do_hidden,
 266               int do_json)
 267 {
 268     char *str, *name, *fullname;
 269     krb5_error_code ret;
 270     krb5_cc_cursor cursor;
 271     krb5_creds creds;
 272     krb5_deltat sec;
 273     rtbl_t ct = NULL;
 274     int print_comma = 0;
 275
 276     ret = krb5_unparse_name (context, principal, &str);
 277     if (ret)
 278         krb5_err (context, 1, ret, "krb5_unparse_name");
 279
 280     ret = krb5_cc_get_full_name(context, ccache, &fullname);
 281     if (ret)
 282         krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 283
 284     if (!do_json) {
 285         printf ("%17s: %s\n", N_("Credentials cache", ""), fullname);
 286         printf ("%17s: %s\n", N_("Principal", ""), str);
 287
 288         ret = krb5_cc_get_friendly_name(context, ccache, &name);
 289         if (ret == 0) {
 290             if (strcmp(name, str) != 0)
 291                 printf ("%17s: %s\n", N_("Friendly name", ""), name);
 292             free(name);
 293         }
 294
 295         if(do_verbose) {
 296             printf ("%17s: %d\n", N_("Cache version", ""),
 297                     krb5_cc_get_version(context, ccache));
 298         } else {
 299             krb5_cc_set_flags(context, ccache, KRB5_TC_NOTICKET);
 300         }
 301
 302         ret = krb5_cc_get_kdc_offset(context, ccache, &sec);
 303
 304         if (ret == 0 && do_verbose && sec != 0) {
 305             char buf[BUFSIZ];
 306             int val;
 307             int sig;
 308
 309             val = (int)sec;
 310             sig = 1;
 311             if (val < 0) {
 312                 sig = -1;
 313                 val = -val;
 314             }
 315
 316             unparse_time (val, buf, sizeof(buf));
 317
 318             printf ("%17s: %s%s\n", N_("KDC time offset", ""),
 319                     sig == -1 ? "-" : "", buf);
 320         }
 321         printf("\n");
 322     } else {
 323         printf ("{ \"cache\" : \"%s\", \"principal\" : \"%s\", ", fullname, str);
 324     }
 325     free(str);
 326
 327     ret = krb5_cc_start_seq_get (context, ccache, &cursor);
 328     if (ret)
 329         krb5_err(context, 1, ret, "krb5_cc_start_seq_get");
 330
 331     if(!do_verbose) {
 332         ct = rtbl_create();
 333         rtbl_add_column(ct, COL_ISSUED, 0);
 334         rtbl_add_column(ct, COL_EXPIRES, 0);
 335         if(do_flags)
 336             rtbl_add_column(ct, COL_FLAGS, 0);
 337         rtbl_add_column(ct, COL_PRINCIPAL, 0);
 338         rtbl_set_separator(ct, "  ");
 339         if (do_json) {
 340             rtbl_set_flags(ct, RTBL_JSON);
 341             printf("\"tickets\" : ");
 342         }
 343     }
 344     if (do_verbose && do_json)
 345         printf("\"tickets\" : [");
 346     while ((ret = krb5_cc_next_cred(context, ccache, &cursor, &creds)) == 0) {
 347         if (!do_hidden && krb5_is_config_principal(context, creds.server)) {
 348             ;
 349         } else if (do_verbose) {
 350             if (do_json && print_comma)
 351                 printf(",");
 352             print_cred_verbose(context, &creds, do_json);
 353             print_comma = 1;
 354         } else {
 355             print_cred(context, &creds, ct, do_flags);
 356         }
 357         krb5_free_cred_contents(context, &creds);
 358     }
 359     if (ret != KRB5_CC_END)
 360         krb5_err(context, 1, ret, "krb5_cc_get_next");
 361     ret = krb5_cc_end_seq_get (context, ccache, &cursor);
 362     if (ret)
 363         krb5_err(context, 1, ret, "krb5_cc_end_seq_get");
 364
 365     print_comma = 0;
 366     if(!do_verbose) {
 367         rtbl_format(ct, stdout);
 368         rtbl_destroy(ct);
 369     }
 370     if (do_json) {
 371         if (do_verbose)
 372             printf("]");
 373         printf("}");
 374     }
 375     free(fullname);
 376 }
 377
 378 /*
 379  * Check if there's a tgt for the realm of `principal' and ccache and
 380  * if so return 0, else 1
 381  */
 382
 383 static int
 384 check_expiration(krb5_context context,
 385                  krb5_ccache ccache,
 386                  time_t *expiration)
 387 {
 388     krb5_error_code ret;
 389     time_t t;
 390
 391     ret = krb5_cc_get_lifetime(context, ccache, &t);
 392     if (ret || t == 0)
 393         return 1;
 394
 395     if (expiration)
 396         *expiration = time(NULL) + t;
 397
 398     return 0;
 399 }
 400
 401 /*
 402  * Print a list of all AFS tokens
 403  */
 404
 405 #ifndef NO_AFS
 406
 407 static void
 408 display_tokens(int do_verbose)
 409 {
 410     uint32_t i;
 411     unsigned char t[4096];
 412     struct ViceIoctl parms;
 413
 414     parms.in = (void *)&i;
 415     parms.in_size = sizeof(i);
 416     parms.out = (void *)t;
 417     parms.out_size = sizeof(t);
 418
 419     for (i = 0;; i++) {
 420         int32_t size_secret_tok, size_public_tok;
 421         unsigned char *cell;
 422         struct ClearToken ct;
 423         unsigned char *r = t;
 424         struct timeval tv;
 425         char buf1[20], buf2[20];
 426
 427         if(k_pioctl(NULL, VIOCGETTOK, &parms, 0) < 0) {
 428             if(errno == EDOM)
 429                 break;
 430             continue;
 431         }
 432         if(parms.out_size > sizeof(t))
 433             continue;
 434         if(parms.out_size < sizeof(size_secret_tok))
 435             continue;
 436         t[min(parms.out_size,sizeof(t)-1)] = 0;
 437         memcpy(&size_secret_tok, r, sizeof(size_secret_tok));
 438         /* don't bother about the secret token */
 439         r += size_secret_tok + sizeof(size_secret_tok);
 440         if (parms.out_size < (r - t) + sizeof(size_public_tok))
 441             continue;
 442         memcpy(&size_public_tok, r, sizeof(size_public_tok));
 443         r += sizeof(size_public_tok);
 444         if (parms.out_size < (r - t) + size_public_tok + sizeof(int32_t))
 445             continue;
 446         memcpy(&ct, r, size_public_tok);
 447         r += size_public_tok;
 448         /* there is a int32_t with length of cellname, but we don't read it */
 449         r += sizeof(int32_t);
 450         cell = r;
 451
 452         gettimeofday (&tv, NULL);
 453         strlcpy (buf1, printable_time(ct.BeginTimestamp),
 454                  sizeof(buf1));
 455         if (do_verbose || tv.tv_sec < ct.EndTimestamp)
 456             strlcpy (buf2, printable_time(ct.EndTimestamp),
 457                      sizeof(buf2));
 458         else
 459             strlcpy (buf2, N_(">>> Expired <<<", ""), sizeof(buf2));
 460
 461         printf("%s  %s  ", buf1, buf2);
 462
 463         if ((ct.EndTimestamp - ct.BeginTimestamp) & 1)
 464             printf(N_("User's (AFS ID %d) tokens for %s", ""), ct.ViceId, cell);
 465         else
 466             printf(N_("Tokens for %s", ""), cell);
 467         if (do_verbose)
 468             printf(" (%d)", ct.AuthHandle);
 469         putchar('\n');
 470     }
 471 }
 472 #endif
 473
 474 /*
 475  * display the ccache in `cred_cache'
 476  */
 477
 478 static int
 479 display_v5_ccache (krb5_context context, krb5_ccache ccache,
 480                    int do_test, int do_verbose,
 481                    int do_flags, int do_hidden,
 482                    int do_json)
 483 {
 484     krb5_error_code ret;
 485     krb5_principal principal;
 486     int exit_status = 0;
 487
 488
 489     ret = krb5_cc_get_principal (context, ccache, &principal);
 490     if (ret) {
 491         if (do_json) {
 492             printf("{}");
 493             return 0;
 494         }
 495         if(ret == ENOENT) {
 496             if (!do_test)
 497                 krb5_warnx(context, N_("No ticket file: %s", ""),
 498                            krb5_cc_get_name(context, ccache));
 499             return 1;
 500         } else
 501             krb5_err (context, 1, ret, "krb5_cc_get_principal");
 502     }
 503     if (do_test)
 504         exit_status = check_expiration(context, ccache, NULL);
 505     else
 506         print_tickets (context, ccache, principal, do_verbose,
 507                        do_flags, do_hidden, do_json);
 508
 509     ret = krb5_cc_close (context, ccache);
 510     if (ret)
 511         krb5_err (context, 1, ret, "krb5_cc_close");
 512
 513     krb5_free_principal (context, principal);
 514
 515     return exit_status;
 516 }
 517
 518 /*
 519  *
 520  */
 521
 522 static int
 523 list_caches(krb5_context context, struct klist_options *opt)
 524 {
 525     krb5_cccol_cursor cursor;
 526     const char *cdef_name;
 527     char *def_name;
 528     krb5_error_code ret;
 529     krb5_ccache id;
 530     rtbl_t ct;
 531
 532     cdef_name = krb5_cc_default_name(context);
 533     if (cdef_name == NULL)
 534         krb5_errx(context, 1, "krb5_cc_default_name");
 535     def_name = strdup(cdef_name);
 536
 537     ret = krb5_cccol_cursor_new(context, &cursor);
 538     if (ret == KRB5_CC_NOSUPP) {
 539         free(def_name);
 540         return 0;
 541     }
 542     else if (ret)
 543         krb5_err (context, 1, ret, "krb5_cc_cache_get_first");
 544
 545     ct = rtbl_create();
 546     rtbl_add_column(ct, COL_DEFCACHE, 0);
 547     rtbl_add_column(ct, COL_NAME, 0);
 548     rtbl_add_column(ct, COL_CACHENAME, 0);
 549     rtbl_add_column(ct, COL_EXPIRES, 0);
 550     rtbl_add_column(ct, COL_DEFCACHE, 0);
 551     rtbl_set_prefix(ct, "   ");
 552     rtbl_set_column_prefix(ct, COL_DEFCACHE, "");
 553     rtbl_set_column_prefix(ct, COL_NAME, " ");
 554     if (opt->json_flag)
 555         rtbl_set_flags(ct, RTBL_JSON);
 556
 557     while (krb5_cccol_cursor_next(context, cursor, &id) == 0) {
 558         int expired = 0;
 559         char *name;
 560         time_t t;
 561
 562         expired = check_expiration(context, id, &t);
 563
 564         ret = krb5_cc_get_friendly_name(context, id, &name);
 565         if (ret == 0) {
 566             const char *str;
 567             char *fname;
 568
 569             rtbl_add_column_entry(ct, COL_NAME, name);
 570             free(name);
 571
 572             if (expired)
 573                 str = N_(">>> Expired <<<", "");
 574             else
 575                 str = printable_time(t);
 576             rtbl_add_column_entry(ct, COL_EXPIRES, str);
 577
 578             ret = krb5_cc_get_full_name(context, id, &fname);
 579             if (ret)
 580                 krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 581
 582             rtbl_add_column_entry(ct, COL_CACHENAME, fname);
 583             if (opt->json_flag)
 584                 ;
 585             else if (strcmp(fname, def_name) == 0)
 586                 rtbl_add_column_entry(ct, COL_DEFCACHE, "*");
 587             else
 588                 rtbl_add_column_entry(ct, COL_DEFCACHE, "");
 589
 590             krb5_xfree(fname);
 591         }
 592         krb5_cc_close(context, id);
 593     }
 594
 595     krb5_cccol_cursor_free(context, &cursor);
 596
 597     free(def_name);
 598     rtbl_format(ct, stdout);
 599     rtbl_destroy(ct);
 600
 601     if (opt->json_flag)
 602         printf("\n");
 603
 604     return 0;
 605 }
 606
 607 /*
 608  *
 609  */
 610
 611 int
 612 klist(struct klist_options *opt, int argc, char **argv)
 613 {
 614     krb5_error_code ret;
 615     int exit_status = 0;
 616
 617     int do_verbose =
 618         opt->verbose_flag ||
 619         opt->a_flag ||
 620         opt->n_flag;
 621     int do_test =
 622         opt->test_flag ||
 623         opt->s_flag;
 624
 625     if(opt->version_flag) {
 626         print_version(NULL);
 627         exit(0);
 628     }
 629
 630     if (opt->list_all_flag) {
 631         exit_status = list_caches(heimtools_context, opt);
 632         return exit_status;
 633     }
 634
 635     if (opt->v5_flag) {
 636         krb5_ccache id;
 637
 638         if (opt->all_content_flag) {
 639             krb5_cc_cache_cursor cursor;
 640             int first = 1;
 641
 642             ret = krb5_cc_cache_get_first(heimtools_context, NULL, &cursor);
 643             if (ret)
 644                 krb5_err(heimtools_context, 1, ret, "krb5_cc_cache_get_first");
 645
 646             if (opt->json_flag)
 647                 printf("[");
 648             while (krb5_cc_cache_next(heimtools_context, cursor, &id) == 0) {
 649                 if (opt->json_flag && !first)
 650                     printf(",");
 651
 652                 exit_status |= display_v5_ccache(heimtools_context, id, do_test,
 653                                                  do_verbose, opt->flags_flag,
 654                                                  opt->hidden_flag,
 655                                                  opt->json_flag);
 656                 if (!opt->json_flag)
 657                     printf("\n\n");
 658
 659                 first = 0;
 660             }
 661             krb5_cc_cache_end_seq_get(heimtools_context, cursor);
 662             if (opt->json_flag)
 663                 printf("]");
 664         } else {
 665             if(opt->cache_string) {
 666                 ret = krb5_cc_resolve(heimtools_context, opt->cache_string, &id);
 667                 if (ret)
 668                     krb5_err(heimtools_context, 1, ret, "%s", opt->cache_string);
 669             } else {
 670                 ret = krb5_cc_default(heimtools_context, &id);
 671                 if (ret)
 672                     krb5_err(heimtools_context, 1, ret, "krb5_cc_resolve");
 673             }
 674             exit_status = display_v5_ccache(heimtools_context, id, do_test,
 675                                             do_verbose, opt->flags_flag,
 676                                             opt->hidden_flag, opt->json_flag);
 677         }
 678     }
 679
 680     if (!do_test) {
 681 #ifndef NO_AFS
 682         if (opt->tokens_flag && k_hasafs()) {
 683             if (opt->v5_flag)
 684                 printf("\n");
 685             display_tokens(opt->verbose_flag);
 686         }
 687 #endif
 688     }
 689
 690     return exit_status;
 691 }