kuser/klist.c

   1 /*
   2  * Copyright (c) 1997-2008 Kungliga Tekniska Högskolan
   3  * (Royal Institute of Technology, Stockholm, Sweden).
   4  * All rights reserved.
   5  *
   6  * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  *
  12  * 1. Redistributions of source code must retain the above copyright
  13  *    notice, this list of conditions and the following disclaimer.
  14  *
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  *
  19  * 3. Neither the name of the Institute nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  */
  35
  36 #include "kuser_locl.h"
  37 #include "parse_units.h"
  38 #include "heimtools-commands.h"
  39 #undef HC_DEPRECATED_CRYPTO
  40
  41 static char*
  42 printable_time_internal(time_t t, int x)
  43 {
  44     static char s[128];
  45     char *p;
  46
  47     if ((p = ctime(&t)) == NULL)
  48         strlcpy(s, "?", sizeof(s));
  49     else
  50         strlcpy(s, p + 4, sizeof(s));
  51     s[x] = 0;
  52     return s;
  53 }
  54
  55 static char*
  56 printable_time(time_t t)
  57 {
  58     return printable_time_internal(t, 20);
  59 }
  60
  61 static char*
  62 printable_time_long(time_t t)
  63 {
  64     return printable_time_internal(t, 20);
  65 }
  66
  67 #define COL_ISSUED              NP_("  Issued","")
  68 #define COL_EXPIRES             NP_("  Expires", "")
  69 #define COL_FLAGS               NP_("Flags", "")
  70 #define COL_NAME                NP_("  Name", "")
  71 #define COL_PRINCIPAL           NP_("  Principal", "in klist output")
  72 #define COL_PRINCIPAL_KVNO      NP_("  Principal (kvno)", "in klist output")
  73 #define COL_CACHENAME           NP_("  Cache name", "name in klist output")
  74 #define COL_DEFCACHE            NP_("", "")
  75
  76 static void
  77 print_cred(krb5_context context, krb5_creds *cred, rtbl_t ct, int do_flags)
  78 {
  79     char *str;
  80     krb5_error_code ret;
  81     krb5_timestamp sec;
  82
  83     krb5_timeofday (context, &sec);
  84
  85
  86     if(cred->times.starttime)
  87         rtbl_add_column_entry(ct, COL_ISSUED,
  88                               printable_time(cred->times.starttime));
  89     else
  90         rtbl_add_column_entry(ct, COL_ISSUED,
  91                               printable_time(cred->times.authtime));
  92
  93     if(cred->times.endtime > sec)
  94         rtbl_add_column_entry(ct, COL_EXPIRES,
  95                               printable_time(cred->times.endtime));
  96     else
  97         rtbl_add_column_entry(ct, COL_EXPIRES, N_(">>>Expired<<<", ""));
  98     ret = krb5_unparse_name (context, cred->server, &str);
  99     if (ret)
 100         krb5_err(context, 1, ret, "krb5_unparse_name");
 101     rtbl_add_column_entry(ct, COL_PRINCIPAL, str);
 102     if(do_flags) {
 103         char s[16], *sp = s;
 104         if(cred->flags.b.forwardable)
 105             *sp++ = 'F';
 106         if(cred->flags.b.forwarded)
 107             *sp++ = 'f';
 108         if(cred->flags.b.proxiable)
 109             *sp++ = 'P';
 110         if(cred->flags.b.proxy)
 111             *sp++ = 'p';
 112         if(cred->flags.b.may_postdate)
 113             *sp++ = 'D';
 114         if(cred->flags.b.postdated)
 115             *sp++ = 'd';
 116         if(cred->flags.b.renewable)
 117             *sp++ = 'R';
 118         if(cred->flags.b.initial)
 119             *sp++ = 'I';
 120         if(cred->flags.b.invalid)
 121             *sp++ = 'i';
 122         if(cred->flags.b.pre_authent)
 123             *sp++ = 'A';
 124         if(cred->flags.b.hw_authent)
 125             *sp++ = 'H';
 126         if(cred->flags.b.transited_policy_checked)
 127             *sp++ = 'T';
 128         if(cred->flags.b.ok_as_delegate)
 129             *sp++ = 'O';
 130         if(cred->flags.b.anonymous)
 131             *sp++ = 'a';
 132         *sp = '\0';
 133         rtbl_add_column_entry(ct, COL_FLAGS, s);
 134     }
 135     free(str);
 136 }
 137
 138 static void
 139 print_cred_verbose(krb5_context context, krb5_creds *cred, int do_json)
 140 {
 141     size_t j;
 142     char *str;
 143     krb5_error_code ret;
 144     krb5_timestamp sec;
 145
 146     if (do_json) { /* XXX support more json formating later */
 147         printf("{ \"verbose-supported\" : false }");
 148         return;
 149     }
 150
 151     krb5_timeofday (context, &sec);
 152
 153     ret = krb5_unparse_name(context, cred->server, &str);
 154     if(ret)
 155         exit(1);
 156     printf(N_("Server: %s\n", ""), str);
 157     free (str);
 158
 159     ret = krb5_unparse_name(context, cred->client, &str);
 160     if(ret)
 161         exit(1);
 162     printf(N_("Client: %s\n", ""), str);
 163     free (str);
 164
 165     if (krb5_is_config_principal(context, cred->server)) {
 166         if (krb5_principal_get_num_comp(context, cred->server) > 1) {
 167             const char *s;
 168
 169             /* If the payload is text and not secret/sensitive, print it */
 170             s = krb5_principal_get_comp_string(context, cred->server, 1);
 171             if (strcmp(s, "start_realm") == 0 ||
 172                 strcmp(s, "anon_pkinit_realm") == 0 ||
 173                 strcmp(s, "default-ntlm-domain") == 0 ||
 174                 strcmp(s, "FriendlyName") == 0 ||
 175                 strcmp(s, "fast_avail") == 0 ||
 176                 strcmp(s, "kx509store") == 0 ||
 177                 strcmp(s, "kx509_service_realm") == 0 ||
 178                 strcmp(s, "kx509_service_status") == 0)
 179                 printf(N_("Configuration item payload: %.*s\n", ""),
 180                        (int)cred->ticket.length,
 181                        (const char *)cred->ticket.data);
 182             else
 183                 printf(N_("Configuration item payload length: %lu\n", ""),
 184                        (unsigned long)cred->ticket.length);
 185         } /* else... this is a meaningless entry; nothing would create it */
 186     } else {
 187         Ticket t;
 188         size_t len;
 189         char *s;
 190
 191         decode_Ticket(cred->ticket.data, cred->ticket.length, &t, &len);
 192         ret = krb5_enctype_to_string(context, t.enc_part.etype, &s);
 193         printf(N_("Ticket etype: ", ""));
 194         if (ret == 0) {
 195             printf("%s", s);
 196             free(s);
 197         } else {
 198             printf(N_("unknown-enctype(%d)", ""), t.enc_part.etype);
 199         }
 200         if(t.enc_part.kvno)
 201             printf(N_(", kvno %d", ""), *t.enc_part.kvno);
 202         printf("\n");
 203         if(cred->session.keytype != t.enc_part.etype) {
 204             ret = krb5_enctype_to_string(context, cred->session.keytype, &str);
 205             if(ret)
 206                 krb5_warn(context, ret, "session keytype");
 207             else {
 208                 printf(N_("Session key: %s\n", "enctype"), str);
 209                 free(str);
 210             }
 211         }
 212         free_Ticket(&t);
 213         printf(N_("Ticket length: %lu\n", ""),
 214                (unsigned long)cred->ticket.length);
 215         printf(N_("Auth time:  %s\n", ""),
 216                printable_time_long(cred->times.authtime));
 217         if(cred->times.authtime != cred->times.starttime)
 218             printf(N_("Start time: %s\n", ""),
 219                    printable_time_long(cred->times.starttime));
 220         printf(N_("End time:   %s", ""),
 221                printable_time_long(cred->times.endtime));
 222         if(sec > cred->times.endtime)
 223             printf(N_(" (expired)", ""));
 224         printf("\n");
 225         if(cred->flags.b.renewable)
 226             printf(N_("Renew till: %s\n", ""),
 227                    printable_time_long(cred->times.renew_till));
 228         {
 229             char flags[1024];
 230             unparse_flags(TicketFlags2int(cred->flags.b),
 231                           asn1_TicketFlags_units(),
 232                           flags, sizeof(flags));
 233             printf(N_("Ticket flags: %s\n", ""), flags);
 234         }
 235         printf(N_("Addresses: ", ""));
 236         if (cred->addresses.len != 0) {
 237             for(j = 0; j < cred->addresses.len; j++){
 238                 char buf[128];
 239                 if(j) printf(", ");
 240                 ret = krb5_print_address(&cred->addresses.val[j],
 241                                          buf, sizeof(buf), &len);
 242
 243                 if(ret == 0)
 244                     printf("%s", buf);
 245             }
 246         } else {
 247             printf(N_("addressless", ""));
 248         }
 249     }
 250     printf("\n\n");
 251 }
 252
 253 /*
 254  * Print all tickets in `ccache' on stdout, verbosely if do_verbose.
 255  */
 256
 257 static void
 258 print_tickets(krb5_context context,
 259               krb5_ccache ccache,
 260               krb5_principal principal,
 261               int do_verbose,
 262               int do_flags,
 263               int do_hidden,
 264               int do_json)
 265 {
 266     char *str, *name, *fullname;
 267     krb5_error_code ret;
 268     krb5_cc_cursor cursor;
 269     krb5_creds creds;
 270     krb5_deltat sec;
 271     rtbl_t ct = NULL;
 272     int print_comma = 0;
 273
 274     ret = krb5_unparse_name (context, principal, &str);
 275     if (ret)
 276         krb5_err (context, 1, ret, "krb5_unparse_name");
 277
 278     ret = krb5_cc_get_full_name(context, ccache, &fullname);
 279     if (ret)
 280         krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 281
 282     if (!do_json) {
 283         printf ("%17s: %s\n", N_("Credentials cache", ""), fullname);
 284         printf ("%17s: %s\n", N_("Principal", ""), str);
 285
 286         ret = krb5_cc_get_friendly_name(context, ccache, &name);
 287         if (ret == 0) {
 288             if (strcmp(name, str) != 0)
 289                 printf ("%17s: %s\n", N_("Friendly name", ""), name);
 290             free(name);
 291         }
 292
 293         if(do_verbose) {
 294             printf ("%17s: %d\n", N_("Cache version", ""),
 295                     krb5_cc_get_version(context, ccache));
 296         } else {
 297             krb5_cc_set_flags(context, ccache, KRB5_TC_NOTICKET);
 298         }
 299
 300         ret = krb5_cc_get_kdc_offset(context, ccache, &sec);
 301
 302         if (ret == 0 && do_verbose && sec != 0) {
 303             char buf[BUFSIZ];
 304             int val;
 305             int sig;
 306
 307             val = (int)sec;
 308             sig = 1;
 309             if (val < 0) {
 310                 sig = -1;
 311                 val = -val;
 312             }
 313
 314             unparse_time (val, buf, sizeof(buf));
 315
 316             printf ("%17s: %s%s\n", N_("KDC time offset", ""),
 317                     sig == -1 ? "-" : "", buf);
 318         }
 319         printf("\n");
 320     } else {
 321         printf ("{ \"cache\" : \"%s\", \"principal\" : \"%s\", ", fullname, str);
 322     }
 323     free(str);
 324
 325     ret = krb5_cc_start_seq_get (context, ccache, &cursor);
 326     if (ret)
 327         krb5_err(context, 1, ret, "krb5_cc_start_seq_get");
 328
 329     if(!do_verbose) {
 330         ct = rtbl_create();
 331         rtbl_add_column(ct, COL_ISSUED, 0);
 332         rtbl_add_column(ct, COL_EXPIRES, 0);
 333         if(do_flags)
 334             rtbl_add_column(ct, COL_FLAGS, 0);
 335         rtbl_add_column(ct, COL_PRINCIPAL, 0);
 336         rtbl_set_separator(ct, "  ");
 337         if (do_json) {
 338             rtbl_set_flags(ct, RTBL_JSON);
 339             printf("\"tickets\" : ");
 340         }
 341     }
 342     if (do_verbose && do_json)
 343         printf("\"tickets\" : [");
 344     while ((ret = krb5_cc_next_cred(context, ccache, &cursor, &creds)) == 0) {
 345         if (!do_hidden && krb5_is_config_principal(context, creds.server)) {
 346             ;
 347         } else if (do_verbose) {
 348             if (do_json && print_comma)
 349                 printf(",");
 350             print_cred_verbose(context, &creds, do_json);
 351             print_comma = 1;
 352         } else {
 353             print_cred(context, &creds, ct, do_flags);
 354         }
 355         krb5_free_cred_contents(context, &creds);
 356     }
 357     if (ret != KRB5_CC_END)
 358         krb5_err(context, 1, ret, "krb5_cc_get_next");
 359     ret = krb5_cc_end_seq_get (context, ccache, &cursor);
 360     if (ret)
 361         krb5_err(context, 1, ret, "krb5_cc_end_seq_get");
 362
 363     print_comma = 0;
 364     if(!do_verbose) {
 365         rtbl_format(ct, stdout);
 366         rtbl_destroy(ct);
 367     }
 368     if (do_json) {
 369         if (do_verbose)
 370             printf("]");
 371         printf("}");
 372     }
 373     free(fullname);
 374 }
 375
 376 /*
 377  * Check if there's a tgt for the realm of `principal' and ccache and
 378  * if so return 0, else 1
 379  */
 380
 381 static int
 382 check_expiration(krb5_context context,
 383                  krb5_ccache ccache,
 384                  time_t *expiration)
 385 {
 386     krb5_error_code ret;
 387     time_t t;
 388
 389     ret = krb5_cc_get_lifetime(context, ccache, &t);
 390     if (ret || t == 0)
 391         return 1;
 392
 393     if (expiration)
 394         *expiration = time(NULL) + t;
 395
 396     return 0;
 397 }
 398
 399 /*
 400  * Print a list of all AFS tokens
 401  */
 402
 403 #ifndef NO_AFS
 404
 405 static void
 406 display_tokens(int do_verbose)
 407 {
 408     uint32_t i;
 409     unsigned char t[4096];
 410     struct ViceIoctl parms;
 411
 412     parms.in = (void *)&i;
 413     parms.in_size = sizeof(i);
 414     parms.out = (void *)t;
 415     parms.out_size = sizeof(t);
 416
 417     for (i = 0;; i++) {
 418         int32_t size_secret_tok, size_public_tok;
 419         unsigned char *cell;
 420         struct ClearToken ct;
 421         unsigned char *r = t;
 422         struct timeval tv;
 423         char buf1[20], buf2[20];
 424
 425         if(k_pioctl(NULL, VIOCGETTOK, &parms, 0) < 0) {
 426             if(errno == EDOM)
 427                 break;
 428             continue;
 429         }
 430         if(parms.out_size > sizeof(t))
 431             continue;
 432         if(parms.out_size < sizeof(size_secret_tok))
 433             continue;
 434         t[min(parms.out_size,sizeof(t)-1)] = 0;
 435         memcpy(&size_secret_tok, r, sizeof(size_secret_tok));
 436         /* don't bother about the secret token */
 437         r += size_secret_tok + sizeof(size_secret_tok);
 438         if (parms.out_size < (r - t) + sizeof(size_public_tok))
 439             continue;
 440         memcpy(&size_public_tok, r, sizeof(size_public_tok));
 441         r += sizeof(size_public_tok);
 442         if (parms.out_size < (r - t) + size_public_tok + sizeof(int32_t))
 443             continue;
 444         memcpy(&ct, r, size_public_tok);
 445         r += size_public_tok;
 446         /* there is a int32_t with length of cellname, but we don't read it */
 447         r += sizeof(int32_t);
 448         cell = r;
 449
 450         gettimeofday (&tv, NULL);
 451         strlcpy (buf1, printable_time(ct.BeginTimestamp),
 452                  sizeof(buf1));
 453         if (do_verbose || tv.tv_sec < ct.EndTimestamp)
 454             strlcpy (buf2, printable_time(ct.EndTimestamp),
 455                      sizeof(buf2));
 456         else
 457             strlcpy (buf2, N_(">>> Expired <<<", ""), sizeof(buf2));
 458
 459         printf("%s  %s  ", buf1, buf2);
 460
 461         if ((ct.EndTimestamp - ct.BeginTimestamp) & 1)
 462             printf(N_("User's (AFS ID %d) tokens for %s", ""), ct.ViceId, cell);
 463         else
 464             printf(N_("Tokens for %s", ""), cell);
 465         if (do_verbose)
 466             printf(" (%d)", ct.AuthHandle);
 467         putchar('\n');
 468     }
 469 }
 470 #endif
 471
 472 /*
 473  * display the ccache in `cred_cache'
 474  */
 475
 476 static int
 477 display_v5_ccache (krb5_context context, krb5_ccache ccache,
 478                    int do_test, int do_verbose,
 479                    int do_flags, int do_hidden,
 480                    int do_json)
 481 {
 482     krb5_error_code ret;
 483     krb5_principal principal;
 484     int exit_status = 0;
 485
 486
 487     ret = krb5_cc_get_principal (context, ccache, &principal);
 488     if (ret) {
 489         if (do_json) {
 490             printf("{}");
 491             return 0;
 492         }
 493         if(ret == ENOENT) {
 494             if (!do_test)
 495                 krb5_warnx(context, N_("No ticket file: %s", ""),
 496                            krb5_cc_get_name(context, ccache));
 497             return 1;
 498         } else
 499             krb5_err (context, 1, ret, "krb5_cc_get_principal");
 500     }
 501     if (do_test)
 502         exit_status = check_expiration(context, ccache, NULL);
 503     else
 504         print_tickets (context, ccache, principal, do_verbose,
 505                        do_flags, do_hidden, do_json);
 506
 507     ret = krb5_cc_close (context, ccache);
 508     if (ret)
 509         krb5_err (context, 1, ret, "krb5_cc_close");
 510
 511     krb5_free_principal (context, principal);
 512
 513     return exit_status;
 514 }
 515
 516 /*
 517  *
 518  */
 519
 520 static int
 521 list_caches(krb5_context context, struct klist_options *opt)
 522 {
 523     krb5_cccol_cursor cursor;
 524     const char *cdef_name;
 525     char *def_name;
 526     krb5_error_code ret;
 527     krb5_ccache id;
 528     rtbl_t ct;
 529
 530     cdef_name = krb5_cc_default_name(context);
 531     if (cdef_name == NULL)
 532         krb5_errx(context, 1, "krb5_cc_default_name");
 533     def_name = strdup(cdef_name);
 534
 535     ret = krb5_cccol_cursor_new(context, &cursor);
 536     if (ret == KRB5_CC_NOSUPP) {
 537         free(def_name);
 538         return 0;
 539     }
 540     else if (ret)
 541         krb5_err (context, 1, ret, "krb5_cc_cache_get_first");
 542
 543     ct = rtbl_create();
 544     rtbl_add_column(ct, COL_DEFCACHE, 0);
 545     rtbl_add_column(ct, COL_NAME, 0);
 546     rtbl_add_column(ct, COL_CACHENAME, 0);
 547     rtbl_add_column(ct, COL_EXPIRES, 0);
 548     rtbl_add_column(ct, COL_DEFCACHE, 0);
 549     rtbl_set_prefix(ct, "   ");
 550     rtbl_set_column_prefix(ct, COL_DEFCACHE, "");
 551     rtbl_set_column_prefix(ct, COL_NAME, " ");
 552     if (opt->json_flag)
 553         rtbl_set_flags(ct, RTBL_JSON);
 554
 555     while (krb5_cccol_cursor_next(context, cursor, &id) == 0) {
 556         int expired = 0;
 557         char *name;
 558         time_t t;
 559
 560         expired = check_expiration(context, id, &t);
 561
 562         ret = krb5_cc_get_friendly_name(context, id, &name);
 563         if (ret == 0) {
 564             const char *str;
 565             char *fname;
 566
 567             rtbl_add_column_entry(ct, COL_NAME, name);
 568             free(name);
 569
 570             if (expired)
 571                 str = N_(">>> Expired <<<", "");
 572             else
 573                 str = printable_time(t);
 574             rtbl_add_column_entry(ct, COL_EXPIRES, str);
 575
 576             ret = krb5_cc_get_full_name(context, id, &fname);
 577             if (ret)
 578                 krb5_err (context, 1, ret, "krb5_cc_get_full_name");
 579
 580             rtbl_add_column_entry(ct, COL_CACHENAME, fname);
 581             if (opt->json_flag)
 582                 ;
 583             else if (strcmp(fname, def_name) == 0)
 584                 rtbl_add_column_entry(ct, COL_DEFCACHE, "*");
 585             else
 586                 rtbl_add_column_entry(ct, COL_DEFCACHE, "");
 587
 588             krb5_xfree(fname);
 589         }
 590         krb5_cc_close(context, id);
 591     }
 592
 593     krb5_cccol_cursor_free(context, &cursor);
 594
 595     free(def_name);
 596     rtbl_format(ct, stdout);
 597     rtbl_destroy(ct);
 598
 599     if (opt->json_flag)
 600         printf("\n");
 601
 602     return 0;
 603 }
 604
 605 /*
 606  *
 607  */
 608
 609 int
 610 klist(struct klist_options *opt, int argc, char **argv)
 611 {
 612     krb5_error_code ret;
 613     int exit_status = 0;
 614
 615     int do_verbose =
 616         opt->verbose_flag ||
 617         opt->a_flag ||
 618         opt->n_flag;
 619     int do_test =
 620         opt->test_flag ||
 621         opt->s_flag;
 622
 623     if(opt->version_flag) {
 624         print_version(NULL);
 625         exit(0);
 626     }
 627
 628     if (opt->list_all_flag) {
 629         exit_status = list_caches(heimtools_context, opt);
 630         return exit_status;
 631     }
 632
 633     if (opt->v5_flag) {
 634         krb5_ccache id;
 635
 636         if (opt->all_content_flag) {
 637             krb5_cc_cache_cursor cursor;
 638             int first = 1;
 639
 640             ret = krb5_cc_cache_get_first(heimtools_context, NULL, &cursor);
 641             if (ret)
 642                 krb5_err(heimtools_context, 1, ret, "krb5_cc_cache_get_first");
 643
 644             if (opt->json_flag)
 645                 printf("[");
 646             while (krb5_cc_cache_next(heimtools_context, cursor, &id) == 0) {
 647                 if (opt->json_flag && !first)
 648                     printf(",");
 649
 650                 exit_status |= display_v5_ccache(heimtools_context, id, do_test,
 651                                                  do_verbose, opt->flags_flag,
 652                                                  opt->hidden_flag,
 653                                                  opt->json_flag);
 654                 if (!opt->json_flag)
 655                     printf("\n\n");
 656
 657                 first = 0;
 658             }
 659             krb5_cc_cache_end_seq_get(heimtools_context, cursor);
 660             if (opt->json_flag)
 661                 printf("]");
 662         } else {
 663             if(opt->cache_string) {
 664                 ret = krb5_cc_resolve(heimtools_context, opt->cache_string, &id);
 665                 if (ret)
 666                     krb5_err(heimtools_context, 1, ret, "%s", opt->cache_string);
 667             } else {
 668                 ret = krb5_cc_default(heimtools_context, &id);
 669                 if (ret)
 670                     krb5_err(heimtools_context, 1, ret, "krb5_cc_resolve");
 671             }
 672             exit_status = display_v5_ccache(heimtools_context, id, do_test,
 673                                             do_verbose, opt->flags_flag,
 674                                             opt->hidden_flag, opt->json_flag);
 675         }
 676     }
 677
 678     if (!do_test) {
 679 #ifndef NO_AFS
 680         if (opt->tokens_flag && k_hasafs()) {
 681             if (opt->v5_flag)
 682                 printf("\n");
 683             display_tokens(opt->verbose_flag);
 684         }
 685 #endif
 686     }
 687
 688     return exit_status;
 689 }