1 .\" Copyright (c) 1998 - 2003, 2006 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 .Nd acquire initial tickets
43 .Oo Fl c Ar cachename \*(Ba Xo
44 .Fl Fl cache= Ns Ar cachename
47 .Op Fl f | Fl Fl no-forwardable
48 .Oo Fl t Ar keytabname \*(Ba Xo
49 .Fl Fl keytab= Ns Ar keytabname
52 .Oo Fl l Ar time \*(Ba Xo
53 .Fl Fl lifetime= Ns Ar time
56 .Op Fl p | Fl Fl proxiable
57 .Op Fl R | Fl Fl renew
59 .Oo Fl r Ar time \*(Ba Xo
60 .Fl Fl renewable-life= Ns Ar time
63 .Oo Fl S Ar principal \*(Ba Xo
64 .Fl Fl server= Ns Ar principal
67 .Oo Fl s Ar time \*(Ba Xo
68 .Fl Fl start-time= Ns Ar time
71 .Op Fl k | Fl Fl use-keytab
72 .Op Fl v | Fl Fl validate
73 .Oo Fl e Ar enctypes \*(Ba Xo
74 .Fl Fl enctypes= Ns Ar enctypes
77 .Oo Fl a Ar addresses \*(Ba Xo
78 .Fl Fl extra-addresses= Ns Ar addresses
81 .Op Fl Fl password-file= Ns Ar filename
82 .Op Fl Fl fcache-version= Ns Ar version-number
83 .Op Fl A | Fl Fl no-addresses
88 .Op Ar principal Op Ar command
91 is used to authenticate to the Kerberos server as
93 or if none is given, a system generated default (typically your login
94 name at the default realm), and acquire a ticket granting ticket that
95 can later be used to obtain tickets for other services.
99 .It Fl c Ar cachename Fl Fl cache= Ns Ar cachename
100 The credentials cache to put the acquired ticket in, if other than
102 .It Fl f Fl Fl forwardable
103 Obtain a ticket than can be forwarded to another host.
104 .It Fl F Fl Fl no-forwardable
105 Do not obtain a forwardable ticket.
106 .It Fl t Ar keytabname , Fl Fl keytab= Ns Ar keytabname
107 Don't ask for a password, but instead get the key from the specified
109 .It Fl l Ar time , Fl Fl lifetime= Ns Ar time
110 Specifies the lifetime of the ticket.
111 The argument can either be in seconds, or a more human readable string
114 .It Fl p , Fl Fl proxiable
115 Request tickets with the proxiable flag set.
116 .It Fl R , Fl Fl renew
118 The ticket must have the
120 flag set, and must not be expired.
123 .Fl Fl renewable-life ,
124 with an infinite time.
125 .It Fl r Ar time , Fl Fl renewable-life= Ns Ar time
126 The max renewable ticket life.
127 .It Fl S Ar principal , Fl Fl server= Ns Ar principal
128 Get a ticket for a service other than krbtgt/LOCAL.REALM.
129 .It Fl s Ar time , Fl Fl start-time= Ns Ar time
130 Obtain a ticket that starts to be valid
132 (which can really be a generic time specification, like
134 seconds into the future.
135 .It Fl k , Fl Fl use-keytab
138 but with the default keytab name (normally
139 .Ar FILE:/etc/krb5.keytab ) .
140 .It Fl v , Fl Fl validate
141 Try to validate an invalid ticket.
142 .It Fl e , Fl Fl enctypes= Ns Ar enctypes
143 Request tickets with this particular enctype.
144 .It Fl Fl password-file= Ns Ar filename
145 read the password from the first line of
151 the password will be read from the standard input.
152 .It Fl Fl fcache-version= Ns Ar version-number
153 Create a credentials cache of version
155 .It Fl a , Fl Fl extra-addresses= Ns Ar enctypes
156 Adds a set of addresses that will, in addition to the systems local
157 addresses, be put in the ticket.
158 This can be useful if all addresses a client can use can't be
159 automatically figured out.
160 One such example is if the client is behind a firewall.
162 .Li libdefaults/extra_addresses
165 .It Fl A , Fl Fl no-addresses
166 Request a ticket with no addresses.
168 Request an anonymous ticket (which means that the ticket will be
169 issued to an anonymous principal, typically
170 .Dq anonymous@REALM ) .
172 Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise
173 names are email like principals that are stored in the name part of
174 the principal, and since there are two @ characters the parser needs
175 to know that the first is not a realm.
176 An example of an enterprise name is
177 .Dq lha@e.kth.se@KTH.SE ,
178 and this option is usually used with canonicalize so that the
179 principal returned from the KDC will typically be the real principal
182 Gets AFS tickets, converts them to version 4 format, and stores them
184 Only useful if you have AFS.
193 options can be set to a default value from the
195 section in krb5.conf, see
196 .Xr krb5_appdefault 3 .
202 will set up new credentials caches, and AFS PAG, and then run the given
204 When it finishes the credentials will be removed.
208 Specifies the default credentials cache.
215 Specifies the Kerberos 4 ticket file to store version 4 tickets in.
223 .Xr krb5_appdefault 3 ,