1KGETCRED(1)               BSD General Commands Manual              KGETCRED(1)
2

NAME

4     kgetcred — get a ticket for a particular service
5

SYNOPSIS

7     kgetcred [--canonicalize] [--canonical] [-c -cache | --cache=cache] [-e
8              enctype | --enctype=enctype] [--debug] [-H | --hostbased]
9              [--name-type=name-type] [--no-transit-check] [--no-store]
10              [--cached-only] [--version] [--help] principal
11     kgetcred [options] --hostbased principal
12     kgetcred [options] --hostbased service hostname [extra-components]
13

DESCRIPTION

15     kgetcred obtains a ticket for the given service principal.  Usually tick‐
16     ets for services are obtained automatically when needed but sometimes for
17     some odd reason you want to obtain a particular ticket or of a special
18     type.
19
20     If --hostbased is given then the given service principal name will be
21     canonicalized (see below).
22
23     The third form constructs a host-based principal from the given service
24     name and hostname.  The service name "host" is used if the given service
25     name in the third usage is the empty string.
26
27     For host-based names, the local host's hostname is used if the given
28     hostname is the empty string or if the principal has a single component.
29
30     Any additional components will be included, even for host-based service
31     principal names, but there are no defaults nor local canonicalization
32     rules for additional components.
33
34     Local name canonicalization rules are applied unless the --canonical
35     option is given.  Currently local name canonicalization rules are sup‐
36     ported only for host-based principal names' hostname component.
37
38     The principal's realm name may be canonicalized by following Kerberos
39     referrals from the client principal's home realm if the --canonicalize
40     option is given or if the local name canonicalization rules are config‐
41     ured to use referrals.
42
43     Supported options:
44
45     --canonicalize
46             requests that the KDC canonicalize the principal.  Currently this
47             only canonicalizes the realm by chasing referrals from the user's
48             start realm, but in the future this may also enable the KDC to
49             canonicalize the complete principal name.
50
51     --canonical
52             turns off local canonicalization of the principal name.
53
54     --name-type=name-type
55             the name-type to use when parsing the principal name.
56
57     --hostbased
58             is short for --name-type=srv_hst.
59
60     -c cache, --cache=cache
61             the credential cache to use.
62
63     --delegation-credential-cache=cache
64             the credential cache to use for delegation.
65
66     -e enctype, --enctype=enctype
67             encryption type to use.
68
69     --no-transit-check
70             requests that the KDC doesn't do transit checking.
71
72     --no-store
73             do not store tickets in the ccache.
74
75     --cached-only
76             do not talk the TGS, search only the ccache.
77
78     --forwardable
79
80     --debug
81             enables debug output to stderr.
82
83     --version
84
85     --help
86
87     If the --canonical option is used, then no further canonicalization
88     should be done locally by the client (for example, DNS), but if
89     --canonicalize is used, then the client will ask that the KDC canonical‐
90     ize the name.
91
92     If the --canonicalize option is used with --hostbased a host-based name-
93     type, and --canonical is not used, then the hostname will be canonical‐
94     ized according to the name canonicalization rules in krb5.conf.
95
96     GSS-API initiator applications with host-based services will get the same
97     behavior as using the --canonicalize --hostbased options here.
98

SEE ALSO

100     kinit(1), klist(1), krb5.conf(5), krb5_openlog(3)
101
102HEIMDAL                         March 12, 2004                         HEIMDAL
Impressum