1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
KGETCRED(1) BSD General Commands Manual KGETCRED(1)
NNAAMMEE
kkggeettccrreedd -- get a ticket for a particular service
SSYYNNOOPPSSIISS
kkggeettccrreedd [----ccaannoonniiccaalliizzee] [----ccaannoonniiccaall] [--cc --ccaacchhee | ----ccaacchhee==_c_a_c_h_e] [--ee
_e_n_c_t_y_p_e | ----eennccttyyppee==_e_n_c_t_y_p_e] [----ddeebbuugg] [--HH | ----hhoossttbbaasseedd]
[----nnaammee--ttyyppee==_n_a_m_e_-_t_y_p_e] [----nnoo--ttrraannssiitt--cchheecckk] [----nnoo--ssttoorree]
[----ccaacchheedd--oonnllyy] [----vveerrssiioonn] [----hheellpp] _p_r_i_n_c_i_p_a_l
kkggeettccrreedd [options] ----hhoossttbbaasseedd _p_r_i_n_c_i_p_a_l
kkggeettccrreedd [options] ----hhoossttbbaasseedd _s_e_r_v_i_c_e _h_o_s_t_n_a_m_e _[_e_x_t_r_a_-_c_o_m_p_o_n_e_n_t_s_]
DDEESSCCRRIIPPTTIIOONN
kkggeettccrreedd obtains a ticket for the given service principal. Usually tick-
ets for services are obtained automatically when needed but sometimes for
some odd reason you want to obtain a particular ticket or of a special
type.
If ----hhoossttbbaasseedd is given then the given service principal name will be
canonicalized (see below).
The third form constructs a host-based principal from the given service
name and hostname. The service name "host" is used if the given _s_e_r_v_i_c_e
name in the third usage is the empty string.
For host-based names, the local host's hostname is used if the given
_h_o_s_t_n_a_m_e is the empty string or if the _p_r_i_n_c_i_p_a_l has a single component.
Any additional components will be included, even for host-based service
principal names, but there are no defaults nor local canonicalization
rules for additional components.
Local name canonicalization rules are applied unless the ----ccaannoonniiccaall
option is given. Currently local name canonicalization rules are sup-
ported only for host-based principal names' hostname component.
The principal's realm name may be canonicalized by following Kerberos
referrals from the client principal's home realm if the ----ccaannoonniiccaalliizzee
option is given or if the local name canonicalization rules are config-
ured to use referrals.
Supported options:
----ccaannoonniiccaalliizzee
requests that the KDC canonicalize the principal. Currently this
only canonicalizes the realm by chasing referrals from the user's
start realm, but in the future this may also enable the KDC to
canonicalize the complete principal name.
----ccaannoonniiccaall
turns off local canonicalization of the principal name.
----nnaammee--ttyyppee==_n_a_m_e_-_t_y_p_e
the name-type to use when parsing the principal name.
----hhoossttbbaasseedd
is short for ----nnaammee--ttyyppee==ssrrvv__hhsstt.
--cc _c_a_c_h_e, ----ccaacchhee==_c_a_c_h_e
the credential cache to use.
----ddeelleeggaattiioonn--ccrreeddeennttiiaall--ccaacchhee==_c_a_c_h_e
the credential cache to use for delegation.
--ee _e_n_c_t_y_p_e, ----eennccttyyppee==_e_n_c_t_y_p_e
encryption type to use.
----nnoo--ttrraannssiitt--cchheecckk
requests that the KDC doesn't do transit checking.
----nnoo--ssttoorree
do not store tickets in the ccache.
----ccaacchheedd--oonnllyy
do not talk the TGS, search only the ccache.
----ffoorrwwaarrddaabbllee
----ddeebbuugg
enables debug output to stderr.
----vveerrssiioonn
----hheellpp
If the ----ccaannoonniiccaall option is used, then no further canonicalization
should be done locally by the client (for example, DNS), but if
----ccaannoonniiccaalliizzee is used, then the client will ask that the KDC canonical-
ize the name.
If the ----ccaannoonniiccaalliizzee option is used with ----hhoossttbbaasseedd a host-based name-
type, and ----ccaannoonniiccaall is not used, then the hostname will be canonical-
ized according to the name canonicalization rules in _k_r_b_5_._c_o_n_f.
GSS-API initiator applications with host-based services will get the same
behavior as using the ----ccaannoonniiccaalliizzee ----hhoossttbbaasseedd options here.
SSEEEE AALLSSOO
kinit(1), klist(1), krb5.conf(5), krb5_openlog(3)
HEIMDAL March 12, 2004 HEIMDAL
|
