1.\" $NetBSD: kgetcred.1,v 1.6 2023/06/19 21:41:42 christos Exp $ 2.\" 3.\" Copyright (c) 1999, 2001 - 2002 Kungliga Tekniska Högskolan 4.\" (Royal Institute of Technology, Stockholm, Sweden). 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" 3. Neither the name of the Institute nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" Id 35.\" 36.Dd March 12, 2004 37.Dt KGETCRED 1 38.Os 39.Sh NAME 40.Nm kgetcred 41.Nd "get a ticket for a particular service" 42.Sh SYNOPSIS 43.Nm 44.Op Fl Fl canonicalize 45.Op Fl Fl canonical 46.Oo Fl c cache \*(Ba Xo 47.Fl Fl cache= Ns Ar cache 48.Xc 49.Oc 50.Oo Fl e Ar enctype \*(Ba Xo 51.Fl Fl enctype= Ns Ar enctype 52.Xc 53.Oc 54.Op Fl Fl debug 55.Oo Fl H \*(Ba Xo 56.Fl Fl hostbased 57.Xc 58.Oc 59.Op Fl Fl name-type= Ns Ar name-type 60.Op Fl Fl no-transit-check 61.Op Fl Fl no-store 62.Op Fl Fl cached-only 63.Op Fl n \*(Ba Fl Fl anonymous 64.Op Fl Fl version 65.Op Fl Fl help 66.Ar principal 67.Nm 68.Op options 69.Fl Fl hostbased 70.Ar principal 71.Nm 72.Op options 73.Fl Fl hostbased 74.Ar service 75.Ar hostname 76.Ar [extra-components] 77.Sh DESCRIPTION 78.Nm 79obtains a ticket for the given service principal. 80Usually tickets for services are obtained automatically when needed 81but sometimes for some odd reason you want to obtain a particular 82ticket or of a special type. 83.Pp 84If 85.Fl Fl hostbased 86is given then the given service principal name will be canonicalized 87(see below). 88.Pp 89The third form constructs a host-based principal from the given service 90name and hostname. The service name "host" is used if the given 91.Ar service 92name in the third usage is the empty string. 93.Pp 94For host-based names, the local host's hostname is used if the given 95.Ar hostname 96is the empty string or if the 97.Ar principal 98has a single component. 99.Pp 100Any additional components will be included, even for host-based service 101principal names, but there are no defaults nor local canonicalization 102rules for additional components. 103.Pp 104Local name canonicalization rules are applied unless the 105.Fl Fl canonical 106option is given. Currently local name canonicalization rules are 107supported only for host-based principal names' hostname component. 108.Pp 109The principal's realm name may be canonicalized by following Kerberos 110referrals from the client principal's home realm if the 111.Fl Fl canonicalize 112option is given or if the local name canonicalization rules are 113configured to use referrals. 114.Pp 115Supported options: 116.Bl -tag -width Ds 117.It Fl Fl canonicalize 118requests that the KDC canonicalize the principal. Currently this only 119canonicalizes the realm by chasing referrals from the user's start 120realm, but in the future this may also enable the KDC to canonicalize 121the complete principal name. 122.It Fl Fl canonical 123turns off local canonicalization of the principal name. 124.It Fl Fl name-type= Ns Ar name-type 125the name-type to use when parsing the principal name. 126.It Fl Fl hostbased 127is short for 128.Fl Fl name-type=srv_hst . 129.It Fl c Ar cache , Fl Fl cache= Ns Ar cache 130the credential cache to use. 131.It Fl Fl delegation-credential-cache= Ns Ar cache 132the credential cache to use for delegation. 133.It Fl e Ar enctype , Fl Fl enctype= Ns Ar enctype 134encryption type to use. 135.It Fl Fl no-transit-check 136requests that the KDC doesn't do transit checking. 137.It Fl Fl no-store 138do not store tickets in the ccache. 139.It Fl Fl cached-only 140do not talk the TGS, search only the ccache. 141.It Fl Fl anonymous 142obtain an anonymous service ticket. 143.It Fl Fl forwardable 144.It Fl Fl debug 145enables debug output to stderr. 146.It Fl Fl version 147.It Fl Fl help 148.El 149.Pp 150If the 151.Fl Fl canonical 152option is used, then no further canonicalization should be done locally 153by the client (for example, DNS), but if 154.Fl Fl canonicalize 155is used, then the client will ask that the KDC canonicalize the name. 156.Pp 157If the 158.Fl Fl canonicalize 159option is used with 160.Fl Fl hostbased 161a host-based name-type, and 162.Fl Fl canonical 163is not used, then the hostname will be canonicalized according to the 164name canonicalization rules in 165.Va krb5.conf . 166.Pp 167GSS-API initiator applications with host-based services will get the 168same behavior as using the 169.Fl Fl canonicalize 170.Fl Fl hostbased 171options here. 172.Sh SEE ALSO 173.Xr kinit 1 , 174.Xr klist 1 , 175.Xr krb5.conf 5 , 176.Xr krb5_openlog 3 177