1.\" $NetBSD: kgetcred.1,v 1.4 2017/01/28 21:31:45 christos Exp $ 2.\" 3.\" Copyright (c) 1999, 2001 - 2002 Kungliga Tekniska Högskolan 4.\" (Royal Institute of Technology, Stockholm, Sweden). 5.\" All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 11.\" 1. Redistributions of source code must retain the above copyright 12.\" notice, this list of conditions and the following disclaimer. 13.\" 14.\" 2. Redistributions in binary form must reproduce the above copyright 15.\" notice, this list of conditions and the following disclaimer in the 16.\" documentation and/or other materials provided with the distribution. 17.\" 18.\" 3. Neither the name of the Institute nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" Id 35.\" 36.Dd March 12, 2004 37.Dt KGETCRED 1 38.Os 39.Sh NAME 40.Nm kgetcred 41.Nd "get a ticket for a particular service" 42.Sh SYNOPSIS 43.Nm 44.Op Fl Fl canonicalize 45.Op Fl Fl canonical 46.Oo Fl c cache \*(Ba Xo 47.Fl Fl cache= Ns Ar cache 48.Xc 49.Oc 50.Oo Fl e Ar enctype \*(Ba Xo 51.Fl Fl enctype= Ns Ar enctype 52.Xc 53.Oc 54.Op Fl Fl debug 55.Oo Fl H \*(Ba Xo 56.Fl Fl hostbased 57.Xc 58.Oc 59.Op Fl Fl name-type= Ns Ar name-type 60.Op Fl Fl no-transit-check 61.Op Fl Fl no-store 62.Op Fl Fl cached-only 63.Op Fl Fl version 64.Op Fl Fl help 65.Ar principal 66.Nm 67.Op options 68.Fl Fl hostbased 69.Ar principal 70.Nm 71.Op options 72.Fl Fl hostbased 73.Ar service 74.Ar hostname 75.Ar [extra-components] 76.Sh DESCRIPTION 77.Nm 78obtains a ticket for the given service principal. 79Usually tickets for services are obtained automatically when needed 80but sometimes for some odd reason you want to obtain a particular 81ticket or of a special type. 82.Pp 83If 84.Fl Fl hostbased 85is given then the given service principal name will be canonicalized 86(see below). 87.Pp 88The third form constructs a host-based principal from the given service 89name and hostname. The service name "host" is used if the given 90.Ar service 91name in the third usage is the empty string. 92.Pp 93For host-based names, the local host's hostname is used if the given 94.Ar hostname 95is the empty string or if the 96.Ar principal 97has a single component. 98.Pp 99Any additional components will be included, even for host-based service 100principal names, but there are no defaults nor local canonicalization 101rules for additional components. 102.Pp 103Local name canonicalization rules are applied unless the 104.Fl Fl canonical 105option is given. Currently local name canonicalization rules are 106supported only for host-based principal names' hostname component. 107.Pp 108The principal's realm name may be canonicalized by following Kerberos 109referrals from the client principal's home realm if the 110.Fl Fl canonicalize 111option is given or if the local name canonicalization rules are 112configured to use referrals. 113.Pp 114Supported options: 115.Bl -tag -width Ds 116.It Fl Fl canonicalize 117requests that the KDC canonicalize the principal. Currently this only 118canonicalizes the realm by chasing referrals from the user's start 119realm, but in the future this may also enable the KDC to canonicalize 120the complete principal name. 121.It Fl Fl canonical 122turns off local canonicalization of the principal name. 123.It Fl Fl name-type= Ns Ar name-type 124the name-type to use when parsing the principal name. 125.It Fl Fl hostbased 126is short for 127.Fl Fl name-type=srv_hst . 128.It Fl c Ar cache , Fl Fl cache= Ns Ar cache 129the credential cache to use. 130.It Fl Fl delegation-credential-cache= Ns Ar cache 131the credential cache to use for delegation. 132.It Fl e Ar enctype , Fl Fl enctype= Ns Ar enctype 133encryption type to use. 134.It Fl Fl no-transit-check 135requests that the KDC doesn't do transit checking. 136.It Fl Fl no-store 137do not store tickets in the ccache. 138.It Fl Fl cached-only 139do not talk the TGS, search only the ccache. 140.It Fl Fl forwardable 141.It Fl Fl debug 142enables debug output to stderr. 143.It Fl Fl version 144.It Fl Fl help 145.El 146.Pp 147If the 148.Fl Fl canonical 149option is used, then no further canonicalization should be done locally 150by the client (for example, DNS), but if 151.Fl Fl canonicalize 152is used, then the client will ask that the KDC canonicalize the name. 153.Pp 154If the 155.Fl Fl canonicalize 156option is used with 157.Fl Fl hostbased 158a host-based name-type, and 159.Fl Fl canonical 160is not used, then the hostname will be canonicalized according to the 161name canonicalization rules in 162.Va krb5.conf . 163.Pp 164GSS-API initiator applications with host-based services will get the 165same behavior as using the 166.Fl Fl canonicalize 167.Fl Fl hostbased 168options here. 169.Sh SEE ALSO 170.Xr kinit 1 , 171.Xr klist 1 , 172.Xr krb5.conf 5 , 173.Xr krb5_openlog 3 174