KGETCRED(1)

💖 KGETCRED — the kgetcred(1) manual, but make it make sense 💖

okay bestie, welcome to kgetcred, a general commands manual moment. this is the little tool that goes and gets you a ticket for one very specific service. not a vibe, not a maybe, a whole actual ticket. let's get into it 🎀

✨ NAME ✨

kgetcred — get a ticket for a particular service 🎫

✨ SYNOPSIS ✨

kgetcred [--canonicalize] [--canonical] [-c -cache | --cache=cache] [-e
         enctype | --enctype=enctype] [--debug] [-H | --hostbased]
         [--name-type=name-type] [--no-transit-check] [--no-store]
         [--cached-only] [-n | --anonymous] [--version] [--help]
         principal
kgetcred [options] --hostbased principal
kgetcred [options] --hostbased service hostname [extra-components]

three whole ways to call her, pick your fighter 💅

✨ DESCRIPTION ✨

so kgetcred obtains a ticket for the given service principal. normally? tickets for services just happen automatically when something needs one, like magic, no thoughts. but sometimes — for some odd reason — you specifically want one particular ticket, or one of a special type. and that's the moment kgetcred walks in 💅

if --hostbased is given, then the service principal name you handed over will be canonicalized (more on that below, stay with me).

the third form builds a host-based principal out of the given service name and hostname. and listen: if the service name in that third usage is the empty string, the service name "host" gets used instead. okay? iconic.

for host-based names, the local host's hostname is used if the given hostname is the empty string, or if the principal only has a single component.

any additional components get included too — yes, even for host-based service principal names — but heads up, there are no defaults and no local canonicalization rules for additional components. they're on their own fr fr.

local name canonicalization rules are applied unless --canonical is given. and currently? those local name canonicalization rules are only supported for the hostname component of host-based principal names. that's it. that's the whole support list 🫶

the principal's realm name may get canonicalized by following Kerberos referrals from the client principal's home realm — this happens if the --canonicalize option is given, or if the local name canonicalization rules are configured to use referrals.

supported options, in order, no skipping, we don't do that here:

• --canonicalize — requests that the KDC canonicalize the principal. currently this only canonicalizes the realm by chasing referrals from the user's start realm, but in the future it may also let the KDC canonicalize the complete principal name. so, like, watch this space.
• --canonical — turns off local canonicalization of the principal name. bye girl 👋
• --name-type=name-type — the name-type to use when parsing the principal name.
• --hostbased — is short for --name-type=srv_hst. that's the whole thing, it's an abbreviation, slay.
• *-c *cache, --cache=cache — the credential cache to use.
• *--delegation-credential-cache=cache* — the credential cache to use for delegation.
• *-e *enctype, --enctype=enctype — encryption type to use.
• --no-transit-check — requests that the KDC doesn't do transit checking.
• --no-store — do not store tickets in the ccache.
• --cached-only — do not talk the TGS, search only the ccache. no chatting, just looking 🔍
• --anonymous — obtain an anonymous service ticket.
• --forwardable — (no notes in the original, she's mysterious 💀)
• --debug — enables debug output to stderr.
• --version — (also no description given, iykyk)
• --help — (same, no description, but you know what to do bestie)

okay now the canonicalization lore, because it's lowkey the whole point:

if the --canonical option is used, then no further canonicalization should be done locally by the client (for example, DNS). but if --canonicalize is used instead, then the client will ask the KDC to canonicalize the name. different vibes, different jobs ✨

if the --canonicalize option is used together with --hostbased a host-based name-type, and --canonical is not used, then the hostname will be canonicalized according to the name canonicalization rules in krb5.conf.

and here's a cute one: GSS-API initiator applications with host-based services will get the same behavior as using the --canonicalize --hostbased options here. so they're basically doing this exact move, just without telling you 🦋

✨ SEE ALSO ✨

kinit(1), klist(1), krb5.conf(5), krb5_openlog(3)

go read those too, they're all besties 🫶

and that's the whole page, no crumbs left. this one came out of the HEIMDAL crew, dated March 12, 2004 — yes she's vintage, and yes she still ate 💅👑✨