K5IDENTITY(5)

💅 k5identity — Kerberos V5 client principal selection rules 🎀

okay so this is K5IDENTITY(5) from the MIT Kerberos manual, and bestie, it's genuinely one of the cutest little config files ever. let's get into it ✨

---

🌸 NAME 🌸

k5identity — the Kerberos V5 client principal selection rules. it's giving "who am I gonna be today" but for your credentials 💅

---

🦋 DESCRIPTION 🦋

so the .k5identity file lives in your home directory (yes, your home directory, it's a whole personal vibe) and it's basically a list of rules for picking which client principal to use based on which server you're hitting up. these rules get used to choose a credential cache inside the cache collection when that's possible. very main character energy 👑

blank lines are ignored. lines starting with # are ignored too. so you can comment and breathe, it's fine 🫶

every line has this shape:

principal field=value ...

if the server principal satisfies all the field constraints on a line, then that line's principal wins and becomes your client principal. slay. the fields it recognizes are:

• realm — if the realm of the server principal is actually known, it gets matched against value, and value can be a pattern using shell wildcards. ✨ heads up though: for host-based server principals, the realm is generally only known if there's a [domain_realm] section in krb5.conf with a mapping for that hostname. no mapping, no realm knowledge, no cap 🧢
• service — if the server principal is a host-based principal, its service component gets matched against value, which may be a pattern using shell wildcards. iconic field name tbh 🎀
• host — if the server principal is a host-based principal, its hostname component gets converted to lowercase and then matched against value, which may be a pattern using shell wildcards. lowercase supremacy fr fr 🌈

and here's the rule that actually matters, so listen up 💀 — if the server principal matches the constraints of multiple lines in .k5identity, the principal from the first matching line is used. first come, first served, periodt. and if no line matches? then credentials get selected some other way, like the realm heuristic or the current primary cache. it's not a crisis, it's just a different vibe 🙈

---

🍓 EXAMPLE 🍓

okay here's a real example .k5identity file and honestly it eats 🔥 it picks the client principal alice@KRBTEST.COM whenever the server principal is inside that realm, picks alice/root@EXAMPLE.COM when the server host is inside a servers subdomain, and picks alice/mail@EXAMPLE.COM when you're accessing the IMAP service on mail.example.com:

alice@KRBTEST.COM       realm=KRBTEST.COM
alice/root@EXAMPLE.COM  host=*.servers.example.com
alice/mail@EXAMPLE.COM  host=mail.example.com service=imap

see how it's just vibes and wildcards? obsessed 💖

---

🧚 SEE ALSO 🧚

• kerberos(1)
• krb5.conf

go read those too, iykyk 👑

---

⭐ AUTHOR ⭐

MIT — the whole thing 💜

---

🌸 COPYRIGHT 🌸

1985-2026, MIT

---

and that's the whole page bestie 🫶 written by MIT, from the MIT Kerberos fam, version 1.22.2 — mwah, go forth and select your principals 💅✨🎀