Integrate kerberos and Keychain

Question

It it possible to make kinit ask Keychain for password and not me?

Answer 1

Actually it is possible. Let us say you have an account "bob" on the realm "MY.REAL.COM" with password "mypasswd". Then in a Terminal type on one single line

security add-generic-password -a "bob" -l "MY.REAL.COM (bob)" -s "MY.REALM.COM" -w "mypasswd" -c "aapl" -T "/usr/bin/kinit"

This will create an item in your default Keychain named "MY.REALM.COM (bob)" with your Kerberos credentials and kin it will be authorized to access it. You can add as many -T "/fulpath/program" switches as you want, each will give access to the specific program to use your kerberos credentials. For example -T "/Applications/Mail.app/Contents/MacOS/Mail" will add access for the Mail.app

More details with man security

After that kinit bob@MY.REAL.COM will not prompt you for a password but will get it from the keychain.

Answer 2

With only kinit, this is impossible.

You'd have to write or have someone else write a separate interface that uses the Keychain Services API to store and access your passwords.