Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

It it possible to make kinit ask Keychain for password and not me?

share|improve this question

2 Answers 2

Actually it is possible. Let us say you have an account "bob" on the realm "MY.REAL.COM" with password "mypasswd". Then in a Terminal type on one single line

security add-generic-password -a "bob" -l "MY.REAL.COM (bob)" -s "MY.REALM.COM" -w "mypasswd" -c "aapl" -T "/usr/bin/kinit"

This will create an item in your default Keychain named "MY.REALM.COM (bob)" with your Kerberos credentials and kinit it will be authorized to access it. You can add as many -T "/fulpath/program" switches as you want, each will give access to the specific program to use your kerberos credentials. For example -T "/Applications/Mail.app/Contents/MacOS/Mail" will add access for Mail.app.

More details with man security.

After that kinit bob@MY.REAL.COM will not prompt you for a password but will get it from the keychain.

share|improve this answer
That is flippin' rad! –  jathanism Mar 7 '12 at 4:42

With only kinit, this is impossible.

You'd have to write or have someone else write a separate interface that uses the Keychain Services API to store and access your passwords.

share|improve this answer
I just don't understand why Keychain is integrated so it remembers passphrase for ssh key, but can't remember password for kerberos. –  tig Nov 23 '11 at 8:15
It's because no one bothered to program it. –  surfasb Nov 23 '11 at 11:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.