25

It it possible to make kinit ask Keychain for password and not me?

3 Answers 3

29

kinit on Mac OS X now (since 10.9, possibly earlier) has built-in support for saving the password to the keychain via the --keychain argument, accomplishing the same thing as paul's answer.

Authenticate using kinit --keychain; the password will be saved upon successful authentication:

kinit --keychain
# or
kinit --keychain [email protected]

Subsequent kinit invocations (which don't require the --keychain argument) will automatically get the saved password from your keychain instead of prompting you to enter it.

2
  • 1
    Wow an option not even mentioned on the kinit man page, and works well. Nice.
    – rogerdpack
    Feb 2, 2018 at 19:24
  • Note that macports' kerberos package may not have the --keychain option available...and is the first on the PATH if installed, but the built-in one does :) kinit: unrecognized option --keychain'
    – rogerdpack
    May 10, 2021 at 17:00
15

Actually it is possible. Let us say you have an account "bob" on the realm "MY.REAL.COM" with password "mypasswd". Then in a Terminal type on one single line

security add-generic-password -a "bob" -l "MY.REAL.COM (bob)" -s "MY.REALM.COM" -w "mypasswd" -c "aapl" -T "/usr/bin/kinit"

This will create an item in your default Keychain named "MY.REALM.COM (bob)" with your Kerberos credentials and kinit it will be authorized to access it. You can add as many -T "/fulpath/program" switches as you want, each will give access to the specific program to use your kerberos credentials. For example -T "/Applications/Mail.app/Contents/MacOS/Mail" will add access for Mail.app.

More details with man security.

After that kinit [email protected] will not prompt you for a password but will get it from the keychain.

2
  • 1
    That is flippin' rad!
    – jathanism
    Mar 7, 2012 at 4:42
  • 1
    I couldn't make this work, however this does work with Miles answer
    – bric3
    Jul 17, 2017 at 8:18
-2

With only kinit, this is impossible.

You'd have to write or have someone else write a separate interface that uses the Keychain Services API to store and access your passwords.

2
  • I just don't understand why Keychain is integrated so it remembers passphrase for ssh key, but can't remember password for kerberos.
    – tig
    Nov 23, 2011 at 8:15
  • It's because no one bothered to program it.
    – surfasb
    Nov 23, 2011 at 11:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .