It it possible to make kinit
ask Keychain for password and not me?
3 Answers
kinit
on Mac OS X now (since 10.9, possibly earlier) has built-in support for saving the password to the keychain via the --keychain
argument, accomplishing the same thing as paul's answer.
Authenticate using kinit --keychain
; the password will be saved upon successful authentication:
kinit --keychain
# or
kinit --keychain [email protected]
Subsequent kinit
invocations (which don't require the --keychain
argument) will automatically get the saved password from your keychain instead of prompting you to enter it.
-
1Wow an option not even mentioned on the
kinit
man page, and works well. Nice. Feb 2, 2018 at 19:24 -
Note that macports' kerberos package may not have the --keychain option available...and is the first on the PATH if installed, but the built-in one does :)
kinit: unrecognized option --keychain'
May 10, 2021 at 17:00
Actually it is possible. Let us say you have an account "bob" on the realm "MY.REAL.COM" with password "mypasswd". Then in a Terminal type on one single line
security add-generic-password -a "bob" -l "MY.REAL.COM (bob)" -s "MY.REALM.COM" -w "mypasswd" -c "aapl" -T "/usr/bin/kinit"
This will create an item in your default Keychain named "MY.REALM.COM (bob)" with your Kerberos credentials and kinit it will be authorized to access it. You can add as many -T "/fulpath/program"
switches as you want, each will give access to the specific program to use your kerberos credentials. For example -T "/Applications/Mail.app/Contents/MacOS/Mail"
will add access for Mail.app.
More details with man security
.
After that kinit [email protected]
will not prompt you for a password but will get it from the keychain.
-
1
-
1
With only kinit, this is impossible.
You'd have to write or have someone else write a separate interface that uses the Keychain Services API to store and access your passwords.
-
I just don't understand why Keychain is integrated so it remembers passphrase for ssh key, but can't remember password for kerberos.– tigNov 23, 2011 at 8:15
-