KINIT(1)

NAME
kinit - obtain and cache Kerberos ticket-granting ticket

SYNOPSIS

kinit
    [-l lifetime] [-s start_time] [-v] [-p|--proxiable|--noproxiable] [-f|--forwardable|--noforwardable] [-k [-t keytab_file]] [-r renewable_life] [-R] [-c cache_name] [-S service_name] [principal] [--version]

DESCRIPTION
kinit obtains and caches an initial ticket-granting ticket for principal.

OPTIONS

-l lifetime
    requests a ticket with the lifetime lifetime. The value for lifetime must be followed immediately by one of the following delimiters:

    s  seconds
    m  minutes
    h  hours
    d  days

    as in "kinit -l 90m". You cannot mix units; a value of `3h30m' will result in an error.

    If the -l option is not specified, the default ticket lifetime (configured by each site) is used. Specifying a ticket lifetime longer than the maximum ticket lifetime (configured by each site) results in a ticket with the maximum lifetime.

-s start_time
    requests a postdated ticket, valid starting at start_time. Postdated tickets are issued with the invalid flag set, and need to be fed back to the kdc before use.

-v  requests that the ticket granting ticket in the cache (with the invalid flag set) be passed to the kdc for validation. If the ticket is within its requested time range, the cache is replaced with the validated ticket.

-p | --proxiable | --noproxiable
    The -p and --proxiable flags request proxiable tickets. The --noproxiable flag explicitly requests non-proxiable tickets, which is useful for overriding the application defaults in the host's krb5.conf(5) file.

-f | --forwardable | --noforwardable
    The -f and --forwardable flags requests forwardable tickets. The --noforwardable flag explicitly requests non-forwardable tickets, which is useful for overriding the application defaults in the host's krb5.conf(5) file.

-r renewable_life
    requests renewable tickets, with a total lifetime of renewable_life. The duration is in the same format as the -l option, with the same delimiters.

-R  requests renewal of the ticket-granting ticket. Note that an expired ticket cannot be renewed, even if the ticket is still within its renewable life.

-k [-t keytab_file]
    requests a host ticket, obtained from a key in the local host's keytab file. The name and location of the keytab file may be specified with the -t keytab_file option; otherwise the default name and location will be used.

-c cache_name
    use cache_name as the credentials (ticket) cache name and location; if this option is not used, the default cache name and location are used.

    The default credentials cache may vary between systems. If the KRB5CCNAME environment variable is set, its value is used to name the default ticket cache. Any existing contents of the cache are destroyed by kinit.

-S service_name
    specify an alternate service name to use when getting initial tickets.

--version
    Prints out the KerbNet release version of the binary and then exits.

CONFIGURATION
Kinit can be configured in the [libdefaults] section of the krb5.conf(5) file. Kinit utilizes the forwardable, proxiable, and renew_lifetime flags. (See krb5.conf(5) for an explanation of these flags.)

ENVIRONMENT
Kinit uses the following environment variable:

KRB5CCNAME
    Location of the credentials (ticket) cache.

FILES

/tmp/krb5cc_[uid]
    default credentials cache ([uid] is the decimal UID of the user).

/etc/v5srvtab
    default location for the local host's keytab file.

/etc/krb5.conf
    file containing local host's Kerberos V5 configuration information

SEE ALSO
klist(1), kdestroy(1), krb5(3), krb5.conf(5)