KDB5_ANADD(8)

NAME
kdb5_anadd - manipulate aname/lname translation database

SYNOPSIS
kdb5_anadd [ -a ] [ -n dbname ] kerberos_principal local_name
kdb5_anadd -d [ -n dbname ] kerberos_principal

DESCRIPTION
kdb5_anadd is a primitive tool for manipulating a database which maps kerberos principals into user accounts on the local machine. By default, Kerberos assumes that a kerberos principal "username@LOCALREALM" maps into the account "username" on the local machine. However, this assumption is not always true.

In order accomodate systems which have local usernames which are not the same as Kerberos principals, the system administrator can use krb5_anadd to set up mappings between a kerberos name and a local account name. (If this database is established using then Kerberos will not do the default mapping; you will have to specify each mapping between a Kerberos principal and username manually).

For example, the following mapping can be established by "joechen@ATHENA.MIT.EDU" maps to "joe" by using the command:

krb5_adadd jochen@ATHENA.MIT.EDU joe

After this command, if joechen@ATHENA.MIT.EDU tries to do an authenticated rlogin to the account "joe" on that machine, the Kerberos access control mechanism will allow the login, since joechen@ATHENA.MIT.EDU is considered to be the local user "joe".

The -d option deletes translations from the database; after execution the principal named by pname will not translate to any local name.

For both uses, the -n dbname option specifies the name of the database which holds the translation; the default database is DEFAULT_LNAME_FILENAME (usually /krb5/aname).

SEE ALSO
krb5(3) krb5_aname_to_localname (3)

BUGS
The mapping is many-to-one, not many-to-many.