6.3. Using kinit to log in to IdM manually

Procedure

• To log in under the user name of the user who is currently logged in on the local system, use kinit without specifying a user name. For example, if you are logged in as <example_user> on the local system:

  [example_user@server ~]$ kinit
  Password for example_user@EXAMPLE.COM:
  [example_user@server ~]$

  If the user name of the local user does not match any user entry in IdM, the authentication attempt fails:

  [example_user@server ~]$ kinit
  kinit: Client 'example_user@EXAMPLE.COM' not found in Kerberos database while getting initial credentials

• To use a Kerberos principal that does not correspond to your local user name, pass the required user name to the kinit utility. For example, to log in as the admin user:

  [example_user@server ~]$ kinit admin
  Password for admin@EXAMPLE.COM:
  [example_user@server ~]$

  注意

  Requesting user tickets using kinit -kt KDB: user@EXAMPLE.COM is disabled. For more information, see the Why kinit -kt KDB: user@EXAMPLE.COM no longer work after CVE-2024-3183 solution.

Verification

• To verify that the login was successful, use the klist utility to display the cached TGT. In the following example, the cache contains a ticket for the example_user principal, which means that on this particular host, only example_user is currently allowed to access IdM services:

  $ klist
  Ticket cache: KEYRING:persistent:0:0
  Default principal: example_user@EXAMPLE.COM
  
  Valid starting     	Expires            	Service principal
  11/10/2019 08:35:45  	11/10/2019 18:35:45  	krbtgt/EXAMPLE.COM@EXAMPLE.COM