Start line:  
End line:  

Snippet Preview

Snippet HTML Code

Stack Overflow Questions
   * Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
   * This code is free software; you can redistribute it and/or modify it
   * under the terms of the GNU General Public License version 2 only, as
   * published by the Free Software Foundation.  Oracle designates this
   * particular file as subject to the "Classpath" exception as provided
   * by Oracle in the LICENSE file that accompanied this code.
  * This code is distributed in the hope that it will be useful, but WITHOUT
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  * version 2 for more details (a copy is included in the LICENSE file that
  * accompanied this code).
  * You should have received a copy of the GNU General Public License version
  * 2 along with this work; if not, write to the Free Software Foundation,
  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  * or visit if you need additional information or have any
  * questions.
  *  (C) Copyright IBM Corp. 1999 All Rights Reserved.
  *  Copyright 1997 The Open Group Research Institute.  All rights reserved.
Kinit tool for obtaining Kerberos v5 tickets.

Yanni Zhang
Ram Marti
 public class Kinit {
     private KinitOptions options;
     private static final boolean DEBUG = .;

The main method is used to accept user command line input for ticket request.

Usage: kinit [-A] [-f] [-p] [-c cachename] [[-k [-t keytab_file_name]] [principal] [password]

  • -A do not include addresses
  • -f forwardable
  • -p proxiable
  • -c cache name (i.e., FILE://c:\temp\mykrb5cc)
  • -k use keytab
  • -t keytab file name
  • principal the principal name (i.e.,
  • password the principal's Kerberos password

Use java -help to bring up help menu.

We currently support only file-based credentials cache to store the tickets obtained from the KDC. By default, for all Unix platforms a cache file named /tmp/krb5cc_<uid&gt will be generated. The <uid&gt is the numeric user identifier. For all other platforms, a cache file named <USER_HOME&gt/krb5cc_<USER_NAME&gt would be generated.

<USER_HOME&gt is obtained from java.lang.System property user.home. <USER_NAME&gt is obtained from java.lang.System property If <USER_HOME&gt is null the cache file would be stored in the current directory that the program is running from. <USER_NAME&gt is operating system's login username. It could be different from user's principal name.

For instance, on Windows NT, it could be c:\winnt\profiles\duke\krb5cc_duke, in which duke is the <USER_NAME&gt, and c:\winnt\profile\duke is the <USER_HOME&gt.

A single user could have multiple principal names, but the primary principal of the credentials cache could only be one, which means one cache file could only store tickets for one specific user principal. If the user switches the principal name at the next Kinit, the cache file generated for the new ticket would overwrite the old cache file by default. To avoid overwriting, you need to specify a different cache file name when you request a new ticket.

You can specify the location of the cache file by using the -c option

    public static void main(String[] args) {
        try {
            Kinit self = new Kinit(args);
        catch (Exception e) {
            String msg = null;
            if (e instanceof KrbException) {
                msg = ((KrbException)e).krbErrorMessage() + " " +
            } else  {
                msg = e.getMessage();
            if (msg != null) {
                ..println("Exception: " + msg);
            } else {
                ..println("Exception: " + e);

Constructs a new Kinit object.

args array of ticket request options. Avaiable options are: -f, -p, -c, principal, password.
Throws: if an I/O error occurs. if the Realm could not be instantiated. if error occurs during Kerberos operation.
    private Kinit(String[] args)
        throws IOExceptionRealmExceptionKrbException {
        if (args == null || args.length == 0) {
             = new KinitOptions();
        } else {
             = new KinitOptions(args);
        String princName = null;
        PrincipalName principal = .getPrincipal();
        if (principal != null) {
            princName = principal.toString();
        KrbAsReqBuilder builder;
        if () {
            ..println("Principal is " + principal);
        char[] psswd = .;
        boolean useKeytab = .useKeytabFile();
        if (!useKeytab) {
            if (princName == null) {
                throw new IllegalArgumentException
                    (" Can not obtain principal name");
            if (psswd == null) {
                ..print("Password for " + princName + ":");
                psswd = Password.readPassword(.);
                if () {
                    ..println(">>> Kinit console input " +
                        new String(psswd));
            builder = new KrbAsReqBuilder(principalpsswd);
        } else {
            if () {
                ..println(">>> Kinit using keytab");
            if (princName == null) {
                throw new IllegalArgumentException
                    ("Principal name must be specified.");
            String ktabName = .keytabFileName();
            if (ktabName != null) {
                if () {
                                       ">>> Kinit keytab file name: " + ktabName);
            builder = new KrbAsReqBuilder(principalktabName == null
                    ? KeyTab.getInstance()
                    : KeyTab.getInstance(new File(ktabName)));
        KDCOptions opt = new KDCOptions();
        String realm = .getKDCRealm();
        if (realm == null) {
            realm = Config.getInstance().getDefaultRealm();
        if () {
            ..println(">>> Kinit realm name is " + realm);
        PrincipalName sname = new PrincipalName("krbtgt" + "/" + realm,
        if () {
            ..println(">>> Creating KrbAsReq");
        if (.getAddressOption())
        builder.action(); credentials =
        // we always create a new cache and store the ticket we get
        CredentialsCache cache =
        if (cache == null) {
           throw new IOException("Unable to create the cache file " +
        if (. == null) {
            // Assume we're running interactively
            ..println("New ticket is stored in cache file " +
         } else {
        // clear the password
        if (psswd != null) {
         = null// release reference to options
    private static void setOptions(int flagint optionKDCOptions opt) {
        switch (option) {
        case 0:
        case -1:
        case 1:
New to GrepCode? Check out our FAQ X