---
name: "kinit.heimdal"
section: "1"
platform: "linux"
package: "heimdal-clients"
version: "7.8.git20221117.28daf24+dfsg-9+deb13u1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/kinit.heimdal"
---

# kinit.heimdal(1)

acquire initial tickets

## NAME

**kinit** – acquire initial tickets

## SYNOPSIS

**kinit** \[**-****-afslog**\] \[**-c** *cachename* **-****-cache=***cachename*\] \[**-f** \| **-****-forwardable**\] \[**-F** \| **-****-no-forwardable**\] \[**-t** *keytabname* **-****-keytab=***keytabname*\] \[**-l** *time* **-****-lifetime=***time*\] \[**-p** \| **-****-proxiable**\] \[**-R** \| **-****-renew**\] \[**-****-renewable**\] \[**-r** *time* **-****-renewable-life=***time*\] \[**-S** *principal* **-****-server=***principal*\] \[**-s** *time* **-****-start-time=***time*\] \[**-k** \| **-****-use-keytab**\] \[**-v** \| **-****-validate**\] \[**-e** *enctypes* **-****-enctypes=***enctypes*\] \[**-a** *addresses* **-****-extra-addresses=***addresses*\] \[**-****-password-file=***filename*\] \[**-****-fcache-version=***version-number*\] \[**-A** \| **-****-no-addresses**\] \[**-n** \| **-****-anonymous**\] \[**-****-enterprise**\] \[**-****-version**\] \[**-****-help**\] \[*principal* \[*command*\]\]

## DESCRIPTION

**kinit** is used to authenticate to the Kerberos server as *principal*, or if none is given, a system generated default (typically your login name at the default realm), and acquire a ticket granting ticket that can later be used to obtain tickets for other services.

Supported options:

- **-c** *cachename* **-****-cache=***cachename*

  The credentials cache to put the acquired ticket in, if other than default.

- **-f** **-****-forwardable**

  Obtain a ticket than can be forwarded to another host.

- **-F** **-****-no-forwardable**

  Do not obtain a forwardable ticket.

- **-t** *keytabname*, **-****-keytab=***keytabname*

  Don't ask for a password, but instead get the key from the specified keytab.

- **-l** *time*, **-****-lifetime=***time*

  Specifies the lifetime of the ticket. The argument can either be in seconds, or a more human readable string like ‘1h’.

- **-p**, **-****-proxiable**

  Request tickets with the proxiable flag set.

- **-R**, **-****-renew**

  Try to renew ticket. The ticket must have the ‘renewable’ flag set, and must not be expired.

- **-****-renewable**

  The same as **-****-renewable-life**, with an infinite time.

- **-r** *time*, **-****-renewable-life=***time*

  The max renewable ticket life.

- **-S** *principal*, **-****-server=***principal*

  Get a ticket for a service other than krbtgt/LOCAL.REALM.

- **-s** *time*, **-****-start-time=***time*

  Obtain a ticket that starts to be valid *time* (which can really be a generic time specification, like ‘1h’) seconds into the future.

- **-k**, **-****-use-keytab**

  The same as **-****-keytab**, but with the default keytab name (normally *FILE:/etc/krb5.keytab*).

- **-v**, **-****-validate**

  Try to validate an invalid ticket.

- **-e**, **-****-enctypes=***enctypes*

  Request tickets with this particular enctype.

- **-****-password-file=***filename*

  read the password from the first line of *filename*. If the *filename* is *STDIN*, the password will be read from the standard input.

- **-****-fcache-version=***version-number*

  Create a credentials cache of version *version-number*.

- **-a**, **-****-extra-addresses=***enctypes*

  Adds a set of addresses that will, in addition to the systems local addresses, be put in the ticket. This can be useful if all addresses a client can use can't be automatically figured out. One such example is if the client is behind a firewall. Also settable via libdefaults/extra\_addresses in [krb5.conf(5)](/krb5.conf/5.md).

- **-A**, **-****-no-addresses**

  Request a ticket with no addresses.

- **-n**, **-****-anonymous**

  Request an anonymous ticket. With the default (false) setting of the *historical\_anon\_pkinit* configuration parameter, if the principal is specified as @REALM, then anonymous PKINIT will be used to acquire an unauthenticated anonymous ticket and both the client name and (with fully RFC-comformant KDCs) realm in the returned ticket will be anonymized. Otherwise, authentication proceeds as normal and the anonymous ticket will have only the client name anonymized. With *historical\_anon\_pkinit* set to true, the principal is interpreted as a realm even without an at-sign prefix, and it is not possible to obtain authenticated anonymized tickets.

- **-****-enterprise**

  Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise names are email like principals that are stored in the name part of the principal, and since there are two @ characters the parser needs to know that the first is not a realm. An example of an enterprise name is “lha@e.kth.se@KTH.SE”, and this option is usually used with canonicalize so that the principal returned from the KDC will typically be the real principal name.

- **-****-afslog**

  Gets AFS tickets, converts them to version 4 format, and stores them in the kernel. Only useful if you have AFS.

The *forwardable*, *proxiable*, *ticket\_life*, and *renewable\_life* options can be set to a default value from the appdefaults section in krb5.conf, see [krb5\_appdefault(3)](/krb5_appdefault/3.md).

If  a *command* is given, **kinit** will set up new credentials caches, and AFS PAG, and then run the given command. When it finishes the credentials will be removed.

## ENVIRONMENT

- KRB5CCNAME

  Specifies the default credentials cache.

- KRB5\_CONFIG

  The file name of *krb5.conf*, the default being */etc/krb5.conf*.

## SEE ALSO

[kdestroy(1)](/kdestroy/1.md), [klist(1)](/klist/1.md), [krb5\_appdefault(3)](/krb5_appdefault/3.md), [krb5.conf(5)](/krb5.conf/5.md)