---
name: "krb5_kuserok"
section: "3"
platform: "linux"
package: "heimdal-dev"
version: "1.2.dfsg.1-2.1+lenny1"
release: "Debian 5.0 (Lenny)"
platforms: ["linux"]
url: "https://new.carta.tech/krb5_kuserok"
---

# krb5\_kuserok(3)

checks if a principal is permitted to login as a user

## NAME

**krb5\_kuserok** – checks if a principal is permitted to login as a user

## LIBRARY

Kerberos 5 Library (libkrb5, -lkrb5)

## SYNOPSIS

**#include \<krb5.h\>**

*krb5\_boolean*\

**krb5\_kuserok**(*krb5\_context context*, *krb5\_principal principal*, *const char \*user*);

## DESCRIPTION

This function takes the name of a local *user* and checks if *principal* is allowed to log in as that user.

The *user* may have a *~/.k5login* file listing principals that are allowed to login as that user. If that file does not exist, all principals with a first component identical to the username, and a realm considered local, are allowed access.

The *.k5login* file must contain one principal per line, be owned by *user*, and not be writable by group or other (but must be readable by anyone).

Note that if the file exists, no implicit access rights are given to *user*@⟨localrealm⟩.

Optionally, a set of files may be put in *~/.k5login.d* ( a directory), in which case they will all be checked in the same manner as *.k5login*. The files may be called anything, but files starting with a hash “(#”), or ending with a tilde “(~”) are ignored. Subdirectories are not traversed. Note that this directory may not be checked by other implementations.

## RETURN VALUES

**krb5\_kuserok** returns TRUE if access should be granted, FALSE otherwise.

## HISTORY

The *~/.k5login.d* feature appeared in Heimdal 0.7.

## SEE ALSO

[krb5\_get\_default\_realms(3)](/krb5_get_default_realms/3.md), [krb5\_verify\_user(3)](/krb5_verify_user/3.md), [krb5\_verify\_user\_lrealm(3)](/krb5_verify_user_lrealm/3.md), [krb5\_verify\_user\_opt(3)](/krb5_verify_user_opt/3.md), [krb5.conf(5)](/krb5.conf/5.md)