---
name: "kuserok"
section: "3"
platform: "linux"
package: "kerberos4kth-dev"
version: "1.2.2-11.2"
release: "Debian 3.1 (Sarge)"
platforms: ["linux"]
url: "https://new.carta.tech/kuserok"
---

# kuserok(3)

Kerberos version of ruserok

## NAME

kuserok - Kerberos version of ruserok

## SYNOPSIS

```
#include <krb.h>
```

**kuserok(kdata, localuser)** **AUTH\_DAT \*auth\_data;** **char   \*localuser;**

## DESCRIPTION

*kuserok* determines whether a Kerberos principal described by the structure *auth\_data* is authorized to login as user *localuser* according to the authorization file ("~*localuser*/.klogin" by default).  It returns 0 (zero) if authorized, 1 (one) if not authorized.

If there is no account for  *localuser* on the local machine, authorization is not granted. If there is no authorization file, and the Kerberos principal described by  *auth\_data* translates to  *localuser* (using  *krb\_kntoln*(3)), authorization is granted. If the authorization file can't be accessed, or the file is not owned by *localuser,* authorization is denied.  Otherwise, the file is searched for a matching principal name, instance, and realm.  If a match is found, authorization is granted, else authorization is denied.

The file entries are in the format:

```
	name.instance@realm
```

with one entry per line.

For convenience ~localuser@LOCALREALM is always considered to be an entry in the file even when there is no file or the file is unreadable.

## SEE ALSO

[kerberos(3)](/kerberos/3.md), [ruserok(3)](/ruserok/3.md), krb\_kntoln(3)

## FILES

- \~*localuser*/.klogin

  authorization list