diff options
| author | Sam Hartman <hartmans@mit.edu> | 2010-01-04 19:59:25 +0000 |
|---|---|---|
| committer | Sam Hartman <hartmans@mit.edu> | 2010-01-04 19:59:25 +0000 |
| commit | 5cc1fcb345d57e7ac9203ab1d92a0a509de9193f (patch) | |
| tree | 2fc6edfec2b5af75821acaad73027475e3ebc39f /src/kadmin/cli/kadmin.M | |
| parent | 4c2630eb315e962261c4f02e629c18e288c69060 (diff) | |
| download | krb5-5cc1fcb345d57e7ac9203ab1d92a0a509de9193f.tar.gz krb5-5cc1fcb345d57e7ac9203ab1d92a0a509de9193f.tar.xz krb5-5cc1fcb345d57e7ac9203ab1d92a0a509de9193f.zip | |
Anonymous documentation
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23583 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/kadmin/cli/kadmin.M')
| -rw-r--r-- | src/kadmin/cli/kadmin.M | 21 |
1 files changed, 20 insertions, 1 deletions
diff --git a/src/kadmin/cli/kadmin.M b/src/kadmin/cli/kadmin.M index f7109ceb97..d6f2df5224 100644 --- a/src/kadmin/cli/kadmin.M +++ b/src/kadmin/cli/kadmin.M @@ -9,7 +9,7 @@ kadmin \- Kerberos V5 database administration program [\fB\-r\fP \fIrealm\fP] [\fB\-p\fP \fIprincipal\fP] [\fB\-q\fP \fIquery\fP] .br [[\fB-c\fP \fIcache_name\fP] | [\fB-k\fP [\fB-t\fP -\fIkeytab\fP]]] [\fB\-w\fP \fIpassword\fP] [\fB\-s\fP +\fIkeytab\fP]] | \fB-n\fP] [\fB\-w\fP \fIpassword\fP] [\fB\-s\fP \fIadmin_server\fP[\fI:port\fP] .TP "\w'.B kadmin.local\ 'u" .B kadmin.local @@ -114,6 +114,25 @@ Use to decrypt the KDC response. This can only be used with the .B \-k option. +\fB-n\fP +Requests anonymous processing. Two types of anonymous principals are +supported. For fully anonymous Kerberos, configure pkinit on the KDC +and configure +.I pkinit_anchors +in the client's krb5.conf. Then use the +.B -n +option with a principal of the form +.I @REALM +(an empty principal name followed by the at-sign and a realm name). +If permitted by the KDC, an anonymous ticket will be returned. +A second form of anonymous tickets is supported; these realm-exposed +tickets hide the identity of the client but not the client's realm. +For this mode, use +.B kinit -n +with a normal principal name. If supported by the KDC, the principal +(but not realm) will be replaced by the anonymous principal. +As of release 1.8, the MIT Kerberos KDC only supports fully anonymous +operation. .TP \fB\-c\fP \fIcredentials_cache\fP Use |