From 5cc1fcb345d57e7ac9203ab1d92a0a509de9193f Mon Sep 17 00:00:00 2001
From: Sam Hartman <hartmans@mit.edu>
Date: Mon, 4 Jan 2010 19:59:25 +0000
Subject: Anonymous documentation

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@23583 dc483132-0cff-0310-8789-dd5450dbe970
---
 src/kadmin/cli/kadmin.M | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

(limited to 'src/kadmin/cli/kadmin.M')

diff --git a/src/kadmin/cli/kadmin.M b/src/kadmin/cli/kadmin.M
index f7109ceb97..d6f2df5224 100644
--- a/src/kadmin/cli/kadmin.M
+++ b/src/kadmin/cli/kadmin.M
@@ -9,7 +9,7 @@ kadmin \- Kerberos V5 database administration program
 [\fB\-r\fP \fIrealm\fP] [\fB\-p\fP \fIprincipal\fP] [\fB\-q\fP \fIquery\fP]
 .br
 [[\fB-c\fP \fIcache_name\fP] | [\fB-k\fP [\fB-t\fP
-\fIkeytab\fP]]] [\fB\-w\fP \fIpassword\fP] [\fB\-s\fP
+\fIkeytab\fP]] | \fB-n\fP] [\fB\-w\fP \fIpassword\fP] [\fB\-s\fP
 \fIadmin_server\fP[\fI:port\fP]
 .TP "\w'.B kadmin.local\ 'u"
 .B kadmin.local
@@ -114,6 +114,25 @@ Use
 to decrypt the KDC response.  This can only be used with the
 .B \-k
 option.
+\fB-n\fP
+Requests anonymous processing.  Two types of anonymous principals are
+supported.  For fully anonymous Kerberos, configure pkinit on the KDC
+and configure
+.I pkinit_anchors
+in the client's krb5.conf.  Then use the
+.B -n
+option with a principal of the form
+.I @REALM
+(an empty principal name followed by the at-sign and a realm name).
+If permitted by the KDC, an anonymous ticket will be returned.
+A second form of anonymous tickets is supported; these realm-exposed
+tickets hide the identity of the client but not the client's realm.
+For this mode, use
+.B kinit -n
+with a normal principal name.  If supported by the KDC, the principal
+(but not realm) will be replaced by the anonymous principal.
+As of release 1.8, the MIT Kerberos KDC only supports fully anonymous
+operation.
 .TP
 \fB\-c\fP \fIcredentials_cache\fP
 Use
-- 
cgit