## SYNOPSIS

           kinit  [-5] [-4] [-V] [-l lifetime] [-s start_time] [-r renewable_life]
                  [-p | -P] [-f | -F] [-a] [-A] [-v] [-R] [-k [-t keytab_file]]
                  [-c cache_name] [-S service_name] [-X attribute[=value]] [prin-
                  cipal]

## DESCRIPTION

           kinit obtains and caches an initial ticket-granting ticket for  princi-
           pal.   The typical default behavior is to acquire only Kerberos 5 tick-
           ets.  However, if kinit was built with both Kerberos 4 support and with
           the default behavior of acquiring both types of tickets, it will try to
           acquire both Kerberos 5 and Kerberos 4 by default.   Any  documentation
           particular  to  Kerberos 4 does not apply if Kerberos 4 support was not
           built into kinit.

## OPTIONS

           -5     get Kerberos 5 tickets.  This  overrides  whatever  the  default
                  built-in behavior may be.  This option may be used with -4

           -4     get  Kerberos  4  tickets.   This overrides whatever the default
                  built-in behavior may be.  This  option  is  only  available  if
                  kinit  was built with Kerberos 4 compatibility.  This option may
                  be used with -5

           -V     display verbose output.

           -l lifetime
                  requests a ticket with the lifetime  lifetime.   The  value  for
                  lifetime  must  be  followed immediately by one of the following
                  delimiters:

                     s  seconds
                     m  minutes
                     h  hours
                     d  days

                  as in "kinit -l 90m".  You cannot mix units; a value of  `3h30m'
                  will result in an error.

                  If  the  -l option is not specified, the default ticket lifetime
                  (configured by each site) is used.  Specifying a ticket lifetime
                  longer  than  the  maximum  ticket  lifetime (configured by each
                  site) results in a ticket with the maximum lifetime.

           -s start_time
                  requests a  postdated  ticket,  valid  starting  at  start_time.
                  Postdated tickets are issued with the invalid flag set, and need
                  to be fed back to the kdc before use.  (Not applicable  to  Ker-
                  beros 4.)

           -r renewable_life
                  requests  renewable  tickets,  with  a  total lifetime of renew-
                  Kerberos 4.)

           -A     request address-less tickets.  (Not applicable to Kerberos 4.)

           -v     requests that the ticket granting ticket in the cache (with  the
                  invalid  flag  set) be passed to the kdc for validation.  If the
                  ticket is within its requested time range, the cache is replaced
                  with the validated ticket.  (Not applicable to Kerberos 4.)

           -R     requests  renewal  of  the ticket-granting ticket.  Note that an
                  expired ticket cannot be renewed, even if the  ticket  is  still
                  within its renewable life.  When using this option with Kerberos
                  4, the kdc must support Kerberos 5 to Kerberos 4 ticket  conver-
                  sion.

           -k [-t keytab_file]
                  requests  a host ticket, obtained from a key in the local host's
                  keytab file.  The name and location of the keytab  file  may  be
                  specified  with the -t keytab_file option; otherwise the default
                  name and location will be used.  When  using  this  option  with
                  Kerberos 4, the kdc must support Kerberos 5 to Kerberos 4 ticket
                  conversion.

           -c cache_name
                  use cache_name as the Kerberos 5 credentials (ticket) cache name
                  and location; if this option is not used, the default cache name
                  and location are used.

                  The default credentials cache may vary between systems.  If  the
                  KRB5CCNAME  environment  variable  is  set, its value is used to
                  name the default ticket cache.  Any  existing  contents  of  the
                  cache  are destroyed by kinit.  (Note: The default name for Ker-
                  beros 4 comes from the  KRBTKFILE  environment  variable.   This
                  option does not apply to Kerberos 4.)

           -S service_name
                  specify  an  alternate  service name to use when getting initial
                  tickets.  (Applicable to Kerberos 5 or if using both Kerberos  5
                  and Kerberos 4 with a kdc that supports Kerberos 5 to Kerberos 4
                  ticket conversion.)

           -X attribute[=value]
                  specify a pre-authentication attribute and value to be passed to
                  pre-authentication  plugins.  The acceptable attribute and value
                  values vary from  pre-authentication  plugin  to  plugin.   This
                  option  may  be  specified  multiple  times  to specify multiple
                  attributes.  If no value is  specified,  it  is  assumed  to  be
                  "yes".

                  The following attributes are recognized by the OpenSSL pkinit
                  pre-authentication mechanism:
                     X509_user_identity=value

## FILES

           /tmp/krb5cc_[uid]  default location of  Kerberos  5  credentials  cache
                              ([uid] is the decimal UID of the user).

           /tmp/tkt[uid]  default  location of Kerberos 4 credentials cache ([uid]
                          is the decimal UID of the user).

           /etc/krb5.keytab
                          default location for the local host's keytab file.

## SEE ALSO

           klist(1), kdestroy(1), kerberos(1)

                                                                          KINIT(1)