kinit

kinit is a Kerberos client utility used to obtain and cache a Kerberos Ticket-Granting Ticket (TGT) for a principal. By contacting the Key Distribution Center (KDC), kinit authenticates the user and issues a TGT, which serves as a credential to request service tickets for access to protected network services.

In typical use, a user can obtain a TGT interactively by running kinit principal@REALM and entering a password. For automated environments, kinit can use a keytab file (for example, kinit -k -t keytab file principal@REALM) to obtain tickets without prompting for a password. Tickets are stored in a credentials cache (ccache), which can be directed or named differently with options such as -c. The TGT and any derived service tickets allow access to resources like SSH, HTTP, or file services, until the tickets expire or are renewed according to policy.

Managing and inspecting tickets is commonly done with klist, which shows current credentials and their lifetimes, and kdestroy, which destroys the credentials cache when no longer needed. Kerberos tickets have a defined lifetime and may be renewable, subject to the realm’s policy; kinit can request tickets with appropriate lifetimes in supported environments.

kinit is part of Kerberos client suites provided by implementations such as MIT Kerberos and Heimdal. It is widely used on Unix-like systems and integrated into enterprise authentication workflows, enabling single sign-on across trusted services within a Kerberos realm.