klist

klist is a command-line utility used to display Kerberos tickets stored in a credentials cache or keytab. It is part of Kerberos implementations such as MIT Kerberos and Heimdal, and a version is also available as klist.exe on Windows. The primary function is to show the tickets that a user or system holds for Kerberos authentication, including Ticket-Granting Tickets (TGTs) and service tickets.

A typical klist invocation lists the tickets currently cached and presents details such as the principal names (for example, user@REALM or service/host@REALM), the start time, end time (validity), and, if applicable, the renewable-until time. This information helps diagnose authentication problems, verify that a valid TGT exists, and confirm that service tickets for specific services are present and valid. Some implementations allow specifying a particular credentials cache with options like -c, or enabling verbose output for more detailed information.

The command is commonly used in troubleshooting Kerberos authentication flows, scripting authentication checks, and during system maintenance to confirm that tickets are renewed and valid after login. In Windows environments, klist.exe serves a similar purpose for Kerberos tickets in the user’s credentials cache.

Security considerations include keeping credentials caches secure, as they grant access to services on behalf of the user. Tickets are time-bound and can be renewed, depending on policy, but improper handling or exposure can lead to unauthorized access. Related commands include kinit (to obtain new tickets) and kdestroy (to destroy the credentials cache).

See also: Kerberos authentication, kinit, kdestroy.