Skip to content

Authenticating with Kerberos

Kerberos is a network authentication protocol supported by a number of IGWN Computing services. Users can generate a ticket-granting ticket tied to their identity that can be used to authenticate against services.

Only LIGO.ORG accounts are configured for use with Kerberos

At this time, only LIGO.ORG accounts can be used with Kerberos; KAGRA and Virgo identities are not supported.

Installing the Kerberos tools

The Kerberos command-line tools can be installed using your preferred package manager:

choco install mitkerberos
conda install --channel conda-forge krb5
apt-get install krb5-user
yum install krb5-workstation

How to generate a credential

Kerberos for LIGO.ORG

LIGO.ORG identity holders can generate Kerberos credentials using the kinit command-line tool from the MIT Kerberos (krb5) distribution:

kinit albert.einstein@LIGO.ORG

Password-less authentication using a Kerberos keytab

Credentials can be stored in a keytab file to enable (re-)generation of Kerberos tickets without having to re-enter a password each time.

To generate a keytab file:

$ ktutil
ktutil:  addent -password -p albert.einstein@LIGO.ORG -k 1 -e aes256-cts-hmac-sha1-96
Password for albert.einstein@LIGO.ORG:
ktutil:  wkt
ktutil:  quit

This will generate the file in the current directory, feel free then to move it wherever you want.

It is common then to store the path of that file in the KRB5_KTNAME environment variable, e.g.:

export KRB5_KTNAME=${HOME}/.kerberos/

Check permissions on Kerberos keytab

A Kerberos keytab can be used by anybody to impersonate the user who created it. It is extremely important that you verify that the permissions on your keytab file ( in the above example) are restricted to only allow read/write for you, the user:

chmod 600

ktutil not available on Windows

The ktutil utility required to generate keytabs is not available from MIT Kerberos on Windows.