How can I use Automator to generate a kerberos ticket using KINIT?

Question

I need to be able to generate a kerberos ticket for my MacBook Pro each time the machine restarts. I can manually run KINIT with my credentials to generate a ticket. What is the best way to automate that process?

Answer 1

You can easily package shell commands inside an Automator application (or service) using the “Run Shell Script” action. However, this will run the commands in a non-interactive shell (for an explanation of the difference between interactive and non-interactive shells, see the pertinent section of the Advanced Bash Scripting Guide – simply put, you will not have access to the terminal for the password prompt, and if kinit is not aware of this, your script will hang). There are two ways around that:

1. script Terminal.app to execute your command instead of executing it directly. In that case, you will need a “Run AppleScript” action instead, containing the following command:

   tell application "Terminal" to do script "kinit <options>"
   

   which will open a new Terminal tab running the given command.

2. use kinit’s --password-file option and pass it the password inside your workflow, i.e.

   echo <password> | kinit --passwordfile=STDIN <options>
   

   To avoid storing your password in plain text inside the workflow, you can securely store it in the OS X Keychain and retrieve it from there. Although possible via a shell script (the TextMate blog has details on how to achieve that – be sure to read the comments), there are so many gotchas to that I’d recommend using a bit of AppleScript and Daniel Jalkut’s excellent Usable Keychain Scripting app. Once installed, the following bit of AppleScript will retrieve your password (assuming the account name is “kinit”):

   tell application "Usable Keychain Scripting" to get password of first generic item of current keychain whose account is "kinit"
   

   Either wrap it in an osascript shell command, i.e.

   passphrase=$(osascript -e '<command above>')
   

   or, as you are using Automator, add an AppleScript action, retrieve the passphrase inside it and pass it to the shell script.

Answer 2

Just wanna chime in; i didn't fancy putting my password into the keychain so i wrote a quick applescript to pick up from a user prompt:

on run {input, parameters}
tell application "System Events"
    set the_username to do shell script "whoami"
    set the_password to "password"
    display dialog "Enter password" default answer "password" buttons {"OK", "Cancel"} default button "OK" with icon 2 with title "SLAC Kerberos" with hidden answer
    set the_password to text returned of the result
end tell
return {the_username, the_password}
end run

of course, you probably wanna put the domain into your username too. and then, from a shell script you can do something like:

echo $2 | kinit --password-file=STDIN $1

what would be nice would be to check the output form the shell script to check for incorrect passwords etc.