Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to be able to generate a kerberos ticket for my MacBook Pro each time the machine restarts. I can manually run KINIT with my credentials to generate a ticket. What is the best way to automate that process?

share|improve this question
Does kinit require any manual input from your side? – patrix May 7 '12 at 14:38
Actually, yes. It prompts me for a password. – tlatkovich May 7 '12 at 14:46
Would using --password-file be an option for you? Otherwise it will be difficult to automate. – patrix May 7 '12 at 15:14
I don't mind entering the password. I just want to execute a script through a shortcut of some kind (icon or keyboard) that opens up the terminal app, runs the KINIT command with my domain parameter and gets me to the point of entering in a password. If the script can enter the password for me, even better. – tlatkovich May 7 '12 at 15:23
up vote 2 down vote accepted

You can easily package shell commands inside an Automator application (or service) using the “Run Shell Script” action. However, this will run the commands in a non-interactive shell (for an explanation of the difference between interactive and non-interactive shells, see the pertinent section of the Advanced Bash Scripting Guide – simply put, you will not have access to the terminal for the password prompt, and if kinit is not aware of this, your script will hang). There are two ways around that:

  1. script to execute your command instead of executing it directly. In that case, you will need a “Run AppleScript” action instead, containing the following command:

    tell application "Terminal" to do script "kinit <options>"

    which will open a new Terminal tab running the given command.

  2. use kinit’s --password-file option and pass it the password inside your workflow, i.e.

    echo <password> | kinit --passwordfile=STDIN <options>

    To avoid storing your password in plain text inside the workflow, you can securely store it in the OS X Keychain and retrieve it from there. Although possible via a shell script (the TextMate blog has details on how to achieve that – be sure to read the comments), there are so many gotchas to that I’d recommend using a bit of AppleScript and Daniel Jalkut’s excellent Usable Keychain Scripting app. Once installed, the following bit of AppleScript will retrieve your password (assuming the account name is “kinit”):

    tell application "Usable Keychain Scripting" to get password of first generic item of current keychain whose account is "kinit"

    Either wrap it in an osascript shell command, i.e.

    passphrase=$(osascript -e '<command above>')

    or, as you are using Automator, add an AppleScript action, retrieve the passphrase inside it and pass it to the shell script.

share|improve this answer
Thanks Kopischke! It took me a little time to get up to speed on the ins and outs of Automator and the scripting syntax. Thanks to you I was able to build an Automator app that generates a kerberos ticket for me. I added the app to my login items so it will run every time I login. Booyah! – tlatkovich May 7 '12 at 17:56

Just wanna chime in; i didn't fancy putting my password into the keychain so i wrote a quick applescript to pick up from a user prompt:

on run {input, parameters}
tell application "System Events"
    set the_username to do shell script "whoami"
    set the_password to "password"
    display dialog "Enter password" default answer "password" buttons {"OK", "Cancel"} default button "OK" with icon 2 with title "SLAC Kerberos" with hidden answer
    set the_password to text returned of the result
end tell
return {the_username, the_password}
end run

of course, you probably wanna put the domain into your username too. and then, from a shell script you can do something like:

echo $2 | kinit --password-file=STDIN $1

what would be nice would be to check the output form the shell script to check for incorrect passwords etc.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.