Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to be able to take advantage of Kerberos without having to join my machine to the domain.

Why? Because this is a personal machine and we are not allowed to join them the corporate domain (nor we can).

share|improve this question
OS X sets up KDC automagically and uses it internally whether you join a domain or not. What specifically are you trying to do? Kerberos is there to use unless your installation has disabled it or configured it to not work in some manner. – bmike Sep 4 '12 at 14:50
Is there a way to tell OS X which user/password to user for kerberos if it happens for you not to have the same user or password on your local machine? – sorin Sep 4 '12 at 14:53
@bmike so kerberos client is not configured automatically, it cannot be as it doesn't know your domain. I was able to obtain a ticket from the command line and to authenticate using CURL. The ticket is visible in Ticket Viewer but no browser is using it. As soon I have a solution I will update, any hints would be more than welcomed. – sorin May 6 '14 at 12:20
I took your "take advantage of kerberos without joining a domain" as you were in stand alone mode only. Clearly, if you need to access the Authentication Server that is remote if you want to get a ticket from that server for use on the local host. I think you need OS X server to have a minimal KDC set up, so my "automagically" isn't going to help on non Macs. Do post your setup once you have something worked out. I'm curious how many realms you have set up and what specific client setup works in that case. – bmike May 6 '14 at 12:44
up vote 1 down vote accepted

Here is my partial success so far. I was able to setup Kerberos authentication but only on Firefox and Google Chrome, on Safari it doesn't work and it seems to be impossible to make it work without really joining the domain.

OS X Kerberos Setup

>kinit username@EXAMPLE.COM

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: user@EXAMPLE.COM
Valid starting     Expires            Service principal
06/05/14 11:36:00  06/05/14 21:36:06  krbtgt/EXAMPLE.COM@EXAMPLE.COM
        renew until 07/05/14 11:36:00

Now you can use /System/Library/CoreServices/Ticket to view the ticket, or to renew it when it expires.


 curl -v --negotiate -u : -b ~/cookiejar.txt -c ~/cookiejar.txt --output /dev/null


go to about:config and configure network.negotiate-auth.trusted-uris:


defaults write AuthServerWhitelist "*"
defaults write AuthNegotiateDelegateWhitelist "*"

Safari [broken!]

Base on it seems that Safari will use SPNEGO only when it is joined into the domain. Otherwise it will only try NTLM which is probably disabled as being insecure.

Any contributions are more than welcomed!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.