I need to be able to generate a kerberos ticket for my MacBook Pro each time the machine restarts. I can manually run KINIT with my credentials to generate a ticket. What is the best way to automate that process?

  • 1
    Does kinit require any manual input from your side?
    – nohillside
    Commented May 7, 2012 at 14:38
  • Actually, yes. It prompts me for a password.
    – tlatkovich
    Commented May 7, 2012 at 14:46
  • Would using --password-file be an option for you? Otherwise it will be difficult to automate.
    – nohillside
    Commented May 7, 2012 at 15:14
  • I don't mind entering the password. I just want to execute a script through a shortcut of some kind (icon or keyboard) that opens up the terminal app, runs the KINIT command with my domain parameter and gets me to the point of entering in a password. If the script can enter the password for me, even better.
    – tlatkovich
    Commented May 7, 2012 at 15:23

2 Answers 2


You can easily package shell commands inside an Automator application (or service) using the “Run Shell Script” action. However, this will run the commands in a non-interactive shell (for an explanation of the difference between interactive and non-interactive shells, see the pertinent section of the Advanced Bash Scripting Guide – simply put, you will not have access to the terminal for the password prompt, and if kinit is not aware of this, your script will hang). There are two ways around that:

  1. script Terminal.app to execute your command instead of executing it directly. In that case, you will need a “Run AppleScript” action instead, containing the following command:

    tell application "Terminal" to do script "kinit <options>"

    which will open a new Terminal tab running the given command.

  2. use kinit’s --password-file option and pass it the password inside your workflow, i.e.

    echo <password> | kinit --passwordfile=STDIN <options>

    To avoid storing your password in plain text inside the workflow, you can securely store it in the OS X Keychain and retrieve it from there. Although possible via a shell script (the TextMate blog has details on how to achieve that – be sure to read the comments), there are so many gotchas to that I’d recommend using a bit of AppleScript and Daniel Jalkut’s excellent Usable Keychain Scripting app. Once installed, the following bit of AppleScript will retrieve your password (assuming the account name is “kinit”):

    tell application "Usable Keychain Scripting" to get password of first generic item of current keychain whose account is "kinit"

    Either wrap it in an osascript shell command, i.e.

    passphrase=$(osascript -e '<command above>')

    or, as you are using Automator, add an AppleScript action, retrieve the passphrase inside it and pass it to the shell script.

  • Thanks Kopischke! It took me a little time to get up to speed on the ins and outs of Automator and the scripting syntax. Thanks to you I was able to build an Automator app that generates a kerberos ticket for me. I added the app to my login items so it will run every time I login. Booyah!
    – tlatkovich
    Commented May 7, 2012 at 17:56

Just wanna chime in; i didn't fancy putting my password into the keychain so i wrote a quick applescript to pick up from a user prompt:

on run {input, parameters}
tell application "System Events"
    set the_username to do shell script "whoami"
    set the_password to "password"
    display dialog "Enter password" default answer "password" buttons {"OK", "Cancel"} default button "OK" with icon 2 with title "SLAC Kerberos" with hidden answer
    set the_password to text returned of the result
end tell
return {the_username, the_password}
end run

of course, you probably wanna put the domain into your username too. and then, from a shell script you can do something like:

echo $2 | kinit --password-file=STDIN $1

what would be nice would be to check the output form the shell script to check for incorrect passwords etc.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .