I would like to be able to take advantage of Kerberos without having to join my machine to the domain.

Why? Because this is a personal machine and we are not allowed to join them the corporate domain (nor we can).

  • 1
    OS X sets up KDC automagically and uses it internally whether you join a domain or not. What specifically are you trying to do? Kerberos is there to use unless your installation has disabled it or configured it to not work in some manner. – bmike Sep 4 '12 at 14:50
  • Is there a way to tell OS X which user/password to user for kerberos if it happens for you not to have the same user or password on your local machine? – sorin Sep 4 '12 at 14:53
  • @bmike so kerberos client is not configured automatically, it cannot be as it doesn't know your domain. I was able to obtain a ticket from the command line and to authenticate using CURL. The ticket is visible in Ticket Viewer but no browser is using it. As soon I have a solution I will update, any hints would be more than welcomed. – sorin May 6 '14 at 12:20
  • 1
    I took your "take advantage of kerberos without joining a domain" as you were in stand alone mode only. Clearly, if you need to access the Authentication Server that is remote if you want to get a ticket from that server for use on the local host. I think you need OS X server to have a minimal KDC set up, so my "automagically" isn't going to help on non server.app Macs. Do post your setup once you have something worked out. I'm curious how many realms you have set up and what specific client setup works in that case. – bmike May 6 '14 at 12:44

Here is my partial success so far. I was able to setup Kerberos authentication but only on Firefox and Google Chrome, on Safari it doesn't work and it seems to be impossible to make it work without really joining the domain.

OS X Kerberos Setup

>kinit username@EXAMPLE.COM

Ticket cache: FILE:/tmp/krb5cc_0
Default principal: user@EXAMPLE.COM
Valid starting     Expires            Service principal
06/05/14 11:36:00  06/05/14 21:36:06  krbtgt/EXAMPLE.COM@EXAMPLE.COM
        renew until 07/05/14 11:36:00

Now you can use /System/Library/CoreServices/Ticket Viewer.app to view the ticket, or to renew it when it expires.


 curl -v --negotiate -u : -b ~/cookiejar.txt -c ~/cookiejar.txt --output /dev/null http://example.com


go to about:config and configure network.negotiate-auth.trusted-uris: .example.com


defaults write com.google.Chrome AuthServerWhitelist "*.example.com"
defaults write com.google.Chrome AuthNegotiateDelegateWhitelist "*.example.com"

Safari [broken!]

Base on https://www.pingidentity.com/support/solutions/index.cfm/How-to-configure-supported-browsers-for-Kerberos-NTLM#safari it seems that Safari will use SPNEGO only when it is joined into the domain. Otherwise it will only try NTLM which is probably disabled as being insecure.

Any contributions are more than welcomed!

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .