NAME

       ad-keytab - Manage and display keytabs for Active Directory principals

SYNOPSIS

       ad-keytab create|update|delete|show keytab-id [keytab-file] [--ad_server=hostname] [--computer_rdn=dn]
       [--user_rdn] [--dump] [--help] [--manual] [--debug]

DESCRIPTION

       This script is a wrapper around msktutil and ldapsearch to simplify the creation of host and service
       keytabs.  The script is useful for boot strapping the Kerberos credentials required to use Active
       Directory as a backend keytab store for wallet.  The script shares the wallet configuration file.

       Generally, two keytabs will need to be created to setup wallet.  One host keytab for the wallet server
       host and one service keytab for wallet to use when connecting to an Active Directory Domain Controller.

       Note, this script does not update the Wallet database which means any keytabs created by it will be
       invisible from wallet.

ACTIONS

       create
           Add a keytab to AD and update the keytab file.  Fails if the keytab already exists.

       update
           Update an existing keytab in AD and update the keytab file.  Fails if the keytab does not exist.

       delete
           Delete a keytab from AD and remove it from the keytab file.

       show
           Show  AD's  view  of  the account corresponding to the keytab.  This action does not use msktutil and
           queries AD directly using LDAP.

OPTIONS AND ARGUMENTS

       keytab-id
           This is either host principal name of the form host/<fqdn> or a service principal name  of  the  form
           service/<id>.   Service  keytab  identifiers cannot be longer than 18 characters because of an Active
           Directory restriction.

       keytab-filename
           The name of the keytab file.  Defaults to /etc/krb5.keytab.

       --conf=filename
           The configuration file to read.  The script searches for a configuration file in the following order.

                 * The command line switch --conf
                 * The environment variable ADKEYTAB
                 * The file .ad-keytab.conf
                 * The file /etc/ad-keytab.conf

       --ad_server=hostname
           The name of the Active Directory host to connect to.  It is important what the  script  contact  only
           _one_ server due to the fact that propagation within an Active Directory domain can be quite slow.

       --base_dn=ou=org,dc=domain,dc=tld
           The base distinguished name holding both computer and user accounts.

       --computer_rdn=dn
           The  relative  distinguished  name  to  use  as the base DN for both the creation of host keytabs and
           searches of Active Directory.  The distinguished name formed will be computer_rdn,base_dn.

       --user_rdn=dn
           The relative distinguished name to use as the base DN for  LDAP  searches  of  Active  Directory  for
           service keytabs.  The distinguished name formed will be user_rdn_rdn,base_dn.

       --dump
           When displaying keytab attributes show all of the attributes.

       --help
           Displays help text.

       --manual
           Displays more complete help text.

       --debug
           Turns on debugging displays.

SEE ALSO

       Set the documentation for Wallet::Config for configuration information, i.e.  perldoc Wallet::Config.

AUTHOR

       Bill MacAllister <whm@dropbox.com>

COPYRIGHT AND LICENSE

       Copyright 2016 Dropbox, Inc.

       Permission  is  hereby  granted,  free  of  charge,  to  any person obtaining a copy of this software and
       associated documentation files (the "Software"), to deal in the Software without  restriction,  including
       without  limitation  the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
       copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to  the
       following conditions:

       The  above  copyright  notice  and  this permission notice shall be included in all copies or substantial
       portions of the Software.

       THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR  IMPLIED,  INCLUDING  BUT  NOT
       LIMITED  TO  THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN
       NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY  CLAIM,  DAMAGES  OR  OTHER  LIABILITY,
       WHETHER  IN  AN  ACTION  OF  CONTRACT,  TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
       SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

       SPDX-License-Identifier: MIT

1.5                                                2024-04-30                                       AD-KEYTAB(8)