kerberos 协议初探

kerberos原理#
一个客户端要访问某个服务时，先要到KDC去认证自己，并获得访问票据TGT
然后客户端再拿着这个访问票据到自己真实想要访问的服务去获得访问授权，
然后真实的进行访问

在kerberos中，KDC有两部分组成：

Authentication Server，用来认证用户，即验证用户存在，且密码正确
Ticket-Granting Service，用来给客户端生成，可以访问客户端想要访问的那个服务的票据TGT
三个请求步骤#
整体来看，kerberos分为三个请求来回，假设一个client要访问服务server

client到Authentication Server认证，并获得跟Ticket-Granting Service通信的加密key，Client/TGS SessionKey和能访问Client/TGS SessionKey的票据
client使用Client/TGS SessionKey跟Ticket-Granting Service进行安全通信，获得能访问server票据
client在拿到第二步的票据去访问服务server

双向验证#
kerberos是双向验证的。实现双向验证的原理：
其上三步通信中，每一步的请求和返回都包含两个数据。一份是发送方想要获取认证的请求，一份是发送方希望接收方认证自己的请求数据。

基础术语#
Principals#
在kerberos网络中，认证双方的指代，可以服务，也可以是个人
Principals是唯一的，KDC是基于Principals来判定它有没有访问某个服务的权限

一个Principals的基本构造为：
primary/instance@realm

其中：

primary是具体的用户名或服务名，比如用户名：jdoe， 服务名：nfs
instance 是该用户或服务具体的角色/机器定位，比如jdoe/admin, ftp/bigmachine.corp.example.com，后者表示ftp这个服务在bigmachine.corp.example.com这host机器上。特别地，如果primary是一个服务，那么其instance必填。而如果primary是用户，则instance不必填
realm 一个逻辑领域，指代kerberos网络的范围，通常是大写域名，比如CORP.EXAMPLE.COM
以下是一些合法的principal定义

Copy
jdoe

jdoe/admin

jdoe/admin@CORP.EXAMPLE.COM

nfs/host.corp.example.com@CORP.EXAMPLE.COM

host/corp.example.com@CORP.EXAMPLE.COM
Realms#
Realms 是kerberos整个网络的逻辑定义，相当于一个域，所以通常也用域名来定义。Realm可以集成，也可以没有集成但又有相应的关系

KDC#
存储有所有Principals的账号信息，用于认证用户，并分发Principal A访问Principal B的票据
KDC本身可以做主从，从而实现高可用

keytab#
一个存储了Principal信息的文件，其中包含用户名跟加密key（相当于密码）。其目的是，可以通过kinit命令，以脚本的方式去KDC认证，并缓存票据TGT。这样做能够使得一些系统之间的授权成为可能，也使得无人工参与的脚本自动化认证成为可能。因为普通的登录认证，需要用户交互，去输入用户名密码。

一个典型的kinit命令如下：ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/168
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/158
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/169
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/159
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/170
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/160
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/171
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/172
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/161
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/162
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/173
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/163
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/164
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/174
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/165
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/175
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/166
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/176
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/167
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/177
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/168
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/178
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/169
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/179
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/170
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/180
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/171
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/181
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/172
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/182
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/173
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/183
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/174
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/184
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/175
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/176
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/185
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/177
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/186
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/178
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/187
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/179
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/188
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/180
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/189
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/190
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/191
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/181
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/192
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/193
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/182
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/194
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/183
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/184
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/195
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/185
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/196
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/186
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/197
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/187
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/198
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/188
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/199
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/189
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/190
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/200
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/201
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/191
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/192
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/202
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/193
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/203
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/194
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/204
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/195
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/205
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/196
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/197
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/206
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/207
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/198
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/208
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/209
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/199
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/210
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/200
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/211
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/201
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/212
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/213
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/202
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/214
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/203
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/215
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/204
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/216
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/205
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/217
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/206
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/218
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/207
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/219
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/208
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/220
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/221
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/209
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/222
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/210
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/223
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/211
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/224
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/212
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/225
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/213
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/226
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/214
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/227
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/215
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/228
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/216
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/229
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/217
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/230
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/218
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/231
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/219
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/232
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/220
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/233
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/221
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/234
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/222
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/235
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/223
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/224
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/236
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/225
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/237
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/226
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/238
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/227
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/239
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/228
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/240
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/229
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/230
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/241
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/231
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/242
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/232
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/243
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/233
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/234
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/235
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/244
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/236
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/245
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/237
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/246
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/238
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/247
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/239
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/248
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/240
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/249
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/241
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/250
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/242
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/251
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/243
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/252
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/244
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/245
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/253
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/246
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/254
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/247
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/255
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/248
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/256
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/249
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/257
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/250
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/258
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/259
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/251
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/260
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/252
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/261
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/253
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/262
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/254
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/263
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/255
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/264
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/256
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/265
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/257
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/266
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/258
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/267
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/259
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/268
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/260
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/269
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/261
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/270
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/262
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/271
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/263
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/264
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/272
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/273
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/265
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/266
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/274
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/267
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/275
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/268
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/276
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/269
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/277
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/270
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/278
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/271
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/279
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/272
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/280
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/273
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/281
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/274
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/282
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/275
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/283
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/276
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/284
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/277
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/285
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/278
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/286
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/279
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/280
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/287
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/281
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/288
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/282
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/289
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/283
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/290
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/284
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/291
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/285
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/292
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/293
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/286
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/287
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/294
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/295
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/288
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/289
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/296
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/290
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/297
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/298
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/299
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/291
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/300
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/292
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/301
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/293
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/302
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/294
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/303
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/295
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/304
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/296
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/305
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/297
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/306
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/298
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/307
ｈｔｔｐｓ：／／github.com/l32nyw20/twggpilioq/discussions/299
ｈｔｔｐｓ：／／github.com/91sipp68/rfrepzlnrj/discussions/308

Copy
kinit username@ADS.IU.EDU -k -t mykeytab; myscript
mykeytab是Keytab的文件名，由于其中可能有多个principal的账号信息，所以这里显示的基于username@ADS.IU.EDU这个用户id，显示的去找文件中的密码，完成认证。
认证完后，执行后续想要操作的myscript脚本。

当日Kinit命令本身也可以不使用Keytab文件，而直接用户交互的方式，去输入密码，完整认证。

整个kerberos的逻辑视图#

其中clients和Application Servers都是Principal