KDB5\_LDAP\_UTIL(8) MIT Kerberos KDB5\_LDAP\_UTIL(8)

# [NAME](#NAME)

kdb5\_ldap\_util - Kerberos configuration utility

# [SYNOPSIS](#SYNOPSIS)

**kdb5\_ldap\_util** \[**-D** *user\_dn* \[**-w** *passwd*]] \[**-H** *ldapuri*] **command** \[*command\_options*]

# [DESCRIPTION](#DESCRIPTION)

kdb5\_ldap\_util allows an administrator to manage realms, Kerberos services and ticket policies.

# [COMMAND-LINE OPTIONS](#COMMAND-LINE_OPTIONS)

[**-r** *realm*](#r)

Specifies the realm to be operated on.

[**-D** *user\_dn*](#D)

Specifies the Distinguished Name (DN) of the user who has sufficient rights to perform the operation on the LDAP server.

[**-w** *passwd*](#w)

Specifies the password of *user\_dn*. This option is not recommended.

[**-H** *ldapuri*](#H)

Specifies the URI of the LDAP server.

By default, kdb5\_ldap\_util operates on the default realm (as specified in *krb5.conf*) and connects and authenticates to the LDAP server in the same manner as :[ref:kadmind(8)](/man/os/krb5/ref:kadmind.8)\` would given the parameters in *\[dbdefaults]* in *kdc.conf*.

# [COMMANDS](#COMMANDS)

## [create](#create)

**create** \[**-subtrees** *subtree\_dn\_list*] \[**-sscope** *search\_scope*] \[**-containerref** *container\_reference\_dn*] \[**-k** *mkeytype*] \[**-kv** *mkeyVNO*] \[**-M** *mkeyname*] \[**-m|-P** *password*|**-sf** *stashfilename*] \[**-s**] \[**-maxtktlife** *max\_ticket\_life*] \[**-maxrenewlife** *max\_renewable\_ticket\_life*] \[*ticket\_flags*]

Creates realm in directory. Options:

[**-subtrees** *subtree\_dn\_list*](#subtrees)

Specifies the list of subtrees containing the principals of a realm. The list contains the DNs of the subtree objects separated by colon (**:**).

[**-sscope** *search\_scope*](#sscope)

Specifies the scope for searching the principals under the subtree. The possible values are 1 or one (one level), 2 or sub (subtrees).

[**-containerref** *container\_reference\_dn*](#containerref)

Specifies the DN of the container object in which the principals of a realm will be created. If the container reference is not configured for a realm, the principals will be created in the realm container.

[**-k** *mkeytype*](#k)

Specifies the key type of the master key in the database. The default is given by the **master\_key\_type** variable in *kdc.conf*.

[**-kv** *mkeyVNO*](#kv)

Specifies the version number of the master key in the database; the default is 1. Note that 0 is not allowed.

[**-M** *mkeyname*](#M)

Specifies the principal name for the master key in the database. If not specified, the name is determined by the **master\_key\_name** variable in *kdc.conf*.

[**-m**](#m)

Specifies that the master database password should be read from the TTY rather than fetched from a file on the disk.

[**-P** *password*](#P)

Specifies the master database password. This option is not recommended.

[**-sf** *stashfilename*](#sf)

Specifies the stash file of the master database password.

[**-s**](#s)

Specifies that the stash file is to be created.

[**-maxtktlife** *max\_ticket\_life*](#maxtktlife)

(*getdate time* string) Specifies maximum ticket life for principals in this realm.

[**-maxrenewlife** *max\_renewable\_ticket\_life*](#maxrenewlife)

(*getdate time* string) Specifies maximum renewable life of tickets for principals in this realm.

[***ticket\_flags***](#ticket_flags)

Specifies global ticket flags for the realm. Allowable flags are documented in the description of the **add\_principal** command in *kadmin*.

Example:

```
kdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu


    -r ATHENA.MIT.EDU create -subtrees o=org -sscope SUB
Password for "cn=admin,o=org":
Initializing database for realm 'ATHENA.MIT.EDU'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:
```

## [modify](#modify)

**modify** \[**-subtrees** *subtree\_dn\_list*] \[**-sscope** *search\_scope*] \[**-containerref** *container\_reference\_dn*] \[**-maxtktlife** *max\_ticket\_life*] \[**-maxrenewlife** *max\_renewable\_ticket\_life*] \[*ticket\_flags*]

Modifies the attributes of a realm. Options:

[**-subtrees** *subtree\_dn\_list*](#subtrees~2)

Specifies the list of subtrees containing the principals of a realm. The list contains the DNs of the subtree objects separated by colon (**:**). This list replaces the existing list.

[**-sscope** *search\_scope*](#sscope~2)

Specifies the scope for searching the principals under the subtrees. The possible values are 1 or one (one level), 2 or sub (subtrees).

[**-containerref** *container\_reference\_dn* Specifies the DN of the](#containerref~2)

container object in which the principals of a realm will be created.

[**-maxtktlife** *max\_ticket\_life*](#maxtktlife~2)

(*getdate time* string) Specifies maximum ticket life for principals in this realm.

[**-maxrenewlife** *max\_renewable\_ticket\_life*](#maxrenewlife~2)

(*getdate time* string) Specifies maximum renewable life of tickets for principals in this realm.

[***ticket\_flags***](#ticket_flags~2)

Specifies global ticket flags for the realm. Allowable flags are documented in the description of the **add\_principal** command in *kadmin*.

Example:

```
shell% kdb5_ldap_util -r ATHENA.MIT.EDU -D cn=admin,o=org -H


    ldaps://ldap-server1.mit.edu modify +requires_preauth
Password for "cn=admin,o=org":
shell%
```

## [view](#view)

**view**

Displays the attributes of a realm.

Example:

```
kdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu


    -r ATHENA.MIT.EDU view
Password for "cn=admin,o=org":
Realm Name: ATHENA.MIT.EDU
Subtree: ou=users,o=org
Subtree: ou=servers,o=org
SearchScope: ONE
Maximum ticket life: 0 days 01:00:00
Maximum renewable life: 0 days 10:00:00
Ticket flags: DISALLOW_FORWARDABLE REQUIRES_PWCHANGE
```

## [destroy](#destroy)

**destroy** \[**-f**]

Destroys an existing realm. Options:

[**-f**](#f)

If specified, will not prompt the user for confirmation.

Example:

```
shell% kdb5_ldap_util -r ATHENA.MIT.EDU -D cn=admin,o=org -H


    ldaps://ldap-server1.mit.edu destroy
Password for "cn=admin,o=org":
Deleting KDC database of 'ATHENA.MIT.EDU', are you sure?
(type 'yes' to confirm)? yes
OK, deleting database of 'ATHENA.MIT.EDU'...
shell%
```

## [list](#list)

**list**

Lists the names of realms under the container.

Example:

```
shell% kdb5_ldap_util -D cn=admin,o=org -H


    ldaps://ldap-server1.mit.edu list
Password for "cn=admin,o=org":
ATHENA.MIT.EDU
OPENLDAP.MIT.EDU
MEDIA-LAB.MIT.EDU
shell%
```

## [stashsrvpw](#stashsrvpw)

**stashsrvpw** \[**-f** *filename*] *name*

Allows an administrator to store the password for service object in a file so that KDC and Administration server can use it to authenticate to the LDAP server. Options:

[**-f** *filename*](#f~2)

Specifies the complete path of the service password file. By default, **/usr/local/var/service\_passwd** is used.

[***name***](#name)

Specifies the name of the object whose password is to be stored. If *krb5kdc* or *kadmind* are configured for simple binding, this should be the distinguished name it will use as given by the **ldap\_kdc\_dn** or **ldap\_kadmind\_dn** variable in *kdc.conf*. If the KDC or kadmind is configured for SASL binding, this should be the authentication name it will use as given by the **ldap\_kdc\_sasl\_authcid** or **ldap\_kadmind\_sasl\_authcid** variable.

Example:

```
kdb5_ldap_util stashsrvpw -f /home/andrew/conf_keyfile


    cn=service-kdc,o=org
Password for "cn=service-kdc,o=org":
Re-enter password for "cn=service-kdc,o=org":
```

## [create\_policy](#create_policy)

**create\_policy** \[**-maxtktlife** *max\_ticket\_life*] \[**-maxrenewlife** *max\_renewable\_ticket\_life*] \[*ticket\_flags*] *policy\_name*

Creates a ticket policy in the directory. Options:

[**-maxtktlife** *max\_ticket\_life*](#maxtktlife~3)

(*getdate time* string) Specifies maximum ticket life for principals.

[**-maxrenewlife** *max\_renewable\_ticket\_life*](#maxrenewlife~3)

(*getdate time* string) Specifies maximum renewable life of tickets for principals.

[***ticket\_flags***](#ticket_flags~3)

Specifies the ticket flags. If this option is not specified, by default, no restriction will be set by the policy. Allowable flags are documented in the description of the **add\_principal** command in *kadmin*.

[***policy\_name***](#policy_name)

Specifies the name of the ticket policy.

Example:

```
kdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu


    -r ATHENA.MIT.EDU create_policy -maxtktlife "1 day"


    -maxrenewlife "1 week" -allow_postdated +needchange


    -allow_forwardable tktpolicy
Password for "cn=admin,o=org":
```

## [modify\_policy](#modify_policy)

**modify\_policy** \[**-maxtktlife** *max\_ticket\_life*] \[**-maxrenewlife** *max\_renewable\_ticket\_life*] \[*ticket\_flags*] *policy\_name*

Modifies the attributes of a ticket policy. Options are same as for **create\_policy**.

Example:

```
kdb5_ldap_util -D cn=admin,o=org -H


    ldaps://ldap-server1.mit.edu -r ATHENA.MIT.EDU modify_policy


    -maxtktlife "60 minutes" -maxrenewlife "10 hours"


    +allow_postdated -requires_preauth tktpolicy
Password for "cn=admin,o=org":
```

## [view\_policy](#view_policy)

**view\_policy** *policy\_name*

Displays the attributes of the named ticket policy.

Example:

```
kdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu


    -r ATHENA.MIT.EDU view_policy tktpolicy
Password for "cn=admin,o=org":
Ticket policy: tktpolicy
Maximum ticket life: 0 days 01:00:00
Maximum renewable life: 0 days 10:00:00
Ticket flags: DISALLOW_FORWARDABLE REQUIRES_PWCHANGE
```

## [destroy\_policy](#destroy_policy)

**destroy\_policy** \[**-force**] *policy\_name*

Destroys an existing ticket policy. Options:

[**-force**](#force)

Forces the deletion of the policy object. If not specified, the user will be prompted for confirmation before deleting the policy.

[***policy\_name***](#policy_name~2)

Specifies the name of the ticket policy.

Example:

```
kdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu


    -r ATHENA.MIT.EDU destroy_policy tktpolicy
Password for "cn=admin,o=org":
This will delete the policy object 'tktpolicy', are you sure?
(type 'yes' to confirm)? yes
** policy object 'tktpolicy' deleted.
```

## [list\_policy](#list_policy)

**list\_policy**

Lists ticket policies.

Example:

```
kdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu


    -r ATHENA.MIT.EDU list_policy
Password for "cn=admin,o=org":
tktpolicy
tmppolicy
userpolicy
```

# [ENVIRONMENT](#ENVIRONMENT)

See *kerberos* for a description of Kerberos environment variables.

# [SEE ALSO](#SEE_ALSO)

*kadmin*, *kerberos*

# [AUTHOR](#AUTHOR)

MIT

# [COPYRIGHT](#COPYRIGHT)

1985-2026, MIT

1.22.2

---

Document: kdb5_ldap_util(8) from krb5 1.22.2-r4 (Chainguard OS)
Source: https://github.com/krb5/krb5.git