Skip to main content

Setting up kerberos in Mac OS X

Kerberos in MAC OS X

Kerberos authentication allows the computers in same domain network to authenticate certain services with prompting the user for credentials. MAC OS X comes with Heimdal Kerberos which is an alternate implementation of the kerberos and uses LDAP as identity management database.
Here we are going to learn how to setup a kerberos on MAC OS X which we will configure latter in our application.

Installing Kerberos

In MAC we can use Homebrew for installing any software package. Homebrew makes it very easy to install the kerberos by just executing a simple command as given below.
brew install krb5
Once installation is complete, we need to set the below export commands in user's profile which will make the kerberos utility commands and compiler available to execute from anywhere.
Open user's bash profile:
vi ~/.bash_profile
Add below lines:
    export PATH=/usr/local/opt/krb5/bin:$PATH
    export PATH=/usr/local/opt/krb5/sbin:$PATH
    export LDFLAGS="-L/usr/local/opt/krb5/lib"
    export CPPFLAGS="-I/usr/local/opt/krb5/include"

Creating kerberos configuration

Now we need to create kerberos configuration which will be used during the setup of our installed kerberos. In this configuration we will setup few things like, domain names, KDC setup, logging, default keytab etc. Kerberos authentication looks up for the /etc/krb5.conf file which is default kerberos configuration location in MAC OS and we will create this file if it does not exist. If this file already exists then we can use the existing kerberos also for the modification. Here I am considering the situation when this file is not available and we need to create it.
To create our kerberos configuration, we will use below user and domain.
User: macuser
Domain: myserver.localhost
To configure above domain, we need to add below configuration in /etc/hosts file. myserver.localhost MYSERVER.LOCALHOST


Execute below command to create the file.
sudo vi /etc/krb5.conf
Put below code in this file and save it. In below code we also set the default encryption code supported. Also we set whether weak encryption is allowed. We have set the keytab, admin keytab location and KDC database also here. Same database will be created and setup the users & domain also.
    default_realm = MYSERVER.LOCALHOST
    default_keytab_name = file:/Users/macuser/krb5/conf/krb5.keytab
    default_tkt_enctypes = aes256-cts-hmac-sha1-96
    default_tgs_enctypes = aes256-cts-hmac-sha1-96
    allow_weak_crypto = true
    dns_lookup_realm = false
    dns_lookup_kdc = false

    default = FILE:/Users/macuser/krb5/logs/krb5kdc.log
    admin_server = FILE:/Users/macuser/krb5/logs/kadmind.log
    kdc = FILE:/Users/macuser/krb5/logs/krb5kdc.log
        kdc = myserver.localhost
        database_name = /Users/macuser/krb5/db/principal
        admin_server = myserver.localhost
        admin_keytab = file:/Users/macuser/krb5/conf/kadm5.keytab
    MYSERVER = {
        kdc = myserver.localhost
        database_name = /Users/macuser/krb5/db/principal
        admin_server = myserver.localhost
        admin_keytab = file:/Users/macuser/krb5/conf/kadm5.keytab
        default_domain = myserver.localhost
    .localhost = MYSERVER.LOCALHOST
    myserver.localhost = MYSERVER.LOCALHOST

Create database

To create the database we need to create below directory structure which we have mentioned in our kerberos configuration file.
We need to execute below command to create the database.
kdb5_util create -r MYSERVER.LOCALHOST -s
You will see the similar output where you can see the database location which we configured in kerberos configuration file.
Loading random data
Initializing database '/Users/macuser/krb5/db/principal' for realm 'MYSERVER.LOCALHOST',
master key name 'K/M@MYSERVER.LOCALHOST'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:

Creating principle, policies and keytab file

Execute below command to open the kadmin console in given directory. If you want to use specific encryption type while configuring database and keytab, then open kadmin with same command by specifying "-e" parameter with comma separated encryption types
cd /Users/macuser/krb5/conf/
Now execute below commands in kadmin console to create policies. Policy creation is not necessary but it is always helpful to manage users using policies.
addpol users
addpol admin
addpol hosts
Execute below commands in kadmin console to create principles.
addprinc -policy users macuser
addprinc -policy admin macuser/admin
addprinc -randkey -policy hosts host/myserver.localhost
addprinc -randkey  HTTP/myserver.localhost
Execute below commands in kadmin console to create keytab files.
ktadd -k krb5.keytab host/myserver.localhost
ktadd -k krb5.keytab HTTP/myserver.localhost
ktadd -k krb5.keytab macuser

ktadd -k kadm5.keytab kadmin/admin kadmin/changepw

Verifying and initializing keytab

Exit the kadmin console by typing "quit" and execute below command to check the keytab entries.
klist -e -k -t krb5.keytab
It will given you below output:
Keytab name: FILE:krb5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 12/29/19 20:40:17 host/myserver.localhost@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:17 host/myserver.localhost@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:32 HTTP/myserver.localhost@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:32 HTTP/myserver.localhost@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:43 macuser@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:43 macuser@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
Now execute the same command on "kadm5.keytab" to check the admin entries. Below is the output.
Keytab name: FILE:kadm5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 12/29/19 20:40:55 kadmin/admin@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/admin@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/changepw@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/changepw@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
Now check if you have read permission for other users also on both the keytab files (created above). If not then please update the permission on them. Post that, please execute below commands in given sequence, to start your kerberos.
Finally, execute below command to initialize your keytab with given user.
kinit macuser@MYSERVER.LOCALHOST -kt krb5.keytab
It will ask for the password, we set during principal creation.
Now open  the "Ticket viewer" and you will see similar to below screen for your initialized user.
ticket viewer
You can check my another post on implementation of Kerberos authentication using Spring boot and SPNEGO API.


  1. I am trying to follow the instruction to set up my Kerberos server on mac OX, I have faced two issues:

    1) ```kdb5_util create -r MYSERVER.LOCALHOST -s```, after you input the password, I will get error
    ```kdb5_util: Can not fetch master key (error: No such file or directory). while initializing the Kerberos admin interface```

    2) ```cd /Users/macuser/krb5/conf/
    I will have the problem that kadmin.local is trying to open the database `/usr/local/Cellar/krb5/1.17.1/var/krb5kdc/principal`, and this will get a result No such file or directory while initializing kadmin.local interface

    Is there anything wrong? Any suggestion will be appreciated

    1. You getting these issues as your database couldn't created and then latter it failed during initialization due to same issue.
      Seems, you have not defined below database setting in your "/etc/krb5.conf" file which specifies the desired location for database.
      database_name = /Users/macuser/krb5/db/principal
      If you don't want to use above setting and want to use default location for database then please make sure that you have below folder hierarchy, if not then please create the folders. Folder hierarchy for database must be present with both custom and default database location.
      Then try to create database using kdb5_util.

  2. Thanks for your reply.

    I have define the database setting in the config file, however, it seems like kadmin.local cannot find the default real I config in the krb5.conf, I have to use `sudo kadmin -r MYSERVER.LOCALHOST` to let it know where is the path of the database.

    For the first issue, I just simply add "sudo" in front of the command to execute, then the issue is gone.

  3. Hi,

    i've follow all the steps you provided, but when i run the `kdb5_util create -r MYSERVER.LOCALHOST -s` command, after typing the master key password i got the following error:

    kdb5_util: Key table file '/usr/local/Cellar/krb5/1.17.1/var/krb5kdc/.k5.MYSERVER.LOCALHOST_tmp' not found while storing key
    Warning: couldn't stash master key.
    kdb5_util: Can not fetch master key (error: No such file or directory). while initializing the Kerberos admin interface

    What am i doing wrong? Do you please have any suggestion?

    Thanks in advance

    1. I tried your previously suggestion: create `/usr/local/Cellar/krb5/1.17.1/var/krb5kdc/` path. This solved my issue. Now i have another one. When i run `kadmin.local` i got the following error:

      kadmin.local: unsupported command

      Any suggestion?

      Thanks in advance

    2. Seems your krb5 sbin is not set on environment's path and not able to find this command. You can set it by exporting location "/usr/local/opt/krb5/sbin" in PATH variable. If this location is not available then you can export location "/usr/local/Cellar/krb5/1.17.1/sbin" in PATH variable. Other way is to execute the command by prepending it with actual location, for example "/usr/local/opt/krb5/sbin/kadmin.local".

    3. First of all, thanks for you support!

      My krb5 sbin path is already setup as environment variable.
      However using kadmin.local inside "/usr/local/Cellar/krb5/1.17.1/sbin" folder everything works fine.

      Thanks again!

  4. while running "sudo kadmind" , I get the below error : kadmind: Cannot open /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/kadm5.acl: No such file or directory while initializing ACL file, aborting

  5. Hello, I am facing the same problem mentioned in the before comment, I did all the steps and everything worked fine until there, after run sudo kadmin the next error is displayed: kadmind: Cannot open /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/kadm5.acl: No such file or directory while initializing ACL file, aborting
    Can you please give me an idea on how to solve this?

    1. Please try to create below folder hierarchy.

  6. Please try to create below folder hierarchy.

  7. I have the same problem when i try to start kadmind I am getting the same error sudo kadmind
    kadmind: Cannot open /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/kadm5.acl: No such file or directory while initializing ACL file, aborting . However the directory exists, it is just that there is no acl file in there. Any ideas?

    1. Never mind, it expects a predefined acl file. A simple touch /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/kadm5.acl suffices to get the server started. Apparently this is a plain text file with some access control lists, the user has to define himself!

    2. Another problem now... kinit myuser@MYSERVER.LOCALHOST -kt krb5.keytab results in an error kinit: Client 'werpu@MYSERVER.LOCALHOST' not found in Kerberos database while getting initial credentials. The db exists the keytab file has the user and the user exists on macos, i am somewhat puzzled why this happens.

  8. Hi there and thanks a lot for your tutorial.

    I followed each of the steps you recommended but when i enter :

    kdb5_util create -r MYSERVER.LOCALHOST -s

    I get :

    zsh: command not found: kdb5_util

    I looked up on the internet and didn't find anything besides checking the $PATH
    So my $PATH is as this :


    If you mind helping me out I would be so gratefull !

    Cheers :)

    1. Aprajita Shailie25 January 2021 at 11:04

      First go inside the folder (cd /Users/macuser/krb5/db/) and then execute kdb5_util create -r MYSERVER.LOCALHOST -s

      It worked for me. Hope it might help you.

  9. Thanks for a very helpful tutorial, it worked for me like a charm. The only missing detail I found is you never mention where to place the keytab files and looking at the krb5.conf they should be placed in the file:/Users/macuser/krb5/conf/ folder. The other items which caused problem for me was missing kadm5_acl.html file. Initially I added it as an empty file but later I found out it really needs to be setup correctly so one can use kadmin. Adding a short section explaining that detail would be very helpful for beginners like myself.

  10. Great article. I followed the instructions on Mac Big Sur and it complaint about pkinit authentication with the following message from the krb5kdc log "preauth pkinit failed to initialize: PKINIT initialization failed: No pkinit_identity supplied for realm MYSERVER.LOCALHOST". After trying to set up pkinit the following the official mit documentation it still complaints about the first line that tries to access the MYSERVER.LOCALHOST in the extensions.kdc I've defined. Any help would be highly appreciated!


Post a Comment

Popular Posts

Asynchronous REST service implementation in Spring boot

In this tutorial we will see how to create an asynchronous REST service endpoint using Spring boot application. Asynchronous service works in a way that it will not block the client request and do the processing in separate thread. When work is complete the response returned to the client so our service will be able to handle more client requests at the same time, compare to synchronous processing model. Let's understand how it is working in synchronous mode. In such server/client application at server side it has a pool of threads which are serving the request. If a request received by a thread then it will be blocked until it send the response back to client. In this case if processing doesn't take much time it will be able to process it quickly and accept other client requests but there could be one situation when all threads are busy and not able to accept the new client requests. To overcome of such problems, asynchronous processing model introduced for REST service

SpringBoot - @ConditionalOnProperty example for conditional bean initialization

@ConditionalOnProperty annotation is used to check if specified property available in the environment or it matches some specific value so it can control the execution of some part of code like bean creation. It may be useful in many cases for example enable/disable service if specific property is available. Below are the attributes which can be used for property check. havingValue - Provide the value which need to check against specified property otherwise it will check that value should not be false. matchIfMissing - If true it will match the condition and execute the annotated code when property itself is not available in environment. name - Name of the property to be tested. If you want to test single property then you can directly put the property name as string like "" and if you have multiple properties to test then you can put the names like {"prop.name1","prop.name2"} prefix - It can be use when you want to apply some prefix to

jaxb2-maven-plugin to generate java code from XSD schema

In this tutorial I will show how to generate the Java source code from XSD schema. I will use jaxb2-maven-plugin to generate the code using XSD file which will be declared in pom.xml to make it part of build, so when maven build is executed it will generate the java code using XSD. Class generation can be controlled in plugin configuration. Maven changes (pom.xml) Include below plugin in your pom.xml. Here we have done some configuration under configuration section as given below. schemaDirectory : This is the directory where I keep my schema (XSD file). outputDirectory : This is the java source location where I want to generate the Java files. If it is not given then by default it will be generate inside target folder. clearOutputDir : If this property is true then it will generate the classes on each build otherwise it will generate only if output directory is empty. <plugin> <groupId>org.codehaus.mojo</groupId> <artifactId>jaxb2-maven-plugin</art