GSS-TOKEN(1)

NAME
gss-token - generate and consume base64 GSS tokens

SYNOPSIS
gss-token [-DNn] [-c -count] service@host
gss-token -r [-MNln] [-C ccache] [-S maxsize] [-c -count] [-m -mech] [service@host]

DESCRIPTION
gss-token generates and consumes base64 encoded GSS tokens. By default, it runs as an initiator and with the -r flag it becomes an acceptor.

gss-token supports the following options:

-C ccache
    write an accepted delegated credential into ccache. This only makes sense if -r is specified.

-D  delegate credentials. This only makes sense as a client, that is when -r is not specified.

-M  copy the default ccache to a MEMORY: ccache before each separate write operation. The default ccache will not pick up any obtained service tickets. If specified with -c, the cache will revert to its original state before each new token is written. This can be used to load test the KDC.

-N  prepend “Negotiate ” to generated tokens and expect it on consumed tokens.

-S maxsize
    split each token that is generated into components of maximum size maxsize. Each token is base64 encoded and output separately.

-c count
    repeat the operation count times. This flag only changes the behaviour when operating in initiator mode. This is good for very basic benchmarking.

-l  loop indefinitely in acceptor mode.

-m mech
    specifies the GSS mechanism that will be used in initiator mode. If a mechanism name of “?” is specified, a list of supported mechanisms will be output and gss-token will exit.

-n  do not output the generated tokens.

-r  run in acceptor mode.

gss-token takes one argument, a host@service specifier. The argument is required when running as an initiator but is optional as an acceptor.

gss-token will try to read a token whenever the GSS mechanism expects one and will output a token whenever the GSS mechanism provides one. Tokens are base64 encoded and terminated by either two successive newlines or one newline and EOF. The base64 encoding may be broken up by single newlines which will be ignored when read. No extra whitespace will be ignored.

EXAMPLES
To test a simple GSS mechanism which doesn't require a round trip, a single /bin/sh pipeline will suffice:

    $ export KRB5_KTNAME=/path/to/keytab
    $ gss-token HTTP@$(hostname) | gss-token -r

SEE ALSO
gssapi(3), kerberos(8).