KRB5.CONF(5)

NAME
krb5.conf - configuration file for Kerberos 5

SYNOPSIS
#include <krb5.h>

DESCRIPTION
The krb5.conf file specifies several configuration parameters for the Kerberos 5 library, as well as for some programs.

The file consists of one or more sections, containing a number of bindings. The value of each binding can be either a string or a list of other bindings. The grammar looks like:

    file:
    	/* empty */
    	sections
            includes
    sections:
    	section sections
    	section
    section:
    	'[' section_name ']' bindings
    section_name:
    	STRING
    bindings:
    	binding bindings
    	binding
    binding:
    	name '=' STRING
    	name '=' '{' bindings '}'
    name:
    	STRING
    includes:
    	'include' path
    	'includedir' path
    path: STRING

STRINGs consists of one or more non-whitespace characters.

Files and directories may be included by absolute path, with percent token expansion (see the TOKEN EXPANSION section). Including a directory causes all files in the directory to be included as if each file had been included separately, but only files whose names consist of alphanumeric, hyphen, and underscore are included, though they may also end in '.conf'.

STRINGs that are specified later in this man-page uses the following notation.

boolean
    values can be either yes/true or no/false.

time
    values can be a list of year, month, day, hour, min, second. Example: 1 month 2 days 30 min. If no unit is given, seconds is assumed.

etypes
    valid encryption types are: des-cbc-crc, des-cbc-md4, des-cbc-md5, des3-cbc-sha1, arcfour-hmac-md5, aes128-cts-hmac-sha1-96, aes256-cts-hmac-sha1-96, aes128-cts-hmac-sha256-128, and aes256-cts-hmac-sha384-192.

address
    an address can be either a IPv4 or a IPv6 address.

Currently recognised sections and bindings are:

[appdefaults]
    Specifies the default values to be used for Kerberos applications. You can specify defaults per application, realm, or a combination of these. The preference order is:
    1.  application realm option
    2.  application option
    3.  realm option
    4.  option

    The supported options are:

    forwardable = boolean
        When obtaining initial credentials, make the credentials forwardable.

    proxiable = boolean
        When obtaining initial credentials, make the credentials proxiable.

    no-addresses = boolean
        When obtaining initial credentials, request them for an empty set of addresses, making the tickets valid from any address.

    ticket_lifetime = time
        Default ticket lifetime.

    renew_lifetime = time
        Default renewable ticket lifetime.

    encrypt = boolean
        Use encryption, when available.

    forward = boolean
        Forward credentials to remote host (for rsh(1), telnet(1), etc).

    historical_anon_pkinit = boolean
        Enable legacy anonymous pkinit command-line syntax. With this option set to true, the kinit(1) - -anonymous command with no principal argument specified will request an anonymous pkinit ticket from the default realm. If a principal argument is specified, it is used as an explicit realm name for anonymous pkinit even without an @ prefix.

    delegate-destination-tgt = boolean
        When forwarding credentials to a remote host, forward a TGT for the realm of the destination host rather than a TGT for the user's realm. This is useful when hosts in the remote realm should not or cannot (e.g. firewalled from user realm's KDC) obtain tickets for services in the user's realm. When the user's realm and the host's realm are the same, this parameter has no effect. The setting can be applied to a single realm as follows:

            EXAMPLE.COM = {
            	delegate-destination-tgt = true
            }

    pkinit_pool = HX509-STORE
        This is a multi-valued parameter naming one or more stores of intermediate certification authority (CA) certificates for the client's end entity certificate.

    pkinit_anchors = HX509-STORE ...
        This is a multi-valued parameter naming one or more stores of anchors for PKINIT KDC certificates.

    pkinit_revoke = HX509-STORE ...
        This is a multi-valued parameter naming one or more stores of CRLs for the issuers of PKINIT KDC certificates. Only the first valid CRL for a particular issuer will be checked. If no CRLs are configured, then CRLs will not be checked. This is because hx509 currently lacks support.

[libdefaults]

    default_realm = REALM
        Default realm to use, this is also known as your “local realm”. The default is the result of krb5_get_host_realm(local hostname).

    allow_weak_crypto = boolean
        are weak crypto algorithms allowed to be used, among others, DES is considered weak.

    block_dns = boolean
        If true, prevent Heimdal from doing any DNS resolution. Default is false.

    clockskew = time
        Maximum time differential (in seconds) allowed when comparing times. Default is 300 seconds (five minutes).

    kdc_timeout = time
        Maximum time to wait for a reply from the kdc, default is 3 seconds.

    capath = {

        destination-realm = next-hop-realm

        ...

        }
        This is deprecated, see the capaths section below.

    default_cc_type = cctype
        sets the default credentials type.

    default_cc_name = ccname
        the default credentials cache name. If you want to change the type only use default_cc_type. The string can contain variables that are expanded at runtime. See the TOKEN EXPANSION section.

    default_file_cache_collections = FILE:/path/with/tokens ...
        This multi-valued parameter allows more than one path to be configured for the FILE credentials cache type to look in. The FILE credentials cache type will also consider file names whose prefixes match these and end in +name as subsidiary caches in the collection. The values of this parameter are subject to token expansion. See the TOKEN EXPANSION section.

    enable_file_cache_iteration = boolean
        If enabled, the FILE credential cache type will support iteration of all subsidiary caches in the default collection, meaning that kinit(1) -l option will list them. This does require scanning the directory containing a given FILE ccache, which, if it is /tmp may be a slow operation. Defaults to false.

    default_etypes = etypes ...
        A list of default encryption types to use. (Default: all enctypes if allow_weak_crypto = TRUE, else all enctypes except single DES enctypes.)

    default_as_etypes = etypes ...
        A list of default encryption types to use in AS requests. (Default: the value of default_etypes.)

    default_tgs_etypes = etypes ...
        A list of default encryption types to use in TGS requests. (Default: the value of default_etypes.)

    default_etypes_des = etypes ...
        A list of default encryption types to use when requesting a DES credential.

    openssl_cnf = FILE
        Path to OpenSSL configuration to use if not the default.

    openssl_propq = PROPQ
        Property query string for OpenSSL. Use this to enable FIPS mode, for example.

    fips = BOOL
        If true this causes the OpenSSL FIPS provider to be loaded.

    default_keytab_name = keytab
        The keytab to use if no other is specified, default is “FILE:/etc/krb5.keytab”.

    default_client_keytab_name = keytab
        The keytab to use for client credential acquisition if no other is specified, default is “FILE:%{LOCALSTATEDIR}/user/%{euid}/client.keytab”. See the TOKEN EXPANSION section.

    dns_lookup_kdc = boolean
        Use DNS SRV records to lookup KDC services location.

    dns_lookup_realm = boolean
        Use DNS TXT records to lookup domain to realm mappings.

    enforce_ok_as_delegate = boolean
        If this flag to true, GSSAPI credential delegation will be disabled when the ok-as-delegate flag is not set in the service ticket. If this flag is false, the ok-as-delegate ticket flag is only enforced when an application specifically requests enforcement. The default value is false.

    kdc_timesync = boolean
        Try to keep track of the time differential between the local machine and the KDC, and then compensate for that when issuing requests.

    max_retries = number
        The max number of times to try to contact each KDC.

    large_msg_size = number
        The threshold where protocols with tiny maximum message sizes are not considered usable to send messages to the KDC.

    ticket_lifetime = time
        Default ticket lifetime.

    renew_lifetime = time
        Default renewable ticket lifetime.

    forwardable = boolean
        When obtaining initial credentials, make the credentials forwardable. This option is also valid in the [realms] section.

    proxiable = boolean
        When obtaining initial credentials, make the credentials proxiable. This option is also valid in the [realms] section.

    verify_ap_req_nofail = boolean
        If enabled, failure to verify credentials against a local key is a fatal error. The application has to be able to read the corresponding service key for this to work. Some applications, like su(1), enable this option unconditionally.

    warn_pwexpire = time
        How soon to warn for expiring password. Default is seven days.

    socks4a_proxy = host[:port]
        SOCKS4a proxy to use when talking to the KDC. Default port is 1080.

        Only TCP service to KDC is allowed in this case, not UDP or HTTP.

        The KDC hostname is passed to the SOCKS4a proxy verbatim without any DNS resolution first. Other DNS resolution, of the proxy address and for any realm mapping or KDC discovery, may still be done outside the SOCKS4a proxy.

        The caller's principal is passed as the SOCKS user id in order to enable stream isolation with Tor.

    http_proxy = proxy-spec
        A HTTP-proxy to use when talking to the KDC via HTTP.

    dns_proxy = proxy-spec
        Enable using DNS via HTTP.

    extra_addresses = address ...
        A list of addresses to get tickets for along with all local addresses.

    time_format = string
        How to print time strings in logs, this string is passed to strftime(3).

    date_format = string
        How to print date strings in logs, this string is passed to strftime(3).

    log_utc = boolean
        Write log-entries using UTC instead of your local time zone.

    scan_interfaces = boolean
        Scan all network interfaces for addresses, as opposed to simply using the address associated with the system's host name.

    fcache_version = int
        Use file credential cache format version specified.

    fcc-mit-ticketflags = boolean
        Use MIT compatible format for file credential cache. It's the field ticketflags that is stored in reverse bit order for older than Heimdal 0.7. Setting this flag to TRUE makes it store the MIT way, this is default for Heimdal 0.7.

    check-rd-req-server
        If set to "ignore", the framework will ignore any of the server input to krb5_rd_req(3), this is very useful when the GSS-API server input the wrong server name into the gss_accept_sec_context call.

    k5login_directory = directory
        Alternative location for user .k5login files. This option is provided for compatibility with MIT krb5 configuration files. This path is subject to percent token expansion (see TOKEN EXPANSION).

    k5login_authoritative = boolean
        If true then if a principal is not found in k5login files then krb5_userok(3) will not fallback on principal to username mapping. This option is provided for compatibility with MIT krb5 configuration files.

    kuserok = rule ...
        Specifies krb5_userok(3) behavior. If multiple values are given, then krb5_userok(3) will evaluate them in order until one succeeds or all fail. Rules are implemented by plugins, with three built-in plugins described below. Default: USER-K5LOGIN SIMPLE DENY.

    kuserok = DENY
        If set and evaluated then krb5_userok(3) will deny access to the given username no matter what the principal name might be.

    kuserok = SIMPLE
        If set and evaluated then krb5_userok(3) will use principal to username mapping (see auth_to_local below). If the principal maps to the requested username then access is allowed.

    kuserok = SYSTEM-K5LOGIN[:directory]
        If set and evaluated then krb5_userok(3) will use k5login files named after the luser argument to krb5_userok(3) in the given directory or in /etc/k5login.d/. K5login files are text files, with each line containing just a principal name; principals apearing in a user's k5login file are permitted access to the user's account. Note: this rule performs no ownership nor permissions checks on k5login files; proper ownership and permissions/ACLs are expected due to the k5login location being a system location.

    kuserok = USER-K5LOGIN
        If set and evaluated then krb5_userok(3) will use ~luser/.k5login and ~luser/.k5login.d/*. User k5login files and directories must be owned by the user and must not have world nor group write permissions.

    aname2lname-text-db = filename
        The named file must be a sorted (in increasing order) text file where every line consists of an unparsed principal name optionally followed by whitespace and a username. The aname2lname function will do a binary search on this file, if configured, looking for lines that match the given principal name, and if found the given username will be used, or, if the username is missing, an error will be returned. If the file doesn't exist, or if no matching line is found then other plugins will be allowed to run.

    fcache_strict_checking
        strict checking in FILE credential caches that owner, no symlink and permissions is correct.

    pkinit_prefer_ec = BOOL
        If set to true then the client will prefer EC/ECC curves for PKINIT key agreement, otherwise it will prefer DH. Defaults to true. The default curve (see below) is “X25519”.

    pkinit_dh_trust_modp_kdc_choice = BOOL
        If set to true and the KDC offers one or more modular DH groups not known to the client, then pick the first one, else ignore such offers.

    pkinit_dh_use_modp = BOOL
        If set to true and pkinit_prefer_ec is set to false, then default to using a modp 2048 group.

    moduli = FILE
        Names a file that contains acceptable modular Diffie-Hellman groups for PKINIT. The given file should contain lines with whitespace-separated fields in this order: name, nbits, p, g, q. Lines starting with a # are comments.

    pkinit_dh_min_bits = NUMBER
        PKINIT client's minimum acceptable modular Diffie-Hellman public key size in bits. This can be set to curve names like “prime256v1” or “P-256” for NIST P-256, “prime384v1” or “P-384” for NIST P-384, “secp521r1” or “P-521” for NIST P-521, “X25519”, and “X448.” It can also be set to a modular DH group size in bits, such as 2048. By default the client will prefer “X25519”.

    pkinit_allow_ecdh = {

        CURVE = BOOL
            Enables/disables ECDH curves. Curve names include “prime256v1” and “P-256” for NIST P-256, “prime384v1” and “P-384” for NIST P-384, “secp521r1” and “P-521” for NIST P-521, “X25519”, and “X448”.

    }

    pkinit_kdfs = KDF-names
        Set to one or more RFC 8636 KDFs that are accepted. By default all RFC 8636 KDFs are accepted.

    enable-kx509 = boolean
        Enable use of kx509 so that every TGT that can has a corresponding PKIX certificate. Default: false.

    kx509_gen_key_type = public-key-type
        Type of public key for kx509 private key generation. Defaults to rsa and currently only rsa is supported.

    kx509_gen_rsa_key_size = number-of-bits
        RSA key size for kx509. Defaults to 2048.

    kx509_store = path
        A file path into which to write a certificate obtained with kx509, and its private key, when attempting kx509 optimistically using credentials from a default ccache. Tokens will be expanded.

    kx509_hostname = hostname
        If set, then the kx509 client will use this hostname for the kx509 service. This can also be set in the [realm] section on a per-realm basis. If not set then a TGS name will be used.

    name_canon_rules = rules
        One or more service principal name canonicalization rules. Each rule consists of one or more tokens separated by colon (':'). Currently these rules are used only for hostname canonicalization (usually when getting a service ticket, from a ccache or a TGS, but also when acquiring GSS initiator credentials from a keytab). These rules can be used to implement DNS resolver-like search lists without having to use DNS.

        NOTE: Name canonicalization rules are an experimental feature.

        The first token is a rule type, one of: as-is, qualify, or nss.

        Any remaining tokens must be options tokens: use_fast (use FAST to protect TGS exchanges; currently not supported), use_dnssec (use DNSSEC to protect hostname lookups; currently not supported), ccache_only , use_referrals, no_referrals, lookup_realm, mindots=N, maxdots=N, order=N, domain= domain, realm= realm, match_domain= domain, and match_realm= realm.

        When trying to obtain a service ticket for a host-based service principal name, name canonicalization rules are applied to that name in the order given, one by one, until one succeds (a service ticket is obtained), or all fail. Similarly when acquiring GSS initiator credentials from a keytab, and when comparing a non-canonical GSS name to a canonical one.

        For each rule the system checks that the hostname has at least mindots periods (if given) in it, at most maxdots periods (if given), that the hostname ends in the given match_domain (if given), and that the realm of the principal matches the match_realm (if given).

        As-is rules leave the hostname unmodified but may set a realm. Qualify rules qualify the hostname with the given domain and also may set the realm. The nss rule uses the system resolver to lookup the host's canonical name and is usually not secure. Note that using the nss rule type implies having to have principal aliases in the HDB (though not necessarily in keytabs).

        The empty realm denotes "ask the client's realm's TGS". The empty realm may be set as well as matched.

        The order in which rules are applied is as follows: first all the rules with explicit order then all other rules in the order in which they appear. If any two rules have the same explicit order, their order of appearance in krb5.conf breaks the tie. Explicitly specifying order can be useful where tools read and write the configuration file without preserving parameter order.

        Malformed rules are ignored.

    allow_hierarchical_capaths = boolean
        When validating cross-realm transit paths, absent any explicit capath from the client realm to the server realm, allow a hierarchical transit path via the common ancestor domain of the two realms. Defaults to true. Note, absent an explicit setting, hierarchical capaths are always used by the KDC when generating a referral to a destination with which is no direct trust.

    client_aware_channel_bindings = boolean
        If this flag is true, then all application protocol authentication requests will be flagged to indicate that the application supports channel bindings when operating over a secure channel. The default value is false.

    check_pac = boolean
        If this flag is true and a Windows Privilege Attribute Certificate (PAC) is present in the ticket authorization data, then krb5_rd_req(3) will validate the PAC before returning success. The default value is true.

    report_canonical_client_name = boolean
        If this flag is true, then the canonical client name from the PAC will be used instead of the client name in the ticket. The default value is false. Note that setting it to true implicitly sets check_pac to true.

[domain_realm]
    This is a list of mappings from DNS domain to Kerberos realm.

    It is used by the client and the TGS both to determine the realm of host-based service principal names based on the principal's hostname component.

    The client may try DNS to determine a host's realm; see the `dns_lookup_realm' parameter, and see below.

    The TGS will issue a referral when a host-based service does not exist in the requested realm but can be mapped with these rules to a different realm. The TGS will also issue a referral when a host-based service exists in the requested realm as an alias of a service in another realm.

    Each binding in this section looks like:

        domain = realm

    The domain can be either a full name of a host or a trailing component, in the latter case the domain-string should start with a period. The trailing component only matches hosts that are in the same domain, ie “.example.com” matches “foo.example.com”, but not “foo.test.example.com”.

    The realm may be the token `dns_locate', in which case the actual realm will be determined using DNS (independently of the setting of the `dns_lookup_realm' option).

[realms]

    REALM = {

        kdc = [service/]host[:port]
            Specifies a list of kdcs for this realm. If the optional port is absent, the default value for the “kerberos/udp” “kerberos/tcp”, and “http/tcp” port (depending on service) will be used. The kdcs will be used in the order that they are specified.

            The optional service specifies over what medium the kdc should be contacted. Possible services are “udp”, “tcp”, and “http”. Http can also be written as “http://”. Default service is “udp” and “tcp”.

        admin_server = host[:port]
            Specifies the admin server for this realm, where all the modifications to the database are performed.

        kpasswd_server = host[:port]
            Points to the server where all the password changes are performed. If there is no such entry, the kpasswd port on the admin_server host will be tried.

        tgs_require_subkey
            a boolan variable that defaults to false. Old DCE secd (pre 1.1) might need this to be true.

        auth_to_local_names = {

            principal_name = username
                The given principal_name will be mapped to the given username if the REALM is a default realm.

        }

        auth_to_local = HEIMDAL_DEFAULT
            Use the Heimdal default principal to username mapping. Applies to principals from the REALM if and only if REALM is a default realm.

        auth_to_local = DEFAULT
            Use the MIT default principal to username mapping. Applies to principals from the REALM if and only if REALM is a default realm.

        auth_to_local = DB:/path/to/db.txt
            Use a binary search of the given DB. The DB must be a flat-text file sortedf in the "C" locale, with each record being a line (separated by either LF or CRLF) consisting of a principal name followed by whitespace followed by a username. Applies to principals from the REALM if and only if REALM is a default realm.

        auth_to_local = DB:/path/to/db
            Use the given DB, if there's a plugin for it. Applies to principals from the REALM if and only if REALM is a default realm.

        auth_to_local = RULE:...
            Use the given rule, if there's a plugin for it. Applies to principals from the REALM if and only if REALM is a default realm.

        auth_to_local = NONE
            No additional principal to username mapping is done. Note that auth_to_local_names and any preceding auth_to_local rules have precedence.

        pkinit_require_eku = BOOL
            If true then the KDC PKINIT Extended Key Usage (EKU) OID (1.3.6.5.2.3.5) must be present in KDCs' PKINIT certificates. Defaults to true.

        pkinit_require_krbtgt_otherName = BOOL
            If true then the PKINIT Subject Alternative Name (SAN) for the TGS must be present in KDCs' PKINIT certificates, and must match their realm. Defaults to true.

        pkinit_require_hostname_match = BOOL
            If true then KDCs' PKINIT certificates must match their hostnames. Defaults to false.

        pkinit_trustedCertifiers = BOOL
            If true then PKINIT client will tell KDCs which trust anchors it trusts. Defaults to true.

        disable_pac = BOOL
            If true then the KDC will not sign tickets with PAC, which disables S4U2Proxy support. Defaults to false.

    }

[capaths]

    client-realm = {

        server-realm = hop-realm ...
            This serves two purposes. First the first listed hop-realm tells a client which realm it should contact in order to ultimately obtain credentials for a service in the server-realm. Secondly, it tells the KDC (and other servers) which realms are allowed in a multi-hop traversal from client-realm to server-realm. Except for the client case, the order of the realms are not important.

    }

[logging]

    entity = destination
        Specifies that entity should use the specified destination for logging. See the krb5_openlog(3) manual page for a list of defined destinations.

[kdc]

    database = {

        dbname = [DATBASETYPE:]DATABASENAME
            Use this database for this realm. The DATABASETYPE should be one of 'lmdb', 'db3', 'db1', 'db', 'sqlite', or 'ldap'. See the info documetation how to configure different database backends.

        realm = REALM
            Specifies the realm that will be stored in this database. It realm isn't set, it will used as the default database, there can only be one entry that doesn't have a realm stanza.

        mkey_file = FILENAME
            Use this keytab file for the master key of this database. If not specified DATABASENAME.mkey will be used.

        acl_file = PA FILENAME
            Use this file for the ACL list of this database.

        log_file = FILENAME
            Use this file as the log of changes performed to the database. This file is used by ipropd-master for propagating changes to slaves. It is also used by kadmind and kadmin (when used with the -l option), and by all applications using libkadm5 with the local backend, for two-phase commit functionality. Slaves also use this. Setting this to /dev/null disables two-phase commit and incremental propagation. Use iprop-log to show the contents of this log file.

        log-max-size = number
            When the log reaches this size (in bytes), the log will be truncated, saving some entries, and keeping the latest version number so as to not disrupt incremental propagation. If set to a negative value then automatic log truncation will be disabled. Defaults to 52428800 (50MB).

    }

    max-request = SIZE
        Maximum size of a kdc request.

    require-preauth = BOOL
        If set pre-authentication is required.

    ports = list of ports
        List of ports the kdc should listen to. The list should be double-quoted if it contains more than one port specification, and the ports should be separated by space or tab characters. A port value of “+” means "all the standard ports" for the service, otherwise each port value should be of a form resolvable by getservbyname(3) such as “someservicename/tcp”, “12345/udp”, or “12345/tcp”. If a numeric value is given with the ‘/’ and protocol name are missing then that port will be used on both, UDP and TCP. For example, “+ 8088/tcp” means “serve on the standard ports and also on port 8088 with TCP”.

    addresses = list of interfaces
        List of addresses the kdc should bind to.

    enable-http = BOOL
        Should the kdc answer kdc-requests over http.

    tgt-use-strongest-session-key = BOOL
        If this is TRUE then the KDC will prefer the strongest key from the client's AS-REQ or TGS-REQ enctype list for the ticket session key that is supported by the KDC and the target principal when the target principal is a krbtgt principal. Else it will prefer the first key from the client's AS-REQ enctype list that is also supported by the KDC and the target principal. Defaults to FALSE.

    svc-use-strongest-session-key = BOOL
        Like tgt-use-strongest-session-key, but applies to the session key enctype of tickets for services other than krbtgt principals. Defaults to FALSE.

    preauth-use-strongest-session-key = BOOL
        If TRUE then select the strongest possible enctype from the client's AS-REQ for PA-ETYPE-INFO2 (i.e., for password-based pre-authentication). Else pick the first supported enctype from the client's AS-REQ. Defaults to FALSE.

    use-strongest-server-key = BOOL
        If TRUE then the KDC picks, for the ticket encrypted part's key, the first supported enctype from the target service principal's hdb entry's current keyset. Else the KDC picks the first supported enctype from the target service principal's hdb entry's current keyset. Defaults to TRUE.

    check-ticket-addresses = BOOL
        Verify the addresses in the tickets used in tgs requests.

    warn_ticket_addresses = BOOL
        Warn about, but allow, usage of tickets from hosts that don't match the addresses in the tickets.

    allow-null-ticket-addresses = BOOL
        Allow address-less tickets.

    disable_pac = BOOL
        Do not include a PAC in service tickets. However, if a service has the auth-data-reqd attribute then the KDC will include a PAC anyways.

    enable_fast = BOOL
        Enable RFC 6113 FAST support, this is enabled by default.

    enable_armored_pa_enc_timestamp = BOOL
        Enable armored encrypted timestamp pre-authentication with key strengthening. RFC 6113 says not to use PA-ENC-TIMESTAMP in FAST armored tunnels as there is a newer replacement, PA-ENC-CHALLENGE, but for interoperability with earlier versions of Heimdal, this is enabled by default for now.

    enable_unarmored_pa_enc_timestamp = BOOL
        Enable unarmored encrypted timestamp pre-authentication. Enabled by default for now, but in a future release will be disabled.

    enable-pkinit = BOOL
        Enable PKINIT (disabled by default).

    pkinit_allow_rsa_key_transport = BOOL
        Enable RSA key transport. This is disabled by default as using Diffie-Hellman key agreement is more secure.

    pkinit_enable_rfc4556_kdf-pkinit = BOOL
        Enable or disable interoperability with clients that do not implement RFC 8636 (PKINIT algorithm agility). Note that the RFC 4556 KDF is based on SHA-1, and RFC 4556 has security issues that are fixed in RFC 8636.

    allow-anonymous = BOOL
        If the kdc is allowed to hand out anonymous tickets.

    synthetic_clients = BOOL
        If enabled then the KDC will issue tickets for clients that don't exist in the HDB provided that they use PKINIT, that PKINIT is enabled, and that the client's have certificates with PKINIT subject alternative names (SANs).

    synthetic_clients_max_life = TIME
        Maximum ticket lifetime for synthetic clients. Default: 5 minutes.

    synthetic_clients_max_renew = TIME
        Maximum ticket renewable lifetime for synthetic clients. Default: 5 minutes.

    pkinit_identity = HX509-STORE
        This is an HX509 store containing the KDC's PKINIT credential (private key and end-entity certificate). This is single valued, though multiple stores can be specified by separating them with commas. An HX509-STORE is of the form TYPE:name where TYPE is one of FILE, PEM-FILE, DER-FILE, PKCS12, PKCS11, or on OX X, KEYCHAIN. The form of the name depends on the TYPE. For FILE, PEM-FILE, DER-FILE, and PKCS12 the name is a file path. See the Heimdal hx509 documentation for more information.

    pkinit_pool = HX509-STORE
        This is a multi-valued parameter naming one or more stores of intermediate certification authority (CA) certificates for the KDC's end entity certificate.

    pkinit_anchors = HX509-STORE ...
        This is a multi-valued parameter naming one or more stores of anchors for PKINIT client certificates. Note that the DIR type of HX509-STORE is also supported here. DIR type stores are OpenSSL-style CA certificate hash directories.

    pkinit_revoke = HX509-STORE ...
        This is a multi-valued parameter naming one or more stores of CRLs for the issuers of PKINIT client certificates. Only the first valid CRL for a particular issuer will be checked. If no CRLs are configured, then CRLs will not be checked. This is because the KDC will not dereference CRL distribution points nor request OCSP responses.

    pkinit_kdc_ocsp = PATH
        This names a file whose contents is the DER encoding of an OCSPResponse for the KDC's end entity certificate.

    pkinit_kdc_friendly_name = NAME
        This is an optional friendly name of the KDC's end entity certificate. This is only helpful when the pkinit_identity store contains many credentials.

    pkinit_principal_in_certificate = BOOL
        If set to true then the KDC will match AS-REQ client principal names to the PKINIT subjectAlternativeName values from the clients' certificates. Defaults to true.

    pkinit_dh_min_bits = NUMBER
        Minimum acceptable modular Diffie-Hellman public key size in bits.

    pkinit_allow_ecdh = {

        CURVE = BOOL
            Indicates whether the given curve will be allowed. Curve names include “prime256v1” and “P-256” for NIST P-256, “prime384v1” and “P-384” for NIST P-384, “secp521r1” and “P-521” for NIST P-521, “X25519”, and “X448”.

    }

    pkinit_enable_kdf_ah_sha1 = BOOL

    pkinit_enable_kdf_ah_sha256 = BOOL

    pkinit_enable_kdf_ah_sha384 = BOOL

    pkinit_enable_kdf_ah_sha512 = BOOL
        By default all PKINIT KDFs are enabled, but you may disable them with these parameters.

    pkinit_max_life_from_cert_extension = BOOL
        If set to true then the KDC will override the max_life attribute of the client principal's HDB record with a maximum ticket life taken from a certificate extension with OID { iso(1) member-body(2) se(752) su(43) heim-pkix(16) 4 } and the DER encoding of an INTEGER number of seconds. Alternatively, if the extended key usage OID { iso(1) member-body(2) se(752) su(43) heim-pkix(16) 3 } is included in the client's certificate, then the notAfter minus the current time will be used.

    pkinit_max_life_bound = TIME
        If set, this will be a hard bound on the maximum ticket lifetime taken from the client's certificate. As usual, TIME can be given as a number followed by a unit, such as “2d” for “two days”.

    pkinit_max_life_from_cert = TIME
        If set, this will override the max_life attribute of the client principal's HDB record with the notAfter of the client's certificate minus the current time, bounded to the given relative TIME unless the pkinit_max_life_from_cert_extension parameter is set and the client's certificate has that extension. As usual, TIME can be given as a number followed by a unit, such as “2d” for “two days”.

    enable_gss_preauth = boolean
        Enables pre-authentication using a GSS-API mechanism supported by the client and KDC. The GSS-API initiator and AS request client names must match, unless the WELLKNOWN/FEDERATED name was used in the AS request, in which case the AS reply will contain the GSS-API initiator name. Authorization and mapping behavior may be customized by plugins. If synthetic clients are enabled, then the GSS-API initiator need not exist in the local database. GSS-API pre-authentication is disabled by default.

    enable_gss_auth_data = boolean
        When using GSS-API pre-authentication, includes a Kerberos authorization data element containing naming attributes associated with the GSS-API initiator. This is disabled by default as it may significantly increase the size of returned tickets.

    gss_mechanisms_allowed = mechs ...
        A list of GSS-API mechanisms that may be used for GSS-API pre-authentication.

    gss_cross_realm_mechanisms_allowed = mechs ...
        A list of GSS-API mechanisms that, when using the default authorization mechanism, will be permitted to map Kerberos principals in foreign realms. The list is empty by default. Initiator names from mechanisms not on this list will be mapped to an enterprise principal in the AS-REQ realm. This option is intended to avoid conflating GSS-API pre-authentication and Kerberos cross-realm authentication. The behavior is provided by the default authorization mechanism and will be overridden by an authorization plugin. Mechanisms may be identified by dot-separated OID or a short name.

    historical_anon_realm = boolean
        Enables pre-7.0 non-RFC-comformant KDC behavior. With this option set to true the client realm in anonymous pkinit AS replies will be the requested realm, rather than the RFC-conformant WELLKNOWN:ANONYMOUS realm. This can have a security impact on servers that expect to grant access to anonymous-but-authenticated to the KDC users of the realm in question: they would also grant access to unauthenticated anonymous users. As such, it is not recommend to set this option to true.

    encode_as_rep_as_tgs_rep = BOOL
        Encode as-rep as tgs-rep to be compatible with mistakes older DCE secd did.

    kdc_warn_pwexpire = TIME
        The time before expiration that the user should be warned that her password is about to expire.

    logging = Logging
        What type of logging the kdc should use, see also [logging]/kdc.

    hdb-ldap-structural-object structural object
        If the LDAP backend is used for storing principals, this is the structural object that will be used when creating and when reading objects. The default value is account .

    hdb-ldap-create-base creation dn
        is the dn that will be appended to the principal when creating entries. Default value is the search dn.

    enable-digest = BOOL
        Should the kdc answer digest requests. The default is FALSE.

    digests_allowed = list of digests
        Specifies the digests the kdc will reply to. The default is ntlm-v2.

    enable-kx509 = boolean
        Enables kx509 service.

        The kx509 service is configurable for a number of cases:

        default certificates for user or service principals,

        non-default certificate requests including subject alternative names (SAN) and extended key usage (EKU) certificate extensions, for either client, server, or mixed usage.

        Distinct configurations are supported for all of these cases as shown below:

            [kdc]
                enable-kx509 = yes | no
                require_csr  = yes | no
                require_initial_kca_tickets = yes | no
                realm = {
                    <REALM> = {
                        kx509 = {
                            <label> = {
                                <param> = <value>
                            }
                            hostbased_service = {
                                <service> = {
                                    <param> = <value>
                                }
                            }
                        }
                    }
                }

        where label is one of:

        user
            for default certificates for user principals,

        root_user
            for default certificates for root user principals,

        admin_user
            for default certificates for admin user principals,

        hostbased_service
            for default certificates for host-based service principals, in which case the service name is used as shown above,

        client
            for non-default client certificates,

        server
            for non-default server certificates,

        mixed
            for non-default client and server certificates.
        and where the parameters are as follows:

        ca = file
            Specifies the PEM credentials for the kx509 / bx509d certification authority. If not specified for any specific use-case, then that use-case will be disabled.

        max_cert_lifetime = NUMunit
            Specifies the maximum certificate lifetime as a decimal number and an optional unit (the default unit is “day” ).

        force_cert_lifetime = NUMunit
            Specifies a minimum certificate lifetime as a decimal number and an optional unit (the default unit is “day” ).

        allow_extra_lifetime = boolean
            Indicates whether a client may request longer lifetimes than their authentication credentials. Defaults to false.

        require_initial_kca_tickets = boolean
            Specified whether to require that tickets for the kca_service service principal be INITIAL. This may be set on a per-realm basis as well as globally. Defaults to true for the global setting.

        include_pkinit_san = boolean
            If true then the kx509 client principal's name and realm will be included in an id-pkinit-san subject alternative name certificate extension. This can be set on a per-realm basis as well as globally. Defaults to true for the global setting.

        email_domain = domain
            If set then the kx509 client user principal's name at the given domain will be included in an rfc822Name subject alternative name certificate extension. This can be set on a per-realm basis as well as globally. Defaults to false for the global setting.

        include_dnsname_san = boolean
            If true then a kx509 host-based or domain-based client principal's hostname will be included in an dNSName subject alternative name certificate extension, with the downcased realm as the domainname. This can be set on a per-realm basis as well as globally. Defaults to false for the global setting.

        ekus = OID
            List of OIDs to include as EKUs.

        subject_name = DN
            Specifies a subject name that should either be empty or contain variable interpolation as described below for template_cert. The subject may be the empty string, causing the issued certificates' subject names to be empty.

        template_cert = store
            Specifies the hx509 store (e.g., PEM-FILE:path) with a template for the certificates to be issued to kx509 clients whose principal names have one component (i.e., are user principals). A template is a certificate with variables to be interpolated in the subjectName. The following variables can be interpolated in the subject name using ${variable} syntax:

            principal-name
                The full name of the kx509 client principal.

            principal-name-without-realm
                The full name of the kx509 client principal, excluding the realm name.

            principal-name-realm
                The name of the client principal's realm.

            principal-component0
                The first component of the client principal.

            principal-component1
                The second component of the client principal.

            principal-component2
                The third component of the client principal.

            principal-service-name
                The name of the service.

            principal-host-name
                The name of the host.

            If a template and subject name are not specified and no default SANs are configured, then no certificate will be issued. Otherwise if a template and subject name are not specified, then subject of the certificate will be empty.

[hdb]

    db-dir = path
        This parameter defines a directory that can contain:

        kdc.conf
            A configuration file with the same format as krb5.conf that will be included.

        m-key
            The master key file.

        kdc.log
            The default logfile for the KDC when a logfile is not specified in [logging]

        kadm5.acl
            The access controls for kadmind.

        log The (binary) log of transactions used for HDB replication via the iprop protocol. See iprop-log(1) for more detail.

        pki-mapping
            The default PKINIT mapping file if one is not specified in [kdc] pkinit_mappings_file.
        and other files related to iprop operation.

    new_service_key_delay = time
        Sets a bias such that new keys are not taken into service until after the given time has passed since they were set. This is useful for key rotation on concrete principals shared by multiple instances of an application: set this time to twice or more the keytab fetch period used by applications.

    enable_virtual_hostbased_princs = boolean
        Heimdal supports a notion of virtual host-based service principals whose keys are derived from those of a base namespace principal of the form WELLKNOWN/HOSTBASED-NAMESPACE/svc/hostname. The service name can be wild-carded as _. Non-wildcarded services have to be listed in the virtual_hostbased_princ_svcs parameter (see below). This parameter enables this feature, which is disabled by default.

    virtual_hostbased_princ_ndots = Integer
        Minimum number of label-separating periods in virtual host-based service principals' hostname component.

    virtual_hostbased_princ_maxdots = Integer
        Maximum number of label-separating periods in namespaces' hostname component.

    virtual_hostbased_princ_svcs = service-name
        This multi-valued parameter lists service names not to wildcard when searching for a namespace for a virtual host-based service principal. Other service names will have keys derived from a matching namespace with a wild-carded service name. This allows one to have different attributes for different services. For example, the host service can be configured to have the ok-as-delegate flag while all others do not.

[bx509]
    This section contains online certification authority configuration, much like kx509 in the [kdc] section, but with the kx509 layer removed.

        [kdc]
            realm = {
                <REALM> = {
                    ...
                }
            }

[get-tgt]

    no_addresses = BOOL
        If set to true then the /get-tgt end-point of the bx509d(8) service will issue address-less TGTs. If set to false then the /get-tgt end-point of the bx509d(8) service will include the client's IP address in the TGT it issues it. Defaults to true.

    impersonation_key_type = KEYTYPE
        Specifies what key type to use for PKINIT client certificates for impersonating users for the /get-tgt end-point.

    impersonation_key_bits = NUMBER
        Specifies the key size when the impersonation_key_type parameter is set to “rsa”. /get-tgt end-point.

    allow_addresses = BOOL
        If set to true then the /get-tgt end-point of the bx509d(8) service will add arbitrary addresses requested by clients to the TGTs it issues them. Defaults to false.

    Certification authority related parameters are as for bx509.

[kadmin]

    password_lifetime = time
        If a principal already have its password set for expiration, this is the time it will be valid for after a change. A value of 0 will clear the password expiration after a successful password change.

    default_keys = keytypes...
        For each entry in default_keys try to parse it as a sequence of etype:salttype:salt syntax of this if something like:

        [(des|des3|etype):](pw-salt|afs3-salt)[:string]

        If etype is omitted it means everything, and if string is omitted it means the default salt string (for that principal and encryption type). Additional special values of keytypes are:

        v5  The Kerberos 5 salt pw-salt

    default_key_rules = {

        globing-rule = keytypes...
            a globbing rule to matching a principal, and when true, use the keytypes as specified the same format as [kadmin]default_keys .

    }

    prune-key-history = BOOL
        When adding keys to the key history, drop keys that are too old to match unexpired tickets (based on the principal's maximum ticket lifetime). If the KDC keystore is later compromised traffic protected with the discarded older keys may remain protected. This also keeps the HDB records for principals with key history from growing without bound. The default (backwards compatible) value is "false".

    use_v4_salt = BOOL
        When true, this is the same as

        default_keys = des3:pw-salt v4

        and is only left for backwards compatibility.

    [password_quality]
        Check the Password quality assurance in the info documentation for more information.

        check_library = library-name
            Library name that contains the password check_function

        check_function = function-name
            Function name for checking passwords in check_library

        policy_libraries = library1 ... libraryN
            List of libraries that can do password policy checks

        policies = policy1 ... policyN
            List of policy names to apply to the password. Builtin policies are among other minimum-length, character-class, external-check.

TOKEN EXPANSION
The values of some parameters are subject to percent token expansion. Expansions supported on all platforms:

%{LIBDIR}
    The install location of Heimdal libraries.

%{BINDIR}
    The install location of Heimdal user programs.

%{LIBEXEC}
    The install location of Heimdal services.

%{SBINDIR}
    The install location of Heimdal admin programs.

%{username}
    The current username.

%{TEMP}
    A temporary directory.

%{USERID}
    The current user's SID (Windows) or effective user ID (POSIX).

%{uid}
    The current user's SID (Windows) or real user ID (POSIX). On POSIX it is best to use the %{euid} token instead (see below).

%{null}
    The empty string.

Expansions supported on POSIX-like platforms:

%{euid}
    The current effective user ID.

%{loginname}
    The username of the logged-in user for this terminal.

%{LOCALSTATEDIR}
    The install location of Heimdal databases.

On Windows, several additional tokens can also be expanded:

%{APPDATA}
    Roaming application data (for current user).

%{COMMON_APPDATA}
    Application data (all users).

%{LOCAL_APPDATA}
    Local application data (for current user).

%{SYSTEM}
    Windows System folder.

%{WINDOWS}
    Windows folder.

%{USERCONFIG}
    Per user Heimdal configuration file path.

%{COMMONCONFIG}
    Common Heimdal configuration file path.

ENVIRONMENT

KRB5CCNAME
    names the credentials cache to use.

KRB5_TRACE
    names a file to write tracing messages to. See also krb5_openlog(3).

KRB5_KTNAME
    names the keytab to use (server-side).

KRB5_CLIENT_KTNAME
    names the keytab to use (client-side).

KRB5_OPENSSL_CNF
    names the OpenSSL configuration file to use.

KRB5_OPENSSL_PROPQ
    names the OpenSSL provider property query to use.

KRB5_CONFIG
    points to the configuration file to read.

FILES

/etc/krb5.conf
    configuration file for Kerberos 5.

EXAMPLES

    [libdefaults]
    	default_realm = FOO.SE
    	name_canon_rules = as-is:realm=FOO.SE
    	name_canon_rules = qualify:domain=foo.se:realm=FOO.SE
    	name_canon_rules = qualify:domain=bar.se:realm=FOO.SE
    	name_canon_rules = nss
    [domain_realm]
    	.foo.se = FOO.SE
    	.bar.se = FOO.SE
    [realms]
    	FOO.SE = {
    		kdc = kerberos.foo.se
    		default_domain = foo.se
    	}
    [logging]
    	kdc = FILE:/var/heimdal/kdc.log
    	kdc = SYSLOG:INFO
    	default = SYSLOG:INFO:USER
    [kadmin]
    	default_key_rules = {
    		*/ppp@* = arcfour-hmac-md5:pw-salt
    	}

DIAGNOSTICS
Since krb5.conf is read and parsed by the krb5 library, there is not a lot of opportunities for programs to report parsing errors in any useful format. To help overcome this problem, there is a program verify_krb5_conf that reads krb5.conf and tries to emit useful diagnostics from parsing errors. Note that this program does not have any way of knowing what options are actually used and thus cannot warn about unknown or misspelled ones.

SEE ALSO
kinit(1), krb5_openlog(3), strftime(3), getservbyname(3), verify_krb5_conf(8)