path: root/contrib/ad-keytab.8

.\" Automatically generated by Pod::Man 4.09 (Pod::Simple 3.35)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.if !\nF .nr F 0
.if \nF>0 \{\
.    de IX
.    tm Index:\\$1\t\\n%\t"\\$2"
..
.    if !\nF==2 \{\
.        nr % 0
.        nr F 2
.    \}
.\}
.\"
.\" Accent mark definitions (@(#)ms.acc 1.5 88/02/08 SMI; from UCB 4.2).
.\" Fear.  Run.  Save yourself.  No user-serviceable parts.
.    \" fudge factors for nroff and troff
.if n \{\
.    ds #H 0
.    ds #V .8m
.    ds #F .3m
.    ds #[ \f1
.    ds #] \fP
.\}
.if t \{\
.    ds #H ((1u-(\\\\n(.fu%2u))*.13m)
.    ds #V .6m
.    ds #F 0
.    ds #[ \&
.    ds #] \&
.\}
.    \" simple accents for nroff and troff
.if n \{\
.    ds ' \&
.    ds ` \&
.    ds ^ \&
.    ds , \&
.    ds ~ ~
.    ds /
.\}
.if t \{\
.    ds ' \\k:\h'-(\\n(.wu*8/10-\*(#H)'\'\h"|\\n:u"
.    ds ` \\k:\h'-(\\n(.wu*8/10-\*(#H)'\`\h'|\\n:u'
.    ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'^\h'|\\n:u'
.    ds , \\k:\h'-(\\n(.wu*8/10)',\h'|\\n:u'
.    ds ~ \\k:\h'-(\\n(.wu-\*(#H-.1m)'~\h'|\\n:u'
.    ds / \\k:\h'-(\\n(.wu*8/10-\*(#H)'\z\(sl\h'|\\n:u'
.\}
.    \" troff and (daisy-wheel) nroff accents
.ds : \\k:\h'-(\\n(.wu*8/10-\*(#H+.1m+\*(#F)'\v'-\*(#V'\z.\h'.2m+\*(#F'.\h'|\\n:u'\v'\*(#V'
.ds 8 \h'\*(#H'\(*b\h'-\*(#H'
.ds o \\k:\h'-(\\n(.wu+\w'\(de'u-\*(#H)/2u'\v'-.3n'\*(#[\z\(de\v'.3n'\h'|\\n:u'\*(#]
.ds d- \h'\*(#H'\(pd\h'-\w'~'u'\v'-.25m'\f2\(hy\fP\v'.25m'\h'-\*(#H'
.ds D- D\\k:\h'-\w'D'u'\v'-.11m'\z\(hy\v'.11m'\h'|\\n:u'
.ds th \*(#[\v'.3m'\s+1I\s-1\v'-.3m'\h'-(\w'I'u*2/3)'\s-1o\s+1\*(#]
.ds Th \*(#[\s+2I\s-2\h'-\w'I'u*3/5'\v'-.3m'o\v'.3m'\*(#]
.ds ae a\h'-(\w'a'u*4/10)'e
.ds Ae A\h'-(\w'A'u*4/10)'E
.    \" corrections for vroff
.if v .ds ~ \\k:\h'-(\\n(.wu*9/10-\*(#H)'\s-2\u~\d\s+2\h'|\\n:u'
.if v .ds ^ \\k:\h'-(\\n(.wu*10/11-\*(#H)'\v'-.4m'^\v'.4m'\h'|\\n:u'
.    \" for low resolution devices (crt and lpr)
.if \n(.H>23 .if \n(.V>19 \
\{\
.    ds : e
.    ds 8 ss
.    ds o a
.    ds d- d\h'-1'\(ga
.    ds D- D\h'-1'\(hy
.    ds th \o'bp'
.    ds Th \o'LP'
.    ds ae ae
.    ds Ae AE
.\}
.rm #[ #] #H #V #F C
.\" ========================================================================
.\"
.IX Title "AD-KEYTAB 8"
.TH AD-KEYTAB 8 "2018-06-04" "1.4" "wallet"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
ad\-keytab
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
ad-keytab create|update|delete|show keytab-id [keytab\-file]
[\-\-ad_server=hostname] [\-\-computer_rdn=dn] [\-\-user_rdn] [\-\-dump]
[\-\-help] [\-\-manual] [\-\-debug]
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
This script is a wrapper around msktutil and ldapsearch to simplify
the creation of host and service keytabs.  The script is useful for
boot strapping the Kerberos credentials required to use Active
Directory as a backend keytab store for wallet.  The script shares
the wallet configuration file.
.PP
Generally, two keytabs will need to be created to setup wallet.  One
host keytab for the wallet server host and one service keytab for
wallet to use when connecting to an Active Directory Domain
Controller.
.PP
Note, this script does not update the Wallet database which means
any keytabs created by it will be invisible from wallet.
.SH "ACTIONS"
.IX Header "ACTIONS"
.IP "create" 4
.IX Item "create"
Add a keytab to \s-1AD\s0 and update the keytab file.  Fails if the keytab
already exists.
.IP "update" 4
.IX Item "update"
Update an existing keytab in \s-1AD\s0 and update the keytab file.  Fails if
the keytab does not exist.
.IP "delete" 4
.IX Item "delete"
Delete a keytab from \s-1AD\s0 and remove it from the keytab file.
.IP "show" 4
.IX Item "show"
Show \s-1AD\s0's view of the account corresponding to the keytab.  This action
does not use msktutil and queries \s-1AD\s0 directly using \s-1LDAP.\s0
.SH "OPTIONS AND ARGUMENTS"
.IX Header "OPTIONS AND ARGUMENTS"
.IP "keytab-id" 4
.IX Item "keytab-id"
This is either host principal name of the form host/<fqdn> or a
service principal name of the form service/<id>.  Service keytab
identifiers cannot be longer than 18 characters because of an
Active Directory restriction.
.IP "keytab-filename" 4
.IX Item "keytab-filename"
The name of the keytab file.  Defaults to /etc/krb5.keytab.
.IP "\-\-conf=filename" 4
.IX Item "--conf=filename"
The configuration file to read.  The script searches for a configuration
file in the following order.
.Sp
.Vb 4
\&      * The command line switch \-\-conf
\&      * The environment variable ADKEYTAB
\&      * The file .ad\-keytab.conf
\&      * The file /etc/ad\-keytab.conf
.Ve
.IP "\-\-ad_server=hostname" 4
.IX Item "--ad_server=hostname"
The name of the Active Directory host to connect to.  It is important
what the script contact only _one_ server due to the fact that
propagation within an Active Directory domain can be quite slow.
.IP "\-\-base_dn=ou=org,dc=domain,dc=tld" 4
.IX Item "--base_dn=ou=org,dc=domain,dc=tld"
The base distinguished name holding both computer and user accounts.
.IP "\-\-computer_rdn=dn" 4
.IX Item "--computer_rdn=dn"
The relative distinguished name to use as the base \s-1DN\s0 for both the
creation of host keytabs and searches of Active Directory.  The
distinguished name formed will be computer_rdn,base_dn.
.IP "\-\-user_rdn=dn" 4
.IX Item "--user_rdn=dn"
The relative distinguished name to use as the base \s-1DN\s0 for \s-1LDAP\s0
searches of Active Directory for service keytabs.  The distinguished
name formed will be user_rdn_rdn,base_dn.
.IP "\-\-dump" 4
.IX Item "--dump"
When displaying keytab attributes show all of the attributes.
.IP "\-\-help" 4
.IX Item "--help"
Displays help text.
.IP "\-\-manual" 4
.IX Item "--manual"
Displays more complete help text.
.IP "\-\-debug" 4
.IX Item "--debug"
Turns on debugging displays.
.SH "SEE ALSO"
.IX Header "SEE ALSO"
Set the documentation for Wallet::Config for configuration information, i.e.
perldoc Wallet::Config.
.SH "AUTHOR"
.IX Header "AUTHOR"
Bill MacAllister <whm@dropbox.com>
.SH "COPYRIGHT AND LICENSE"
.IX Header "COPYRIGHT AND LICENSE"
Copyright 2016 Dropbox, Inc.
.PP
Permission is hereby granted, free of charge, to any person obtaining a
copy of this software and associated documentation files (the \*(L"Software\*(R"),
to deal in the Software without restriction, including without limitation
the rights to use, copy, modify, merge, publish, distribute, sublicense,
and/or sell copies of the Software, and to permit persons to whom the
Software is furnished to do so, subject to the following conditions:
.PP
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
.PP
\&\s-1THE SOFTWARE IS PROVIDED \*(L"AS IS\*(R", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.\s0  \s-1IN NO EVENT SHALL
THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
DEALINGS IN THE SOFTWARE.\s0
.PP
SPDX-License-Identifier: \s-1MIT\s0