Kerberos kinit profile

krblogin.sh

#!/bin/sh
# /etc/profile.d/krblogin.sh
# jpm 2012-08-30
   
set -e

LDAPURIS="ldap://kdc.mens.de,ldap://kdc2.mens.de"
LDAPBASE="dc=mens,dc=de"
  
# PS1 is not set for SCP
  
if [ ! -z "$PS1" ]; then

        # Is the logged-in user in LDAP? If so, we assume (s)he's got
        # krb5 credentials, so prompt for credentials if we don't yet
        # have a valid credentials cache

        bold=`tput smso`
        norm=`tput rmso`
        ul_on=`tput smul`
        ul_off=`tput rmul`

        # Find user in LDAP

        username=${1:-$USER}
        cn=`ldapsearch -x -H ${LDAPURIS} \
                -b ${LDAPBASE} \
                -s sub \
                "(&(uid=$username)(host=*))" cn | sed -ne '/^cn:/s/^cn: *//p'`

        if [ -n "$cn" ]; then           # Found user in LDAP

                if klist -s; then
                        echo "Welcome back ${bold}${cn}${norm} :"
                        klist -5 | sed -e "s/^\(Default principal: \)\(.*\)/\1${bold}\2${norm}/" -e 's/^/|      /'
                else
                        echo "Welcome ${bold}${cn}${norm}. Enter ${ul_on}Kerberos${ul_off} credentials"
                        kinit -f
                fi

        fi
fi