Repository navigation
Support OSX ticket cache #412
Description
Hello,
I was interested in being able to read a ticket cache on OSX and found issue #328 which is closed at this point. Being unable to reopen it I decided to create a new issue.
The best overview I have found on the subject of the non-FILE cache used on OSX is this page: https://k5wiki.kerberos.org/wiki/Projects/KCM_client
From the page:
Heimdal implements a credential cache type named "KCM" where operations are transmitted to a daemon process which manages the actual cache contents. The KCM daemon can be contacted via a Unix domain socket or, on OS X only, via Mach RPC. (There is also incomplete support in the source code for using Doors on Solaris.)
On OS X 10.7 and later, the native default credential cache type uses the KCM protocol via Mach RPC. It is typically referred to via the "API" cache type for continuity with Kerberos for Macintosh; the API and KCM cache types have the same namespace in the native OS X Kerberos.
Kerberos for Windows and Kerberos for Macintosh also implement a daemon-based cache type named "API". It uses a different protocol and transports.
So, a bit confusingly, even if klist on a modern OSX machine returns Credentials cache: API:XXXXXXX it is actually backed by the heimdal KCM protocol, reinforced in this mailing list thread: http://kerberos.996246.n3.nabble.com/API-cache-on-Mac-OSX-td44391.html
Apple's API: cache is Heimdal's kcm daemon, which recent (1.13+) MIT
supports as the KCM: ccache type.
As stated there is an added quirk on OSX: while KCM is using UNIX domain sockets on other systems, on OSX it appears to be reached via Mach RPC calls, something I was not at all familiar with prior to investigating this.
The MIT kerberos code supports both, with the implementation found here:
https://github.com/krb5/krb5/blob/master/src/lib/krb5/ccache/cc_kcm.c
/*
* This cache type contacts a daemon for each cache operation, using Heimdal's
* KCM protocol. On macOS, the preferred transport is Mach RPC; on other
* Unix-like platforms or if the daemon is not available via RPC, Unix domain
* sockets are used instead.
*/
Looking around the heimdal codebase I believe the equivalent code is found here:
https://github.com/heimdal/heimdal/blob/master/lib/ipc/client.c
What I feel most unsure about is how you would interact with the Mach RPC calls from this library, I have not been able to find any obvious native golang way of doing so.
Activity
sunxunkang commentedon Nov 9, 2020
I have the same problem.
sunxunkang commentedon Nov 11, 2020
ping~
sunxunkang commentedon Nov 12, 2020
anybody?
sunxunkang commentedon Dec 28, 2020
I get credential file via 'kgetcred' command on macos finally
jake-scott commentedon Feb 21, 2021
Hi - see #426 for a proposal on how to support this. I also need KCM support for an enterprise use-case and would be happy to implement if we can agree how..
Johnlon commentedon May 19, 2026
Given this is intended to be pure go I suppose it is put of the question simply to link into the native Kerberos libs for Mac and get all the native mac kinit like behaviour including access via "API:" caches etc?
That's the approach I've taken but it would be good to have an robust impl that many eyes have been on; eg here.
jake-scott commentedon May 19, 2026
You might want to take a look at : https://github.com/golang-auth/go-gssapi and https://github.com/golang-auth/go-gssapi-c instead.