id       = "krb5"
name     = "Kerberos"
homepage = "https://web.mit.edu/kerberos/"
description = "Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications by using secret-key cryptography."
# The Cerberus mark from MIT's own Kerberos page.
icon     = "https://web.mit.edu/kerberos/images/dog-ring.jpg"
# klist, kinit and kdestroy are the user-facing commands of an MIT Kerberos or
# Heimdal install; the entry is named for the project, since the binaries carry
# no config of their own and the files below belong to the Kerberos client.
executables   = ["klist", "kinit", "kdestroy"]
platforms = ["macos", "linux"]

[dotfiles]

# https://web.mit.edu/kerberos/krb5-latest/doc/user/user_config/k5identity.html —
# ".k5identity file, which resides in a user's home directory, contains a list
# of rules for selecting a client principals based on the server being
# accessed", used to choose a credential cache. The realm and KDC configuration
# is /etc/krb5.conf, which is system-wide and not listed here; the credential
# caches themselves are runtime state in /tmp or the OS keyring.
paths = ["~/.k5identity"]

# https://web.mit.edu/kerberos/krb5-latest/doc/user/user_config/k5login.html —
# .k5login lists the principals allowed to log in as this account: "Anyone with
# valid tickets for a principal in the file is allowed host access with the UID
# of the user in whose home directory the file resides." That is an access
# grant on one host, the Kerberos counterpart of ~/.ssh/authorized_keys, which
# this catalog also keeps out of a sync.
exclude = ["~/.k5login"]

# Nothing here is a credential: .k5identity holds principal names and host
# patterns, no keys. The keys live in the ticket cache and the keytab.
secret = []

# Read by the client library when it picks a cache; nothing holds it open.
side_effect = false

# No machine_lines: the rules map server realms and hostnames to the principal
# the user wants there, which is the same answer on every machine they work on.

[commands]
format = 1
label = "List Kerberos tickets"
description = "Show the tickets in a credential cache with klist. kinit and kdestroy are not covered."
quality = "ai-draft"
base = "fig:klist"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]
id = "fig"
kind = "completion"
url = "https://github.com/withfig/autocomplete/blob/master/src/klist.ts"
license = "MIT"

[[commands.field]]
id = "cache"
label = "Credential cache"
type = "string"
option = ["-c"]
sources = ["fig"]

[[commands.field]]
id = "flags"
label = "Show ticket flags"
type = "boolean"
option = ["-f"]
sources = ["fig"]

[[commands.field]]
id = "verbose"
label = "Verbose"
type = "boolean"
option = ["-v", "--verbose"]
sources = ["fig"]

[[commands.field]]
id = "list_all"
label = "List all caches"
type = "boolean"
option = ["-l", "--list-all"]
sources = ["fig"]

[[commands.field]]
id = "json"
label = "JSON output"
type = "boolean"
option = ["--json"]
sources = ["fig"]

[[commands.field]]
id = "test"
label = "Test for a valid TGT"
description = "Print nothing; the exit status says whether a valid ticket-granting ticket exists."
type = "boolean"
option = ["-s"]
sources = ["fig"]

[[commands.task]]
id = "list"
label = "List tickets"
fields = ["cache", "flags", "verbose"]

[[commands.task]]
id = "check"
label = "Check for a valid TGT"
set = { test = [true] }
fields = ["test", "cache"]

[[commands.group]]
id = "basic"
label = "Basic"
fields = ["cache", "flags", "verbose", "list_all", "json", "test"]