client login using keytab file

[karman-docker]

Hi,
I am using this library for Kerberos authentication in my application. I have followed the examples provided in this repository to login my client application using a keytab file. Is there any other way for the client to login to KDC without using keytab file? The reason for my query is if the application is being used by thousands of users, this will require all those users first create a keytab file. I am wondering if there is some other alternative to using a keytab file. Similar to a browser which doesn't use keytab file. How does a browser able to sign-in to KDC without a keytab file ? Does it use the TGT generated when the user signs-in ?

[Denis-shl]

@karman-docker Hello, if I understood you correctly, then you can use the password https://github.com/jcmturner/gokrb5/blob/master/v8/client/client.go#L35

[huaraz]

A Browser uses the Kerberos cache file on linux and the windows credential store. This is part of IWA Integrates Windows authentication. See https://learn.microsoft.com/en-us/aspnet/web-api/overview/security/integrated-windows-authentication. Sending a password to the app is a bad idea i.e.