Skip Menu |

Subject: kadmin should have a script-friendly mode
Download (untitled) / with headers
text/plain 1.1KiB
The following design should be relatively easy to implement and would
make kadmin and kadmin.local easier to use in administrative scripts,
without creating backwards compatibility issues.

If there are any command-line arguments after the kadmin_startup getopt
loop is complete, they should be interpreted as a command with the
following semantics:

1. The command is split according to the argv entries (i.e. using
ss_execute_command), not according to ss_execute_line quoting.

2. No informational messages are displayed to stdout. Error messages
can still be displayed to stderr.

3. If the command fails to complete, kadmin exits with a non-zero
status. (In normal use, even with -q, it only exits with nonzero status
if it fails to connect to kadmind.)

I don't propose to fix #743 (prompt is displayed to stdout). I expect
this to be most useful in combination with kadmin -c so that the script
doesn't have to deal with inputting a password on each kadmin

Converting our Python tests to use the new syntax would be a bonus, as
it would mean the tests would immediately notice when a kadmin command
Subject: git commit
Download (untitled) / with headers
text/plain 1.4KiB

Support kadmin script mode

Add support for a command and argments to be specified on the kadmin
command line, with script-friendly behavior. kadmin_startup() now
yields either a request string or a request argv array, and sets
script_mode in the argv array case. Informational messages now go
through info() and are suppressed if script_mode is set. Prompts and
warning messages are also suppressed in script mode. Error messages
indicating a failure now go through error() and set exit_status if
script_mode is set. The extended com_err() hook is always installed
so that com_err messages go through error() and set exit_status.

getopt() is now invoked with a leading '+' to suppress Gnu getopt
argument reordering behavior, so that invokers don't need to pass "--"
to prevent query options from being treated as kadmin options.
Non-Gnu getopt implementations should harmlessly treat '+' as a valid
flag option, which has no effect as it will reach the same default
label in the switch statement.
Author: Greg Hudson <>
Commit: 040fe97758bdf53b6c00815b0306410eb88ea5ec
Branch: master
doc/admin/admin_commands/kadmin_local.rst | 23 ++-
src/kadmin/cli/kadmin.c | 351 ++++++++++++++++-------------
src/kadmin/cli/kadmin.h | 3 +-
src/kadmin/cli/ss_wrapper.c | 18 +-
4 files changed, 224 insertions(+), 171 deletions(-)
I found a small bug: "kadmin.local unknown_command ..." results in:

kadmin.local: Command not found (null)

because ss_perror() gets called with a NULL third argument. I will
submit a fix under the same issue number.
Subject: git commit

Fix kadmin script mode command-not-found error

In ss_wrapper.c, if ss_execute_command() returns an error, we should
call ss_perror() with *args as the third argument and not request
(which is NULL). Expand out the conditional into three commented
branches for greater clarity, since the error-handling is no longer
identical for the ss_execute_command() and ss_execute_line() cases.
Author: Greg Hudson <>
Commit: 9c491320f72f1e07f87c1cf5b7671505f3526891
Branch: master
src/kadmin/cli/ss_wrapper.c | 22 +++++++++++++++-------
1 files changed, 15 insertions(+), 7 deletions(-)