...

In the AFS Authentication application window, to obtain new tokens, click "Obtain new tokens"... your username will be formatted as one of two ways depending on if you have a Cornell NetID or Cornell GuestID:

• netids provisioned at CNF before Feburary 23, 2025 are: your_netid@CIT.CORNELL.EDU
  • We are in the process of migrating these netids to CORNELL.EDU ... if CIT.CORNELL.EDU no longer works, please try CORNELL.EDU
• guestids (and netids provisioned at CNF on or after February 23, 2025) are your_guestids and netids are both: your_guestid_or_netid@CORNELL.EDU

both are case sensitive... the part after the '@' symbol must be all caps. While your netid or guestid itself must be lowercase.

 Linux

Look for the Key icon at the top right of your screen and mouse over the icon. A popup will tell you when your credentials will expire (if renewable the credentials will be renewed). You can also right click on the key icon and choose "List Tickets"... look for the tickets labeled "afs/cnf.cornell.edu@CNF.CORNELL.EDU" . If the key icon has a yellow exclamation or a red x, then you should manually obtain new credentials. Simply left click on the key icon – you will be prompted for your password.

If you run into problems where the Windows AFS GUI throws an error and will not give you tokens, and you have verified you are using the correct username format and correct password, see the General - Windows AFS GUI Login Error section below.

 Linux

Open an XTerm by choosing from the menus: Applications - CNF - XTerm .

From Or from the commandline, type "tokens" to see your tokens.

To obtain new tokens, either use the GUI application (key icon) mentioned above or from the commandline type in kinit <username> followed by entering your password followed by typing in: aklog. See below for proper formatting of your username.Newer versions of the gui krb5-auth-dialog application (the key icon mentioned above) have the ability to obtain and renew AFS tokens – you can install and configure this application on your local Linux system.again open an XTerm from the menus via Applications - CNF - XTerm and type in: kinit followed followed by pressing return... your identity will autopopulate based on your linux login. When entering in your password, the cursor will not move. After pressing return, if you do not receive an error, type in: aklog  .  There will not be any output after pressing return if there are not any errors. Type in "tokens" again to see your new tokens and expiration time. 

On CNF Thin, AFS Tokens will generally auto renew for up to 8 days after you re-connect to your session.

On Korat and Minx, Tokens will generally auto renew for up to 8 days after you first connect. After those 8 days are up, you will need to use the kinit and aklog commands as mentioned above to obtain new tokens.

You can view the final expiration time of your Kerberos tickets (AFS Tokens are derived from Kerberos tickets either with the aklog command or automatically) by typing in the command: klist

Macintosh

The built-in System Preferences panel for managing AFS tokens does not work properly in the CNF environment if your system is not configured correctly. Do not use it without talking to CNF IT.

We suggest using the GUI AFSLog application . This application will first open the Kerberos Ticket Viewer. After logging into Kerberos, exit the Kerberos Ticket Viewer. In approximately 5 seconds, the AFSLog application will either bounce for your attention or pop up a new window. The new window will show you your AFS tokens.

...

 You can both destroy your existing tokens and obtain new tokens using the above
Windows and Linux applications.

When obtaining new tokens, if using a Cornell netid provisioned at CNF before February 23, 2025, your username must be
formatted as:
        netid@CIT.CORNELL.EDU (@CIT.CORNELL.EDU must be all caps).

• We are in the process of migrating these netids to CORNELL.EDU ... if CIT.CORNELL.EDU no longer works, please try CORNELL.EDU

If using a Cornell GuestID (gid-xxxx), your username must be formatted as:
        guestid@CORNELL.EDU (@CORNELL.EDU must be all caps).

If using a Cornell NetID provisioned at CNF on or after February 23, 2025Cornell NetID, your username must be formatted as:
        @netid@CORNELLnetid@CORNELL.EDU (@CORNELL.EDU must be all caps).

Windows AFS Gui Login Error

We have seen some problems when attempting to obtain AFS Tokens using the Windows AFS client GUI. To work around this, you can use the Windows Powershell to get AFS Tokens:

1. Open a Powershell prompt
2. Type in the following:
   

   Code Block
   language powershell
   PS> cd "C:\Program Files\MIT\Kerberos\bin" PS> .\kinit <netid_or_guestid>@CORNELL.EDU

   (make sure to capitalize "CORNELL.EDU" ) . 
   You will be prompted for your netid or guestid password. The cursor will not move while you type in your password. Hit return when done.
3. Now type in the following:
   

   Code Block
   language powershell
   PS> cd "c:\Program Files\OpenAFS\Client\Program" PS> .\aklog -d

   you will see some debug output showing that you have successfully obtained AFS tokens.
4. The AFS GUI will now show your tokens.

 Access Control Lists

 An Access Control List (ACL) is the AFS mechanism which let you access
directories and files. This access mechanism works as follows:

...