Automator application to connect SMB drives with Kerberos Authentication

All PC workstations in the office belong the company domain and single sign-on with kerberos works pretty much flawlessly.  As a Mac user, I also wanted the benefits of single sign-on.  Specifically, it is really nice not having to enter/save passwords for all the company websites.  In addition, connecting to network drives is faster with kerberos.

Lately, Ticket Viewer has not been playing nicely on Sierra, so I am using the terminal to run kinit to get a kerberos ticket at the beginning of the day.   This depends on some settings in /etc/krb5.conf which are displayed below.  Remember to replace REALM with your company domain.

[appdefaults]
forwardable = true
proxiable = true
no-address = true
[libdefaults]
default_realm = REALM
dns_lookup_kdc = true
dns_lookup_realm = true
[realms]

My typical morning routine is to open the laptop, open terminal, run "kinit username@REALM" to get the ticket, then run an automator application to mount the network drives I use.

The other day I remembered that Automator can run shell scripts, so I should be able to have my Automator application get the kerberos ticket before it tries to mount the drives and skip the terminal session.  As I did not want to save my password in a file somewhere on the drive, and trying to extract it from the keychain is problematic in Sierra, I just have my application present a dialog box with password input field and pass that on to kinit.  This works great.  Now I just run my application, type in the password and watch as the drives are connected.  Here is a screenshot of my application showing the applescript that presents the dialog box and gets the ticket.

UPDATE 2018-10-23:
I got tired of typing my password every time, so I saved it in my keychain and altered my automator application to use a shell script instead of an AppleScript because it was much easier.  See below for the shell script.

#!/bin/bash
# get the local IP address
theIP=`/sbin/ifconfig | /usr/bin/grep "inet 10" | /usr/bin/grep -v inet6 | /usr/bin/cut -d" " -f2 | /usr/bin/cut -d. -f1`
# if IP address starts with 10 then I am probably at work
if [ $theIP -eq 10 ]; then
 kticket=`/usr/bin/klist | /usr/bin/grep krbtgt`
 if [ -z "$kticket" ]; then
  /usr/bin/kinit -f  --enterprise --canonicalize username@company.com@COMPANY.COM
 fi
 /usr/bin/open 'smb://server1.company.com/share'
 /usr/bin/open 'smb://server2.company.com/share'
fi