Save kerberos password in keychain for use with kinit on MacOS (was OS X) for use with network drives

I work for a company that uses and Active Directory domain for the internal network. Therefore, kerberos authentication is supported. MacOS also supports kerberos authentication, so I can replicate most of the single sign-on experience on my Mac. I wrote a simple shell script to get a kerberos ticket-granting ticket and mount the network drives:

#!/bin/bash
# get the local IP address
theIP=`/sbin/ifconfig | /usr/bin/grep "inet 10" | /usr/bin/grep -v inet6 | /usr/bin/cut -d" " -f2 | /usr/bin/cut -d. -f1`
# if IP address starts with 10 then I am probably on work's internal network
if [ $theIP -eq 10 ]; then
 /usr/bin/kinit -f  --enterprise --canonicalize username@company.com@COMPANY.COM
 /usr/bin/open 'smb://server.company.com/share'
fi

To make this script really useful, I save my password securely in MacOS's keychain so that kinit can grab it automatically. I use the following command in the terminal:
 

security add-generic-password -a "username@company.com" -l "COMPANY.COM (USERNAME)" -s "COMPANY.COM" -c "aapl" -T "/usr/bin/kinit"

After I create the keychain entry, I open the Keychain Access application and find the newly created entry so I can add the actual password.  I just double-click on the new entry.

In order to make it work properly, I add a backslash before the @ sign in the account name.  I also click the Show password checkbox, authenticate, and type my password in the box at the bottom of this window.

Then I click on the Access Control tab and grant access to Terminal so I can test the script.  Of course, I click Save Changes before closing the window.

That is it! Now the script can run without any intervention on my part. If I change my company password, I have to come in here to Keychain Access, click on show password, authenticate, and then change the password to the new one.