Kerberos
Kerberos is a network authentication protocol designed to provide secure authentication for users and services in a distributed computing environment. It is widely used as the primary authentication mechanism in Windows Active Directory domains and many other network environments.
Here is a quick high-level overview of how Kerberos authentication works:
The client requests a TGT to the KDC by sending an AS_REQ, which additional information encrypted with the client’s Kerberos key (Kerberos pre-authentication; not always required)
The KDC responds with an AS_REP containing a TGT encrypted with the KDC key and a session key encrypted with the client’s Kerberos key to encrypt and authenticate communication with the KDC.
The client connects with a service and negotiates the authentication using SPNEGO.
The client requests an ST from the KDC by sending a TGS_REQ that includes the TGT and the SPN of the target service.
The KDC decrypts the TGT with its Kerberos key to access the username and the session key. The KDC responds with a TGS_REP containing an ST and session key for the client to encrypt communications with the target service.
The client sends the ST to the service with an AP_REQ message. The service decrypts the ST and gets the service session key and the PAC. The service will use security information from the PAC to determine what access the user has to its resources.
The target service sends an AP_REP to the client to confirm that it is the service desired.
Kerberos Extensions
Kerberos extensions are additional features added to the standard Kerberos protocol that provide additional functionality, security, and flexibility. I'll talk about a few important ones here.
The PAC (Privilege Attribute Certificate) is a structure within Kerberos TGTs and STs that contains authorization data for a user such as group memberships, user privileges, etc.
S4U2Self allows a service to obtain a ST on behalf of a user without needing the user's password or TGT.
How it works:
Service obtains TGT from the KDC
Service makes a S4U2Self request to the KDC to request a ST for the user that it is acting on behalf of
S4U2Proxy allows a service to delegate a user's credentials to another service.
After receiving a ST via S4U2Self, the service can then obtain a ticket to another service on behalf of the user.
U2U (User-to-User) allows mutual authentication between two parties (user-to-user or user-to-service and vice versa) using each other's TGTs. This is typically used in situations where both parties need to verify each other's identity.
How it works:
Client obtains TGT from the KDC
Client requests a ST from the KDC encrypted with the target's TGT session key (instead of the target's secret key)
Client sends the ST to the target
Target decrypts the ST using its TGT session key and validates the client's identity
The target can then also validate the client
Last updated