Re: Kerberos v. AD

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Dean Wells [MVP] (dwells_at_mask.msetechnology.com)
Date: 03/02/05 

Date: Tue, 1 Mar 2005 22:54:32 -0500

The TGT is the ticket initially given to an authenticating client once
it has successfully presented valid credentials. The TGT is then later
presented to KDCs (Key Distribution Centers / Windows DCs) by the client
in order to validate the issuance of session tickets. The session
tickets, once issued, are presented to resource servers by the client in
order that they may authorize access to the requested service.

Note that all tickets contain many attributes that dictate certain
behaviors, for example - ticket expiry time, maximum renewal period and
the ability for the client to (perhaps) be impersonated. 

-- 
Dean Wells [MVP / Directory Services]
MSEtechnology
[[ Please respond to the Newsgroup only regarding posts ]]
R e m o v e    t h e    m a s k    t o    s e n d    e m a i l
Spin wrote:
> Thanks Dean!  Just to be clear, where does the Kerberos Ticket
> granting ticket come into play in all of this?
>
> "Dean Wells [MVP]" <dwells@mask.msetechnology.com> wrote in message
> news:e6CZkPrHFHA.3076@tk2msftngp13.phx.gbl...
>> To be clear, Kerberos plays no part in the authorization process ...
>> it is used exclusively for authentication.  Kerberos creates ~secure
>> constructs called tickets which contain an attribute known as the PAC
>> (privileged attribute certificate) which in turn contains the Windows
>> Access Token.  This is a proprietary component (as it is on many OSs)
>> used to fuel the authorization process for an ACLable (Access Control
>> List) resource.
>>
>> Kerberos was selected by Microsoft as it was deemed to be a proven
>> industry standard.  Microsoft don't and shouldn't create proprietary
>> mechanisms to provide features that are common among many plaforms
>> (i.e. the process of auhentication).  Adherence to industry
>> standards hasn't long been a driving factor in Microsoft
>> technologies, more recently it is ... this is a good, good thing!
>>
>> Active Directory is Microsoft's interpretation and offering of an
>> LDAP service (with a specific slant toward maintaining compatibility
>> with Microsoft's definition of domain) ... it exploits or depends
>> upon a variety industry protocols including Kerberos, DNS and LDAP
>> and offers a centralized configuration mechanism for many others,
>> for example - IPsec.
>>
>> --
>> Dean Wells [MVP / Directory Services]
>> MSEtechnology
>> [[ Please respond to the Newsgroup only regarding posts ]]
>> R e m o v e    t h e    m a s k    t o    s e n d    e m a i l
>>
>> ptwilliams wrote:
>>> What do you mean?  AD does both.  It uses Kerberos v5 for
>>> authorisation, and then AD for secure authentication because of
>>> Kerberos.
>>>
>>> Why write a propriety system, when there's an excellent industry
>>> standard available.
>>>
>>> (Also, the US Justice Dept. and indeed the European one, would
>>> prefer it if MS didn't write everything themselves, and bundle
>>> everything as part of Windows ;-)

Relevant Pages

  • Re: Kerberised NFS
    ... Kerberised NFS presumably requires authentication and encryption between client and server, so presumably the client needs to get a ticket prior to contacting the server. ... server with kerberos security options, and successfully automounting user's home directories on client machines when they log in. ...
    (comp.protocols.kerberos)
  • Re: Kerberos Issues
    ... the ticket expired can happen if there is a time difference in the machine ... The event means the ticket you are presenting to your server has already ... > I get a ton of Kerberos event log items. ... > Client Realm: ...
    (microsoft.public.win2000.security)
  • Solved: Kerberised NFS
    ... Kerberised NFS presumably requires authentication and encryption between client and server, so presumably the client needs to get a ticket prior to contacting the server. ... server with kerberos security options, and successfully automounting user's home directories on client machines when they log in. ... first thing in the morning the home directories on client machines are inaccessable (i.e. when I ssh in my home directory is unavaliable). ...
    (comp.protocols.kerberos)
  • Re: Kerberos in Browser based Applications
    ... Just getting web-based authentication configured and working is only the beginning, ... forwarded ticket then be used to authenticate to other backend services on behalf of the user) ... I have set up a Kerberos realm. ... database) are both included as principals in KDC database and the ...
    (comp.protocols.kerberos)
  • Re: Kerberos error trying to talk to a server that no longer exist
    ... I found a computer object for nt4 and disabled it. ... based on what's stored in AD and gave that ticket to the client. ... Event Source: Kerberos ...
    (microsoft.public.windows.server.active_directory)