* '''Key Distribution Center (KDC)''': Comprised of the Authentication Service (AS) and the Ticket Granting Service (TGS), it issues ticket-granting tickets (TGTs) and service tickets. * '''Kerberos Tickets''': Encrypted tokens used to authenticate users and services. Includes Ticket Granting Tickets (TGTs) and service tickets. * '''Security Principal''': An entity (user or service) identified by Kerberos for authentication. * '''Active Directory Domain Services (AD DS)''': Provides the KDC functionality in a Windows domain.
* '''Mutual Authentication''': Ensures both the user and the service verify each other's identity. * '''Single Sign-On (SSO)''': Allows users to authenticate once and access multiple resources without re-authenticating. * '''Secure Ticketing''': Uses tickets to authenticate users and services without transmitting passwords over the network. * '''Delegation''': Enables services to act on behalf of a user, useful for services that need to access resources on behalf of the user.
1. **User Login**: The user logs in and the client requests an Authentication Ticket (TGT) from the KDC's Authentication Service (AS). 2. **Ticket Granting Ticket (TGT)**: The AS verifies the user's credentials and issues a TGT, encrypted with the user's password hash. 3. **Service Ticket Request**: The client uses the TGT to request a service ticket from the Ticket Granting Service (TGS) for accessing a specific service. 4. **Service Ticket**: The TGS issues a service ticket, encrypted with the service's key. 5. **Access Service**: The client presents the service ticket to the target service, which verifies it and grants access.
* Ensure that the domain controller is configured to provide KDC services. * Use Group Policy Management (`gpmc.msc`) to configure Kerberos policies under `Computer Configuration` > `Policies` > `Windows Settings` > `Security Settings` > `Account Policies` > `Kerberos Policy`.
* Use the `klist` command to view cached Kerberos tickets: ```cmd klist ```
* Use the `kinit` command to renew the TGT: ```cmd kinit ```