Kerberos
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Kerberos?
Kerberos is a ticket-based network authentication protocol that lets users access services without repeatedly sending passwords. This profile connects the concept to KBY's practical engineering guidance.
A trusted Key Distribution Centre issues time-limited ticket-granting and service tickets protected with shared or public-key-derived secrets. Accurate time, service principal names, DNS and key management are critical to reliable operation.
Provide mutual, centralised authentication across an untrusted network.
- Enterprise single sign-on
- Active Directory authentication
- Secure network service access
5 resources for Kerberos
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Kerberos
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Systems Engineering(1)
Learn the architecture, concepts and engineering context.
Config Traps(3)
Recognise and avoid known failure modes.
- Unconstrained Kerberos Delegation on a Service Account Grants Domain-Wide ImpersonationAn Active Directory service account marked for unconstrained Kerberos delegation caches the TGT of any authenticating user, turning a routine legacy compatibility setting into a domain-wide impersonation risk. Open
- Kerberos Delegation Set to 'Kerberos Only' Blocks TransitionSelecting 'Use Kerberos only' for AD constrained delegation feels like the safer choice, but it quietly disables protocol transition and breaks non-Kerberos client authentication. Open
- msDS-SupportedEncryptionTypes: RC4 Still Wins KerberosWhen a service account's msDS-SupportedEncryptionTypes attribute is left unset or still includes RC4, any domain-authenticated user can request a TGS ticket for its SPN and crack the account's password offline. Domain-wide AES enforcement does not override this per-account gap, so the weakest cipher the KDC will negotiate still wins. Open