What it means
Kerberos relies on a trusted key distribution center and shared cryptographic keys. After initial authentication, a client receives a ticket-granting ticket, then requests service tickets for particular resources. Services validate tickets rather than asking the user for a password each time.
How it works
Tickets contain identities, lifetimes, and session-key material protected by cryptography. Time synchronization, service principal names, key protection, delegation rules, and domain trust relationships are central to secure operation. Compromise of privileged keys or ticket-granting infrastructure can have broad consequences.
A user signs in to a managed workstation and receives a ticket-granting ticket. When the user opens a file service, the workstation obtains a service ticket and presents it to the server, enabling single sign-on without transmitting the user's password to that server.
Practical focus
- Protect domain controllers and high-value service-account keys
- Keep time synchronized and monitor unusual ticket behavior
- Use constrained delegation and modern encryption settings
- Rotate service credentials and remove obsolete principals
Common mistakes
- Assuming single sign-on eliminates the need for strong endpoint security
- Granting broad delegation because it is easier to configure
- Ignoring legacy encryption types and dormant service accounts
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: