Kerberos is a protocol that allows users to authenticate on the network and access services once authenticated. Kerberos uses port 88 by default and has been the default authentication protocol for domain accounts since Windows 2000.

Kerberos is a stateless authentication protocol based on tickets. It effectively decouples a user's credentials from their requests to consumable resources, ensuring their password is not transmitted over the network. The protocol is fundamentally a symmetric-key authentication protocol, with optional assymetric features (like PKINIT). The Kerberos Key Distribution Center (KDC) maintains information such as user key information and ticket validity but does not record prior transaction history. Instead, the Kerberos Ticket Granting Service (TGS) relies on a valid Ticket Granting Ticket (TGT). It assumes that if a user has a valid TGT, they must have proven their identity.

Basic Understanding

At a very high level, when a user wants to interact with available resources on the network, the following occurs:

  1. They will first ask a centralized server for an "identity card".
  2. The user will then have to prove who they are, and in exchange, they will receive their "identity card," or Ticket Granting Ticket (TGT).
  3. This TGT will be presented whenever they want to access a service. Thus, each time they want to access a service, they will present this ID, and if it is valid, the central server will provide a temporary ticket to present to the requested resource.
  4. This temporary ticket contains all the user's information, such as their name, group membership, etc.
  5. The resource will then receive this ticket and will be able to grant access to its services if the user has the right to do so.

This process takes place in two stages. First, via a ticket request to identify a user's TGT, and then a request to access services using a Ticket Granting Service (TGS) ticket or Service Ticket (ST).

Note: Ticket Granting Service (TGS) is a component of the Key Distribution Center (KDC), which is responsible for issuing service tickets.