Implementing Kerberos Authentication
1. Understanding Kerberos Protocol
| Component | Role |
|---|---|
| KDC | Key Distribution Center (AS + TGS) |
| AS | Authentication Server — issues TGT |
| TGS | Ticket Granting Service — issues service tickets |
| Principal | Named entity (user@REALM, HTTP/host@REALM) |
| Realm | Administrative authentication domain |
2. Implementing Kerberos Authentication Flow
1. User → AS: AS-REQ (preauth with password-derived key)
2. AS → User: TGT encrypted with TGS key + session key encrypted with user key
3. User → TGS: TGS-REQ (TGT + service principal)
4. TGS → User: Service ticket encrypted with service key
5. User → Service: AP-REQ with service ticket
6. Service decrypts ticket → authenticated
3. Using Ticket Granting Ticket
| Property | Detail |
|---|---|
| Issued by | AS at initial login |
| Lifetime | Default 10 hours, renewable 7 days |
| Encrypted with | TGS service key (krbtgt) |
| Cache | Credential cache (ccache) on client |
| Risk | Pass-the-ticket / Golden Ticket if krbtgt key stolen |
4. Requesting Service Tickets
| Step | Detail |
|---|---|
| SPN | Service Principal Name (e.g., HTTP/web.example.com@REALM) |
| TGS-REQ | Includes TGT + SPN |
| TGS-REP | Service ticket encrypted with service's long-term key |
| Encryption | AES-256-CTS-HMAC-SHA1 preferred (RC4 deprecated) |
5. Validating Kerberos Tickets
| Check | Detail |
|---|---|
| Decrypt | With service's keytab key |
| Authenticator | Validates timestamp (≤5 min skew) |
| Replay | Cache authenticator until ticket exp |
| PAC | Validate Privilege Attribute Certificate signature (AD) |
6. Implementing Key Distribution Center
| Implementation | Notes |
|---|---|
| MIT Kerberos | Reference, Unix/Linux |
| Heimdal | BSD-licensed alternative |
| Active Directory | Microsoft's KDC + LDAP combined |
| Ports | 88/tcp+udp (KDC), 464 (kpasswd) |
7. Using Kerberos with Active Directory
| Concept | Detail |
|---|---|
| AD = KDC + LDAP | DCs serve both |
| SPN registration | setspn -A HTTP/host service-account |
| Keytab | Generated via ktpass |
| SPNEGO | HTTP "Negotiate" wraps Kerberos for browsers |
8. Implementing Kerberos Delegation
| Type | Detail |
|---|---|
| Unconstrained | Service can impersonate user anywhere — risky AVOID |
| Constrained (S4U2Proxy) | Limited to specific SPNs |
| Resource-Based (RBCD) | Target resource grants delegation |
| Protocol Transition (S4U2Self) | Service obtains ticket as user without password |
9. Handling Kerberos Ticket Expiration
| Event | Action |
|---|---|
| TGT expires | Re-prompt for credentials or use renewable until renew_till |
| Service ticket expires | Request new from TGS using TGT |
| Clock skew >5 min | KRB_AP_ERR_SKEW — sync NTP |
| Renewal | kinit -R before renew_till |
10. Implementing Cross-Realm Authentication
| Concept | Detail |
|---|---|
| Trust | Realms share inter-realm krbtgt keys |
| Transitive trust | A trusts B, B trusts C → A trusts C (AD forests) |
| Referral | KDC returns ticket to remote realm's TGS |
| Caveat | Each cross-realm hop must be auditable |