How Kerberos V5 works

Document directory

•  

The Kerberos v5 authentication mechanism issues a ticket for accessing network services. These tickets contain encrypted data that can be used to confirm the identity of the user to the requested service, including the encrypted password. In addition to entering passwords or smart card creden。, the entire authentication process is invisible to users.

Key Distribution Center (kdc) is an important service in Kerberos V5 ). KDC runs on each domain controller as part of the Active Directory Service and stores all client passwords and other account information.

The Kerberos v5 authentication process works as follows:

1.	The user on the client system uses a password or smart card to authenticate the identity of KDC.
2.	KDC issues a special authorization ticket to this client. The client system uses the TGT to access the ticketing service (TGs), which is part of the Kerberos v5 authentication mechanism on the domain controller.
3.	TGS then issues a service ticket to the client.
4.	The client presents a service ticket to the requested network service. The service ticket proves the identity of the user to the service, and also proves the identity of the Service to the user.

The Kerberos V5 service is installed on each domain controller, and the Kerberos client is installed on each workstation and server.

Each domain controller is used as a KDC. The client uses the Domain Name Service (DNS) to locate the nearest available domain controller. The domain controller runs as the user's preferred KDC in the user login session. If the preferred KDC is unavailable, the system locates the standby KDC to provide authentication.