Kerberos

Kerberos is a network authentication protocol that verifies the identity of users and services using secret-key cryptography and time-limited tickets issued by a trusted third party called the Key Distribution Center (KDC). It lets two parties prove their identity over a non-secure network without sending passwords across it, and it is the default authentication protocol inside Microsoft Active Directory domains.

How Kerberos works

• The user authenticates once to the KDC and receives a Ticket Granting Ticket (TGT).
• To reach a service, the user presents the TGT and requests a service ticket.
• The KDC issues a time-limited service ticket for that specific resource.
• The service validates the ticket without contacting the KDC directly.
• Tickets expire automatically, which limits the window for misuse.

Examples and use cases

Inside a corporate domain, an employee logs into Windows and then reaches the file server and intranet without re-entering a password, because Kerberos tickets carry the proof. Kerberos is strong inside the perimeter, but it was not designed for browser-based SaaS across the public internet. That is why companies layer SAML or OIDC federation on top for cloud apps, while Kerberos keeps serving on-prem resources.

Related concepts

• LDAP and Single Sign-On (SSO)
• Identity Provider (IdP)
• Live article: Identity and access management with Active Directory, simply explained
• Live article: Fundamental concepts of identity and access management
• Live solution: Corma for IT teams

FAQ

What is the KDC in Kerberos?

‍The Key Distribution Center is the trusted server that authenticates users and issues tickets. It is the core of the Kerberos trust model.

Is Kerberos used for cloud SaaS?

‍Rarely on its own. Kerberos excels inside a network perimeter. For cloud apps, federation protocols like SAML and OIDC take over.

Why does Kerberos use tickets instead of passwords?

‍Tickets are time-limited and avoid transmitting passwords over the network, which reduces interception and replay risk.

Corma unifies governance across on-prem directory identity and cloud SaaS access. Explore Corma for IT teams or request a demo.