# What is Kerberos Authentication?

> Kerberos authentication is a ticket-based network authentication protocol in which a trusted Key Distribution Center (KDC) helps a client and network service establish authenticated, time-limited credentials.

- Canonical URL: https://yellowcube.eu/glossary/kerberos-authentication/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It uses symmetric cryptography so a user can access multiple participating services without sending the user’s password to each service. Kerberos Version 5 is specified by the IETF.

The client first obtains a ticket-granting ticket from the KDC’s authentication service. It then presents that ticket to the ticket-granting service to obtain a service ticket for a particular service principal. The client presents the service ticket and fresh authenticator to the service, which may also prove its identity to the client. Tickets and session keys are held in a credential cache until expiry or removal.

### Key points

- **Trust model:** Define realms, principals, service names, cross-realm relationships, KDCs, and long-term keys; a naming or key-management error can redirect or break authentication.
- **Ticket protection:** Use current encryption types and pre-authentication, restrict ticket lifetime and delegation, protect keytabs and credential caches, and destroy tickets when no longer needed.
- **Operational dependency:** Maintain accurate time, resilient KDC service, controlled key rotation, protected administration, and logs that can distinguish issuance from later service use.
- **Important limitation:** Kerberos authenticates principals but does not decide what an authenticated principal may do. A compromised KDC, service key, endpoint, or ticket cache can enable broad impersonation or reuse until affected credentials expire or are replaced.

### Related terms

[Authentication](<https://yellowcube.eu/glossary/authentication/>) · [Active Directory (AD)](<https://yellowcube.eu/glossary/active-directory/>) · [Single sign-on (SSO)](<https://yellowcube.eu/glossary/single-sign-on/>) · [Lightweight Directory Access Protocol (LDAP)](<https://yellowcube.eu/glossary/lightweight-directory-access-protocol/>) · [Login credentials](<https://yellowcube.eu/glossary/login-credentials/>)

### Sources

[RFC 4120: The Kerberos Network Authentication Service (V5)](https://datatracker.ietf.org/doc/html/rfc4120) · [MIT Kerberos documentation](https://web.mit.edu/~kerberos/krb5-latest/doc/index.html) · [MIT Kerberos: Encryption types](https://web.mit.edu/kerberos/krb5-latest/doc/admin/enctypes.html)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.