Public web server and AD- based Kerberos authentication

Question

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses (Form- based login/password). All I want is to get the domain username of the incoming user if they are coming from corporate network. I'm using keytab file on the webserver created with ktpass. Webserver is in DMZ and isolated from intranet. The Kerberos implementation in question is Active Directory.

• Is Kerberos suitable for public internet webserver authentication in this kind of setup?
• Are there some specific security considerations related to a setup like this?
• What are the necessary steps if the keytab file gets compromised?

Answer 1

I don't see any immediate weaknesses. Kerberos is going to look for the user to supply an access token generated by the Kerberos server which should only be available on your private network. The web server shouldn't know how to generate an access token that would allow access to the private network so all that could be done by compromising the service shared key of the web server would be to allow access to the webserver (which presumably the attacker already has access if they've compromised your service secret key.)

In fact, I don't believe the web server should even need access to the Kerberos server since it only needs to be able to verify a TGT which only requires knowledge of the service secret key. The client that is logged in to the private network should be the only one with a connection to both worlds.