I was reading about kerberos authentication and how the password is not transferred on the wire but it exist in the kdc database to encrypt or decrypt messages, and only tickets are transferred after validation. I wonder when the user changes his password at the client how will it update the new password in the kdc database?
In simple terms Kerberos is a protocol used for authenticating users on a network.
In this example the client may change their password on the client machine, which in turn is saved into the network passwords database - commonly used is Active Directory.
Kerberos protocol requires the user to authenticate first against an authentication server, in this example it would be the sever holding the active directory, commonly called a domain controller.
Once authenticated then Kerberos assigns a ticket that is used instead of the password while wishin the protocol - such as requesting service tickets.
When authenticating the user encrypts a shared item(a timestamp) with his hash, if the kdc manages to decrypt the timestamp with the same hash it will return a TGT. This is signed with the kdc's secret password hash. (in a Microsoft environment this is krbtgt's password)
When replacing the password you need to provide a valid TGT, the original password and the new password encrypted. (and not hashed) this is done using the kadmin protocol which uses kerberos as a transport protocol. See http://web.mit.edu/krb5/old-build/sandbox/doc/kadmin/kpasswd.protocol