Microsoft describes the communication steps to receive a TGS as follows:

  1. client asks Kerberos DC for Ticket Granting Ticket
  2. client receives TGT (if authenticated successfully)
  3. client asks KDC for Ticket Granting Service, to get access to a certain platform
  4. client receives TGS (if TGT was valid)
  5. client accesses the platform and offers the TGS
  6. platform grants access (if the token is accepted)

Kerberos V Exchange TGS

I wonder how the client could ask for a certain TGS in the first place before the user hasn't even tried to access the destination platform? Or is this user step just omitted in the above given illustration?


It's assumed the client knows what service it's trying to authenticate to. The service indicated to the client that authentication was required and the client should go get a service ticket. All of that can and must happen independently of the Kerberos protocol itself.

  • Great, thanks! Could the user approach the KDC and request a TGS without having talked to the destination service beforehand?
    – MarkHelms
    Jul 15 at 15:26
  • Yes, they're independent actions. Kerberos has no knowledge of any communication between the client the service. The only caveat is the client must know the SPN of the service before it can request a ticket. The protocol doesn't care at all how the client learned the SPN.
    – Steve
    Jul 15 at 15:30
  • Thanks, I got the picture now.
    – MarkHelms
    Jul 15 at 15:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.