0

Microsoft describes the communication steps to receive a TGS as follows:

  1. client asks Kerberos DC for Ticket Granting Ticket
  2. client receives TGT (if authenticated successfully)
  3. client asks KDC for Ticket Granting Service, to get access to a certain platform
  4. client receives TGS (if TGT was valid)
  5. client accesses the platform and offers the TGS
  6. platform grants access (if the token is accepted)

Kerberos V Exchange TGS

I wonder how the client could ask for a certain TGS in the first place before the user hasn't even tried to access the destination platform? Or is this user step just omitted in the above given illustration?

Improve this question

1 Answer 1

Reset to default
1

It's assumed the client knows what service it's trying to authenticate to. The service indicated to the client that authentication was required and the client should go get a service ticket. All of that can and must happen independently of the Kerberos protocol itself.

Improve this answer
2
  • Great, thanks! Could the user approach the KDC and request a TGS without having talked to the destination service beforehand?
    – MarkHelms
    Jul 15, 2021 at 15:26
  • Yes, they're independent actions. Kerberos has no knowledge of any communication between the client the service. The only caveat is the client must know the SPN of the service before it can request a ticket. The protocol doesn't care at all how the client learned the SPN.
    – Steve
    Jul 15, 2021 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .