What is inside a Kerberos TGT ticket?

Question

I would like to know what makes up a TGT ticket? The reason is that we've noticed the more Windows AD groups the account is in, the larger the size of the ticket. We've also noticed that when we clear Internet Explorer cookies, the ticket size drops (ever so slightly).

Brief example: If the account is in 543 AD groups, then the ticket size is 12,960. We have found the approximate ratio is 21.7.

So, 543 x 21.7 ~ 13K as ticket size.

Due to these behaviors, I started wondering what is really inside the ticket? My goal: To help identify the biggest offender that's causing the TGT ticket to be larger than the max limit ticket size set in our Apache server.

Any help would be appreciated.

Thanks

Answer 1

Kerberos is essentially just for authentication, not authorization; however the ticket data structure has a field for authorization info, in case an implementer wants to encode such information in a credential. Unix implementations of Kerberos have mostly just left this field unused, but Microsoft chose to use it, and embeds a “privilege attribute certificate” (PAC) in tickets it issues containing security information about the AD account to which the client Kerberos principal corresponds: group memberships etc. This goes not just in the TGT, but in any ticket issued by AD. The advantage of this is that servers which receive these tickets immediately know these user attributes in a trustworthy fashion, and do not have to then query AD separately to discover them. A down side is that if things like group memberships change, a user needs to get a new ticket for that to be reflected (and are usually told to “log out and log in again” to accomplish that). And of course, if you remove someone from a group, that is not fully effective until all the user's tickets have expired.

My goal: To help identify the biggest offender that's causing the TGT ticket to be larger than the max limit ticket size set in our Apache server.

Apache doesn't have a “max ticket size.” Kerberos authentication happens in HTTP headers exchanged by the client and server, and the service ticket is encoded in them and so grows as the count of a user’s group memberships increase. Apache has a default size limit on headers which is low compared to possible AD ticket sizes (8K). You can just increase it with the Apache LimitRequestFieldSize directive.

Answer 2

A Kerberos ticket contains information such as group membership and SID history information in the request’s header. So if your user is having problems he's in too many groups. The only way to actually fix this is to reduce the group membership and maybe remove the SID history from the the user and group attributes. This will probably also increase your logon speeds for other services as well like Exchange for instance.