In fact they are the same, and that is called the Key Distribution Center (KDC).
The kerberos has three heads (like a cerberus):
- The KDC that consists in the auth and the ticket granting system.
- The Service.
- The user of the service.
The issue here is that what is really happening is:
- Alice authenticates herself against only one machine.
- Alice gets a ticket for an specific service (here is one of the tricks, she is authenticated but he hasn't access to all services, just the ones she asks the tickets for so she may be able to access the printer servers without compromising the "production servers" which she is also an admin). You are establishing boundaries.
- The ticket grants you access to the servers.
So, in fact, the servers "doesn't allow anybody" to get into, they just allow valid tickets. Think of it like going to the movies:
- You buy your tickets at home online (this would be like the auth phase, where you present your credentials, name, card number...):
- You go to the ticket machine and "auth" yourself with your credit card or an id number (the #1 step token), so it gives you a ticket.
- The guy at the front check your ticket and allow you to go into if it is the right session and the right place.
- You watch the movie.
As you can see "1" and "2" are very different operations and you will never have to show the guy at the front your credit card to let you go into the movie =)
Hope this helps a bit =) (Also, I have checked my notes and I have this link for you. )