I currently try to understand the Kerberos protocol. And I think I understand the parts of it. How Alice gets a ticket from the Authentication Server to authenticate herself to the ticket granting service. And how that one does the same, so Alice can authenticate herself to Bob.

But what I don't understand is, why aren't the Kerberos Authentication Server and the Ticket Granting Server the same?

1 Answer 1


In fact they are the same, and that is called the Key Distribution Center (KDC).

The kerberos has three heads (like a cerberus):

  1. The KDC that consists in the auth and the ticket granting system.
  2. The Service.
  3. The user of the service.

The issue here is that what is really happening is:

  1. Alice authenticates herself against only one machine.
  2. Alice gets a ticket for an specific service (here is one of the tricks, she is authenticated but he hasn't access to all services, just the ones she asks the tickets for so she may be able to access the printer servers without compromising the "production servers" which she is also an admin). You are establishing boundaries.
  3. The ticket grants you access to the servers.

So, in fact, the servers "doesn't allow anybody" to get into, they just allow valid tickets. Think of it like going to the movies:

  1. You buy your tickets at home online (this would be like the auth phase, where you present your credentials, name, card number...):
  2. You go to the ticket machine and "auth" yourself with your credit card or an id number (the #1 step token), so it gives you a ticket.
  3. The guy at the front check your ticket and allow you to go into if it is the right session and the right place.
  4. You watch the movie.

As you can see "1" and "2" are very different operations and you will never have to show the guy at the front your credit card to let you go into the movie =)

Hope this helps a bit =) (Also, I have checked my notes and I have this link for you. )

  • Clarification: When I say "it is the same" I mean that the auth and TGS are usually served by the same machine. Of course they are different processes.
    – kiBytes
    Feb 21, 2014 at 20:22
  • 1
    Thank you very much. That really helped me. And your link is great! Feb 21, 2014 at 21:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .