Basic Kerberos Authentication

[@twaca]

One way to think of using Kerberos is to think of going to an amusement park. When you arrive at the park, you go to the main gate. You then proceed to the main ticket booth (the authentication server in the key distribution center) and purchase an all-day pass to the park (a ticket-granting ticket). You receive a purple wristband (because purple is the color for Wednesday) that indicates that you have paid your fee for that day and you have full access to the park. The colored wristband is good for all day. While in the park, you must purchase additional tickets for the rides. You walk up to a ticket booth (ticket-granting server) and the attendant notices that you have a purple wristband. You tell her you are wanting to ride the roller coaster. She issues you a ticket (session ticket) for the roller coaster. When you get to the roller coaster, the roller coaster attendant sees your purple wristband and accepts the ticket issued to you by the ticket seller. The roller coaster attendant does not need to check with the ticket seller because that is the only place you could have obtained that ticket. At the end of the day, when the park closes, the purple wristband for Wednesday no longer authenticates you. The wristband color for Thursday is orange. You also noticed that you did all the work. None of the ticket sellers or ride operators communicated with each other. It was up to you to procure tickets and walk around and distribute them. This is exactly the model as designed by MIT for Kerberos.

[@anibaldk]

Your explanation is clearer than the entire video

[@masoomanaqvi5107]

would love for u 2 come up with similar analogy for SAML

[@samirul223]

You are the best

[@denizbolat19]

great explanation in layman's terms

[@TacticalSommelier]

Thank you!

[@syedtaimoorhussain4626]

I was trying to understand the flow of the tickets and the keys for kerberos authentication process. This is the easiest explanation I found. It is clear now how it works, in my case for an SMB File share resource sharing. Thanks

[@devcentral]

Great to hear and thanks for the comment!

[@rkarthik63]

This is one of the best detailed explanations for KCD in KZbin.

[@devcentral]

Glad you liked it and thanks for the comment!

[@amzi-x]

The best explanasion how kerberos is works! Thank you!

[@devcentral]

Thanks for the comment! Glad you enjoyed the video!

[@NathanInSanAntonio]

nice backwards writing skills

[@treibsandbohrer]

guess what, they probably mirrored the whole thing

[@joepelletier6694]

@@charlyGnarly187 its mirrored irl

[@clayandro]

@@joepelletier6694 wahahaha xD

[@randomlegend631]

Lol

[@thedude7450]

Best explanation on all of KZbin. Kudos.

[@piyushhandekar2943]

Super helpful ...Thank you for clearing the concept !!

[@devcentral]

You are welcome and we appreciate the comment!!

[@tronwai]

8:34 double encrypted with service key and client key, but the session key is stored inside this double encryption, right? How will the client know that session key? I am assuming that "session key" is the key used to later encrypt all communication between client and server. If not, what happens when somebody intercepts the server ticket, when it is being sent to the server by the client, and then uses it for himself.

[@utubesanjay]

Are you writing backwards?

[@devcentral]

This is how we produce the Lightboards: kzbin.info/www/bejne/i2iokH9qrKiDisU

[@dmitrynt]

After SPNs were explained in a nutshell the rest of the video's req/rep mentions nothing about SPNs. Would be nice if it did.

[@EdenResolve]

Do you make your shirt with backwards logos or is he actually writing backwards?

[@devcentral]

Partially corrrect! We do have reverse logo shirts and this is how we produce these: kzbin.info/www/bejne/i2iokH9qrKiDisU

[@EdenResolve]

@@devcentral thats some fine attention to detail. Quite a few channels out there that don't put that much effort in.

[@Mortizul]

Is he writing backwards so we can read it forwards?

[@l-eon]

Asking the real questions

[@alexanderastardjiev9728]

No. He is just writing on the other side of the board. After that the video is flipped vertically.

[@l-eon]

@@alexanderastardjiev9728 How come the text on his shirt is readable then?

[@in2survive]

Leon Heess s done via software. Notice that he is writing with his “left” hand. Yes, he could be lefty, but that is how it is done.

[@l-eon]

@@in2survive No way they are tracking this logo so perfectly behind the glass. Either it is printed on mirrored or there is something else going on.

[@JamesBrodski]

Great video! But I don't believe the "Kerberos Tray" is a commonly recognized term in the context of the Kerberos authentication protocol.

[@marckaeser3565]

Thanks I like the video, but I have a little question: At 7:53, the session key meant to be used between the client and the service provider (principal) is encrypted using the secret key shared between the TGS and the Service Provider, but how does the client know the session key? If it is encrypted with a key only the principal and the TGS know, the client cannot decrypt it. Which part did I miss? How does the client learn about the session key? Is it just added and "one-time-encrypted" using the shared key between the client and the TGS? Thanks!

[@lindsayhefton1582]

I'd watch this first. kzbin.info/www/bejne/lWWXdHt6aLurY5I

[@kevindavies6824]

Thanks for a great video. Very clear.

[@מיכאלאלמליח-ז6צ]

I would be happy to know when you think you will publish the parts 2 & 3

[@devcentral]

part 2 will drop Dec 3rd, part 3 Dec 17th.

[@hyp3rvirus]

What about Java JAAS and thousands of threads requests? Nobody talks about Java but TGS are always lost in subject. How to workaround?

[@omchaudhary3072]

Do you know any live working example of KERBEROS?

[@HarryYese]

Basically every windows domain and a lot of other stuff uses Kerberos

[@SafikulIslam-nb9tu]

My system is sending user as domain\UserID format using Kerberos but need to send only user as UserID format to grant access. How to remove this domain name from user using Kerberos configuration? Anyone having any idea on this? Thanks for helping

[@JasonRahm]

should be able to modify the value of that session variable in the APM visual policy editor.

[@kumanish75]

amazing explanation

[@user-or7ji5hv8y]

How do the private keys get distributed to the different places in the first place? thx

[@devcentral]

The KDC holds all the secrets, but those secrets if compromised don't equate to having a user's password, just a set of keys derived from the user's password. Section 3.1 of the RFC should help: tools.ietf.org/html/rfc4120#section-3.1

[@TeraxGaming1024]

Could you please explain why ticket is getting large when users are memer of multiple groups?

[@devcentral]

the auth token built for a user includes the user SID as well as the SID of every group the user belongs to, which can lead to a very large ticket.

[@msa6467]

Good video, will be waiting for the f5 APM part

[@devcentral]

Dec 17th

[@benzlal]

Informative

[@devcentral]

thanks for the comment and glad you liked the video!

[@muhannadtahboush9914]

Dear can i know the mathematical function/ algorithms for kerberos v5 .

[@devcentral]

There is a solid list of resources here: medium.com/@robert.broeckelmann/kerberos-v5-related-specs-and-rfcs-281c7b088025.

[@Jinsh0]

What is AS in AS Req? And What is AP in AP Req? Someone kindly elaborate please..

[@danife]

Request and Response to and from the KDC Authz Service

[@mohamedsaeed9388]

Waiting for Part2,3

[@devcentral]

Dec 3rd, Dec 17th

[@Earth_Jitsu]

Thanks!

[@bhandaridsyt]

Waiting for other 2 videos

[@abhijithks7419]

Hi, can you please make a video on ssl vpn via apm module please ?

[@devcentral]

Are you thinking a general ssl vpn technology overview with APM specifics?

[@abhijithks7419]

F5 DevCentral yes

[@wolfestatebiz]

Good explanation i can see a little better what data transfer protocols are most about.. Cryptography

[@pablocaiza.]

nice

[@WilsonMar1]

Not to be nick-picky here, but I think it would help to mention the role of NTP servers being used to avoid running beyond MaxClockSkew

[@LeQNam]

sound too difficult to hear.

[@Alberto_Cavalcante]

Nice!

[@ltownandfriends4531]

squeak squeak squeak

[@jamesflorez5867]

Poorly explained...!!! incoherent!!! !!!!

[@patcoder1287]

Bullshit , very well explained. First sort your basics then come and watch the video. Directly u won't understand shit