Kerberos

Kerberos is a network authentication protocol designed by MIT to provide mutual authentication between clients and services over insecure networks. It uses symmetric key cryptography and tickets issued by a trusted Key Distribution Center (KDC) to enable passwordless, replay-resistant single sign-on (SSO) within enterprise environments. The protocol is standardized in IETF RFC 4120 and underpins Active Directory, Integrated Windows Authentication (IWA), and many UNIX/Linux SSO deployments.

Key Capabilities

• Mutual authentication: Both client and service confirm each other’s identity, preventing impersonation and replay attacks.

• Ticket-based SSO: Users authenticate once to the KDC and then reuse the TGT to access multiple network services seamlessly.

• Encryption and integrity: Uses symmetric cryptography (typically AES) to protect credentials and validate message integrity.

• Delegation and constrained delegation: Allows a service to act on behalf of a user for backend access (used in web SSO via IWA or ADFS).

Limitations

• Network and time sensitivity: Kerberos authentication depends on synchronized system clocks between clients and Key Distribution Centers (KDCs), typically within ±5 minutes. Any clock drift can cause authentication failures.

• On-premises domain dependence: The protocol is designed for trusted, internal Active Directory or MIT Kerberos environments. Extending Kerberos authentication over untrusted or internet networks generally requires federation through IdPs such as ADFS or Microsoft Entra ID.

• Operational complexity: Misconfigurations in KDC setup, Service Principal Names (SPNs), or DNS often lead to authentication or SSO failures, making Kerberos management intricate.

• Limited MFA extensibility: Native Kerberos does not include built-in multi-factor or adaptive authentication; these capabilities must be layered on through external federation or gateway solutions.

• Not a modern token protocol: Kerberos issues time-bound tickets, not OIDC or OAuth 2.0 tokens. To enable web or API-based SSO, translation via identity federation platforms like ADFS or Keycloak is required.