Kerberos

Security Patterns

Meaning

Kerberos is a network authentication protocol that uses tickets to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. It is commonly used for single sign-on (SSO) in enterprise environments.

Primary Function

Authentication and authorization

Communicative Purpose

Provides secure authentication for services over an insecure network using ticket-based exchange.

Pattern

obtain TGT → request service ticket → access protected service

Função primária

Authentication and authorization

Propósito comunicativo

Provides secure authentication for services over an insecure network using ticket-based exchange.

Situações de gatilho

When implementing SSO for internal applications, when securing communication between microservices in a data center, when integrating with Active Directory or LDAP for user login.

Contextos

Enterprise IT systems, Windows Active Directory environments, Unix/Linux services using SASL/GSSAPI, cloud services that support Kerberos authentication.

Padrão

obtain TGT → request service ticket → access protected service

Colocados típicos

LDAP
Active Directory
SASL
GSSAPI
SPNEGO
ticket granting ticket (TGT)
service ticket

Substituições comuns

OAuth2
SAML
JWT-based authentication

Erros comuns

Assuming Kerberos encrypts data; it only provides authentication. Misconfiguring service principal names (SPNs). Not handling ticket renewal.

Similar / contraste

NTLM (older Microsoft auth, less secure); OAuth2 (token-based for APIs).

Interferências

Coming from OAuth2: expecting stateless tokens; Kerberos requires stateful ticket management and clock synchronization.

Família do chunk

Authentication protocols
SSO
Ticket-based auth
GSSAPI

Nuance

Requires time synchronization (within 5 minutes) across clients and servers; tickets have limited lifetime; not suitable for public internet without VPN.

Efeito pragmático

Enables strong mutual authentication and reduces password fatigue via SSO.

Dica de memória

Think of a three-headed dog guarding the gate: Kerberos issues tickets like guarded passes.

Nota

Kerberos requires all participants to have synchronized clocks (typically within 5 minutes) and correctly configured service principal names.

Upgrade path

Implementing Kerberos with constrained delegation or using FAST (Flexible Authentication Secure Tunnel) for stronger security.

Frequência: MediumFormulaicidade: FlexibleTipo de construção: conceptPrioridade de aquisição: Recognition firstPrioridade de output: BothTag de espaçamento: Long-term

Examples

import gssapi # Initialize a security context for a service (e.g., HTTP service on host "app.example.com") service_name = gssapi.Name('HTTP@app.example.com', name_type=gssapi.NameType.hostbased_service) ctx = gssapi.SecurityContext(name=service_name, usage='initiate') # Perform the token exchange to obtain a service ticket token = ctx.step() while not ctx.complete: # In a real client, send `token` to the server and receive the next token # Here we simulate a loop that would continue until the context is complete token = ctx.step(token) print('Kerberos authentication completed, service ticket acquired.')

import kerberos # Acquire a Kerberos ticket for the current user (equivalent to `kinit`) _, krb_context = kerberos.authGSSClientInit('HTTP@api.example.com') kerberos.authGSSClientStep(krb_context, '') # The client token can now be sent in an HTTP Authorization header auth_header = f'Negotiate {kerberos.authGSSClientResponse(krb_context)}' print('Add this header to your HTTP request:', auth_header)

import subprocess # Use the system `kinit` command to obtain a TGT for a user username = 'alice@example.com' password = 'SuperSecretPassword' # In practice, use a secure method to provide the password proc = subprocess.Popen(['kinit', username], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True) stdout, stderr = proc.communicate(input=password + '\n') if proc.returncode == 0: print('TGT obtained successfully.') else: print('kinit failed:', stderr) # After obtaining the TGT, you can SSH to a Kerberos-enabled host without a password ssh_command = ['ssh', '-K', 'host.example.com'] subprocess.run(ssh_command) print('SSH session established using Kerberos authentication.')