An employee logs in to the laptop in the morning, opens the CRM, and in the afternoon opens a file share. Which Kerberos exchanges run, and when is the password needed?

At logon the AS exchange runs once (password needed, TGT obtained); opening the CRM runs a TGS exchange for a CRM ticket and an AP exchange with the CRM; the file share in the afternoon needs only another TGS exchange and AP exchange, reusing the cached TGT, so no password is needed again.

1. Morning logon: the password is typed once. The client derives its key and runs phase 1 (AS-REQ/AS-REP). The credential cache now holds the TGT and the TGS session key.
2. CRM: the client has no CRM ticket yet, so it runs phase 2 with the cached TGT (TGS-REQ/TGS-REP) and gets a CRM service ticket plus service session key, then phase 3 (AP-REQ/AP-REP) with the CRM. The CRM grants access to customer data for authenticated employees.
3. Later CRM connections reuse the cached CRM ticket: only phase 3.
4. Afternoon file share: phase 2 again (a new ticket for the file service) and phase 3 with the file server. The AS is not contacted, the password is not asked for.

This is single sign-on: one authentication, many services. It holds as long as the TGT is valid (around 10 hours); after that the client must get a new TGT, which means entering the password again or renewing the ticket.

Go deeper:

• MIT Kerberos documentation: Ticket management — obtaining, viewing, renewing and destroying tickets as a user.
• MIT Kerberos documentation: klist — list the TGT and service tickets in your credential cache to watch SSO happen.