Quiz Entry - updated: 2026.10.22
Which parties take part in a Kerberos realm, and what does each one do?
The client (the user's machine running the Kerberos software), the service the client wants to use, and the Kerberos server or Key Distribution Center (KDC), which plays two roles: the Authentication Server (AS) and the Ticket-Granting Server (TGS).
| Party | Job |
|---|---|
| User / principal | The person who wants to use an application from their laptop |
| Client | The Kerberos client software on the laptop: runs the protocol, holds the key material, stores received tickets in a local credential cache |
| Authentication Server (AS) | Authenticates users against its user database and issues the Ticket Granting Ticket (TGT) |
| Ticket-Granting Server (TGS) | Issues service tickets on the basis of a valid TGT; keeps a database of all registered services |
| Service | The application server (file server, printer, CRM, database) the user wants to use |
AS and TGS together form the KDC; in practice they run in the same process on the same server (in Windows, on every domain controller). A realm (Domäne) is the administrative domain served by one KDC, written in capitals such as ACME.COM. Unlike Needham-Schroeder, the server side is split into two roles, which is what makes single sign-on work.
Go deeper:
MIT Kerberos documentation: Kerberos V5 concepts — realms, principals, credential caches and keytabs.- Roguelynn: Explain like I'm 5, Kerberos — the parties and the three exchanges in plain language.