Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there such a thing as a Kerberos Domain?

I'm pretty sure I've heard the term but I'm struggling to find a decent explanation (or any explanation).

Is it just people confusing it with an Windows Domain or an LDAP Domain?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

Not really, no. I would say that it's getting confused with an Active Directory domain. Kerberos is an authentication protocol. There is no domain concept in plain Kerberos.

The term "domain" refers to the organization structure of Active Directory. Active Directory employs Kerberos as one of its available authentication protocols, which I think is where the confusion would come in.

share|improve this answer
    
Yes, that sounds about right - thanks :) –  Adrian K Aug 16 '10 at 3:08
2  
"Realm" is the kerberos terminology equivalent to domain. –  davenpcj Oct 29 '10 at 20:43

See RFC4120, "The Kerberos Network Authentication Service (V5)". Realms are a namespace or administrative zone, usually tied to the domain used -- perhaps your people are referring to to a Kerberos realm?

EX: someone with AD domain credentials could authenticate to a non-Windows Kerberos realm. I notice Microsoft refers to "cross-domain" in discussions of Kerberos when "cross-realm" might be more appropriate.

share|improve this answer

Active directory is essentially a closely tied implementation of LDAP and Kerberos by microsoft, along with some customized tools and additional 'functionality' built on top. So it would be correct to say that kerberos is PART of a windows domain, but not that kerberos is equivalent to a windows domain.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.