Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since Kerberos relies on issuing a security token that the end user then uses to access network resources, how are systems (laptops) not on the domain able to access the same network resources using only the username and password of an active directory user?

I guess it would make more sense if just using the user credentials, Kerberos generates a security token and issues it to the system, but it seems like there should be more security there to prevent a nondomain system from accessing network resources.

If anyone could enlighten me, I'd appreciate it!

share|improve this question
    
Stupid question.. with the use of Kerberos in an Active Directory environment.. is there any need to have NTLM enabled? Not that I'm entirely sure it can be disabled, but I noticed on the wiki page joeqwerty linked to says Microsoft does not recommend it's usage. – Eric Dec 6 '12 at 19:00
up vote 2 down vote accepted

NTLM is used in this case...

http://msdn.microsoft.com/en-us/library/windows/desktop/aa378749(v=vs.85).aspx

http://en.wikipedia.org/wiki/NTLM

share|improve this answer
    
Stupid question.. with the use of Kerberos in an Active Directory environment.. is there any need to have NTLM enabled? Not that I'm entirely sure it can be disabled, but I noticed on the wiki page you linked to says Microsoft does not recommend it's usage. – Eric Dec 6 '12 at 18:59

how are systems (laptops) not on the domain able to access the same network resources using only the username and password of an active directory user?

It depends on which "network resources" are involved. On a domain-joined Windows computer you're logged into, there are at least two client Kerberos identities in play:

  • you, user@DOMAIN
  • the computer, workstation$@DOMAIN

There is also host/workstation@DOMAIN, but that's generally the identification of a service running on the host, being accessed from elsewhere. If a privileged process on the host wants to do something -- say, add its name to DNS using Kerberos-authenticated dynamic DNS -- it will use its identity to do so, workstation$@DOMAIN. If you in your login session access some resource yourself, however -- say a CIFS network share, or an authenticated HTTP URL -- then the client identity is your principal name, user@DOMAIN (credentials for which are acquired automatically for you using the password you entered to log in). From your question, you seem to think that some combination is involved; it's not, they are separate.

This is why there's no problem using Kerberos to access Windows-based resources from other platforms. You can just as well type "kinit user" on a Linux box, enter your password to get a Kerberos credential (TGT) from a domain controller, and then use Firefox to access a Kerberos-authenticated web page on IIS. The protocols for all this are standard, and you don't need anything except your user credential.

A previous answer claimed that NTLM is required in this case; that's false (though certainly it may be used). However, when you access some resource from a non-domain computer and are prompted for your username and password, you don't necessarily know what authentication method is actually being used. It might use Kerberos. It might also just fall back to a password-based mechanism whereby it sends your username and password to the server for verification, and then cache your password so you don't have to re-enter it. Many protocols allow both via abstraction schemes like SASL. You'd have to look on the wire to see what's going on.

share|improve this answer

I know at least one system that can use kerberos that works from non domain workstations. This application's name is "SAP NETWEAVER Portal". I performed some network sniffing on workstation and communication, when I log in to the web application which is between workstation and domain controllers. Before that, a dns query for srv _krb records of domain that I passed to the username field (it must be FQDN domain format e.g. mydomain.local\myusername) is made. After that, some kerberos frames occurs.

share|improve this answer

Instructions below are for how to authenticate to a Samba server using Kerberos from a Windows 7 client. I have not tested for other version of client and server:

On the Windows 7 client, "Run As Administrator" cmd.exe. Then enter this command to supply Windows with knowledge of the Kerberos domain controller (KDC) for the kerberos REALM.COM:

ksetup /setkdc REALM.COM kdc01.realm.com

(Enter more KDCs for the realm REALM.COM if they exist. Also, can add other realms.)

Then use Explorer to access the network share of interest. (E.g. \\samba.realm.com\share in the address bar.) A password prompt will open if the share is protected.

You'll need to specify the realm in the username. This can be done either like user@REALM.COM or REALM.COM\user.

Then enter the password.

share|improve this answer
    
/setkdc isn't even a valid flag on my Windows 7 computer? – James Johnston May 11 at 15:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.