Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a base understanding of how Kerberos works in an Active Directory environment and the methods it uses to authenticate users and workstations onto the network, but my question is.. since Kerberos relies on issuing a security token that the end user then uses to access network resources, how are systems (laptops) not on the domain able to access the same network resources using only the username and password of an active directory user?

I guess it would make more sense if just using the user credentials, Kerberos generates a security token and issues it to the system, but it seems like there should be more security there to prevent a nondomain system from accessing network resources.

If anyone could enlighten me, I'd appreciate it!

share|improve this question
    
Stupid question.. with the use of Kerberos in an Active Directory environment.. is there any need to have NTLM enabled? Not that I'm entirely sure it can be disabled, but I noticed on the wiki page joeqwerty linked to says Microsoft does not recommend it's usage. –  Eric Dec 6 '12 at 19:00

3 Answers 3

up vote 1 down vote accepted

NTLM is used in this case...

http://msdn.microsoft.com/en-us/library/windows/desktop/aa378749(v=vs.85).aspx

http://en.wikipedia.org/wiki/NTLM

share|improve this answer
    
Stupid question.. with the use of Kerberos in an Active Directory environment.. is there any need to have NTLM enabled? Not that I'm entirely sure it can be disabled, but I noticed on the wiki page you linked to says Microsoft does not recommend it's usage. –  Eric Dec 6 '12 at 18:59

I know at least one system that can use kerberos that works from non domain workstations. This application's name is "SAP NETWEAVER Portal". I performed some network sniffing on workstation and communication, when I log in to the web application which is between workstation and domain controllers. Before that, a dns query for srv _krb records of domain that I passed to the username field (it must be FQDN domain format e.g. mydomain.local\myusername) is made. After that, some kerberos frames occurs.

share|improve this answer

how are systems (laptops) not on the domain able to access the same network resources using only the username and password of an active directory user?

It depends on which "network resources" are involved. On a domain-joined Windows computer you're logged into, there are at least two client Kerberos identities in play:

  • you, user@DOMAIN
  • the computer, workstation$@DOMAIN

There is also host/workstation@DOMAIN, but that's generally the identification of a service running on the host, being accessed from elsewhere. If a privileged process on the host wants to do something -- say, add its name to DNS using Kerberos-authenticated dynamic DNS -- it will use its identity to do so, workstation$@DOMAIN. If you in your login session access some resource yourself, however -- say a CIFS network share, or an authenticated HTTP URL -- then the client identity is your principal name, user@DOMAIN (credentials for which are acquired automatically for you using the password you entered to log in). From your question, you seem to think that some combination is involved; it's not, they are separate.

This is why there's no problem using Kerberos to access Windows-based resources from other platforms. You can just as well type "kinit user" on a Linux box, enter your password to get a Kerberos credential (TGT) from a domain controller, and then use Firefox to access a Kerberos-authenticated web page on IIS. The protocols for all this are standard, and you don't need anything except your user credential.

A previous answer claimed that NTLM is required in this case; that's false (though certainly it may be used). However, when you access some resource from a non-domain computer and are prompted for your username and password, you don't necessarily know what authentication method is actually being used. It might use Kerberos. It might also just fall back to a password-based mechanism whereby it sends your username and password to the server for verification, and then cache your password so you don't have to re-enter it. Many protocols allow both via abstraction schemes like SASL. You'd have to look on the wire to see what's going on.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.