In Kerberos, the Authentication Server (AS) and the Ticket Granting Server (TGS) are generally implemented on the same server. This machine is called the Key Distribution Center (KDC).
Surely, it makes sense to implement these services on the same physical machine, as in small and medium-sized networks it would be overkill to separate these two services. Additionally, I have a relatively reliable source, which says (translated):
TGS and AS have to access the same DB => it doesn't make much sense to implement TGS and AS on different machines
However I don't see which database has to be shared between the two.
This is my idea, how I would separate AS and TGS, there are no shared databases:
- As AS and TGS are separated, they have a different Master Secret
- The AS has a database with all users with their respective master secret (used when the User signs in, to encrypt the session key), as well as the master secret of the TGS (to encrypt requested TGTs).
- The TGS has a database, which allows it to determine which user is allowed to use which service (ACL, revocation list, ...), as well as a database with all services with their respective master secrets (to encrypt Tickets).
When a user wants to use a service (simplified):
- Authenticate at the AS
- Get a Ticket Granting Ticket (TGT), encrypted with the TGS Master Secret, as well as the session key, encrypted with the user's master secret.
- Contact the TGS with the TGT
- Get a Ticket, encrypted with the Service's Master Secret
- Contact the Service with the Ticket
Am I missing something, or is there really no problem at all separating the AS and the TGS?