1*7f2fe78bSCy Schubert<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> 2*7f2fe78bSCy Schubert<html><head> 3*7f2fe78bSCy Schubert<meta name="GENERATOR" content="Microsoft� HTML Help Workshop 4.1"> 4*7f2fe78bSCy Schubert<link rel="stylesheet" type="text/css" href="Leash.css"> 5*7f2fe78bSCy Schubert<title>Kerberos Terminology</title></head> 6*7f2fe78bSCy Schubert 7*7f2fe78bSCy Schubert<body> 8*7f2fe78bSCy Schubert<h1><a name="top"> Kerberos Terminology</a></h1> 9*7f2fe78bSCy Schubert<p> 10*7f2fe78bSCy SchubertIt is helpful to understand three terms when using Kerberos; <a href="#principal"> principals</a>, <a href="#realm"> realms</a>, and <a href="#ticket"> tickets</a>.</p> 11*7f2fe78bSCy Schubert<p> 12*7f2fe78bSCy Schubert<table> 13*7f2fe78bSCy Schubert<tbody><tr> 14*7f2fe78bSCy Schubert<th><a name="principal">Principals</a></th> 15*7f2fe78bSCy Schubert</tr> 16*7f2fe78bSCy Schubert<tr> 17*7f2fe78bSCy Schubert<td> 18*7f2fe78bSCy Schubert A Kerberos <i>principal</i> is a unique identity that uses 19*7f2fe78bSCy SchubertKerberos. For users, it is the identity you use to log on to Kerberos. 20*7f2fe78bSCy SchubertPrincipals are a combination of your user name and the name of the <a href="#realm"> realm</a> (or domain) you belong to, in the form <span class="typed">username@REALM.NAME.</span> For example: <span class="typed">jdoe@SALES.WIDGET.COM.</span> 21*7f2fe78bSCy SchubertSome people will have more than one principal. An administrator might 22*7f2fe78bSCy Schuberthave a regular principal and a separate one with administrative rights. 23*7f2fe78bSCy SchubertOr if a particular installation uses multiple realms and requires a 24*7f2fe78bSCy Schubertseparate log-on for each one, people with access to multiple realms 25*7f2fe78bSCy Schubertwill have a principal for each realm. 26*7f2fe78bSCy Schubert<p></p> 27*7f2fe78bSCy SchubertBecause Kerberos provides <em>mutual</em> authentication, the 28*7f2fe78bSCy Schubertnetwork resources that use Kerberos also have unique principals. 29*7f2fe78bSCy SchubertHowever, you do not need to know a service's principal to access it.<p></p> 30*7f2fe78bSCy Schubert<a href="#top">Back to Top</a> 31*7f2fe78bSCy Schubert</td> 32*7f2fe78bSCy Schubert</tr> 33*7f2fe78bSCy Schubert<tr> 34*7f2fe78bSCy Schubert<th> <a name="realm"> Realms</a> </th> 35*7f2fe78bSCy Schubert</tr> 36*7f2fe78bSCy Schubert<tr> 37*7f2fe78bSCy Schubert<td> 38*7f2fe78bSCy Schubert Kerberos <i>realms</i> are a way of logically grouping 39*7f2fe78bSCy Schubertresources and identities that use Kerberos. Your realm is the home of 40*7f2fe78bSCy Schubertyour Kerberos identity and your point of entry to the network resources 41*7f2fe78bSCy Schubertcontrolled by Kerberos. In Windows, realms are called <em>domains.</em> 42*7f2fe78bSCy Schubert<p></p> 43*7f2fe78bSCy SchubertWhen a Kerberos installation is set up, administrators decide how to 44*7f2fe78bSCy Schubertgroup identities and network resources into realms. For example, some 45*7f2fe78bSCy Schubertinstallations group all network resources into one realm. Others group 46*7f2fe78bSCy Schubertall identities into one realm that is solely used as an entry point to 47*7f2fe78bSCy Schubertresources grouped in other realms. Depending on your installation and 48*7f2fe78bSCy Schubertyour needs, you might have a <a href="#principal"> principal</a> 49*7f2fe78bSCy Schubert(or principals) in only one realm that provides you with all the access 50*7f2fe78bSCy Schubertyou need, or you might have different principals for accessing 51*7f2fe78bSCy Schubertdifferent realms. 52*7f2fe78bSCy Schubert<p></p>Realms are usually named after the DNS domain they correspond 53*7f2fe78bSCy Schubertto, but using all upper case letters. For example, Widget Makers 54*7f2fe78bSCy SchubertIncorporated might have a realm named <span type="" typed="">WIDGETMAKERSINC.COM.</span> By definition, each network resource in a Kerberos realm uses the same Kerberos installation for authentication.<p></p> 55*7f2fe78bSCy Schubert <p></p> 56*7f2fe78bSCy Schubert<a href="#top">Back to Top</a> 57*7f2fe78bSCy Schubert</td> 58*7f2fe78bSCy Schubert</tr> 59*7f2fe78bSCy Schubert 60*7f2fe78bSCy Schubert<tr> 61*7f2fe78bSCy Schubert<th> <a name="ticket">Tickets</a></th> 62*7f2fe78bSCy Schubert</tr> 63*7f2fe78bSCy Schubert<tr> 64*7f2fe78bSCy Schubert<td> 65*7f2fe78bSCy SchubertKerberos uses the concept of <i>tickets </i> to keep passwords 66*7f2fe78bSCy Schubertfrom being transmitted in the clear and to provide users the 67*7f2fe78bSCy Schubertconvenience of a single log-on to access multiple services and hosts. <p></p> 68*7f2fe78bSCy SchubertOnce a you provide a valid principal and password, Kerberos issues you 69*7f2fe78bSCy Schuberta ticket with a limited lifetime. This ticket is an encrypted block of 70*7f2fe78bSCy Schubertdata that authenticates you. In most cases the ticket allows you to 71*7f2fe78bSCy Schubertaccess all of the appropriate network resources in the realm you use, 72*7f2fe78bSCy Schubertfor the lifetime of the ticket, without having to take any further 73*7f2fe78bSCy Schubertaction. <p></p> 74*7f2fe78bSCy SchubertWhen you access one of these resources, MIT Kerberos passes your 75*7f2fe78bSCy Schubertinitial Ticket Granting Ticket (TGT) to the service. Kerberos verifies 76*7f2fe78bSCy Schubertthe ticket and then issues a separate ticket that allows access to that 77*7f2fe78bSCy Schubertservice. You don't have to worry about obtaining or managing these new 78*7f2fe78bSCy Schubertservice tickets; they are automatically issued. Service tickets can be 79*7f2fe78bSCy Schubertviewed with MIT Kerberos but cannot be directly obtained or destroyed 80*7f2fe78bSCy Schubertthrough it. 81*7f2fe78bSCy Schubert<p></p> 82*7f2fe78bSCy SchubertTickets contain two <a href="JavaScript:popup.TextPopup(popupEncryptionKey, popfont,9,9,-1,-1)">encryption keys</a>: 83*7f2fe78bSCy Schubertthe ticket key and the session key. The ticket key is shared between 84*7f2fe78bSCy Schubertthe Kerberos infrastructure and the service you are using. The session 85*7f2fe78bSCy Schubertkey is shared between you and the service, and is used to encrypt and 86*7f2fe78bSCy Schubertdecrypt communication with the service. <p></p> 87*7f2fe78bSCy Schubert<a href="#top">Back to Top</a> 88*7f2fe78bSCy Schubert</td> 89*7f2fe78bSCy Schubert</tr> 90*7f2fe78bSCy Schubert</tbody></table> 91*7f2fe78bSCy Schubert</p><h2>Related Help</h2> 92*7f2fe78bSCy Schubert<ul id="helpul"> 93*7f2fe78bSCy Schubert<li><a href="HTML/Kerberos.htm">What is Kerberos?</a></li> 94*7f2fe78bSCy Schubert<li><a href="HTML/How_Kerberos_Works.htm">How does Kerberos work?</a></li> 95*7f2fe78bSCy Schubert<li><a href="HTML/Encryption_Types.htm">Encryption types</a></li> 96*7f2fe78bSCy Schubert</ul> 97*7f2fe78bSCy Schubert 98*7f2fe78bSCy Schubert<script language="JavaScript"> 99*7f2fe78bSCy Schubertpopfont="Arial,.725," 100*7f2fe78bSCy SchubertpopupEncryptionKey="A value that a specific code or algorithim uses to makes information unreadable to anyone without a matching key." 101*7f2fe78bSCy Schubert</script> 102*7f2fe78bSCy Schubert 103*7f2fe78bSCy Schubert<object id="popup" type="application/x-oleobject" classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11"> 104*7f2fe78bSCy Schubert</object> 105*7f2fe78bSCy Schubert</body></html> 106