How does keytab work exactly?

一个人想着一个人 提交于 2019-12-05 11:44:05

Your diagram is wrong. You have a basic misunderstanding about how kerberos works. ( It's fairly common by the way). A service that uses kerberos for authentication NEVER talks to the kdc. All it ever does is use it's secret key ( keytab ) to decrypt blobs that are presented by the user.

The only part of kerberos that ever talks to the KDC is the client or user side. When it attempts to access the service at port 1010, it first asks the KDC for a service ticket for that service. This is a blob encrypted with the service's secret key that has the user's identity inside it. ( plus a bunch of other protocol related stuff ).

If you have an GSS based api inside your service on port 1010, all you need to do is tell that API where the keytab is and then ask it what the userid is on the connection. You never need to make any other connections to external services. I am not familiar with the Java API's, but there should only be one or two calls required to verify the user credentials.

While this dialogue doesn't exactly match the version of Kerberos currently in use, it will help you understand the basic principals.

http://web.mit.edu/kerberos/dialogue.html

To understand this, you must understand the basic principles of Kerberos, which is a "trusted third party" security system.

Your server will receive a "token" which the Ticket-Granting Service (TGS; basically, the Windows Domain Controller) has encrypted using the server's secret key, the one which is present in the keytab file. The server, naturally, will need access to that secret key in order to decrypt. If the decryption is successful, this is a guarantee to the server that the token is authentic because the secret key is known only to the TGS and the server—that's the secret these two parties share.

The phrase "trusted 3rd party" refers to the TGS because the server (party 1) allows the user (party 2) to be authenticated because it indirectly trusts the TGS (party 3).

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!