Kerberos
termsecuritynetworking
The ticket-based network authentication protocol behind enterprise silent sign-on: a Key Distribution Center issues time-limited tickets that services can verify offline, so passwords travel once at login and never again.
In Active Directory environments Kerberos is the default authentication fabric, and web SSO products ride it through SPNEGO for prompt-free desktop login.
Kerberos solved a problem that looks impossible at first: authenticating users across a network without ever sending a password over it. The answer is tickets. Authenticate once to a central authority, receive a time-limited ticket, and present that ticket to services, which validate it without contacting the authority for every request.
This is why it underpins Active Directory and why single sign-on inside an enterprise feels seamless. It is also why Kerberos failures are so distinctive. Because tickets are time-limited and the protocol compares timestamps, clock skew beyond a few minutes breaks authentication outright, which is why domain members synchronize time obsessively and why "check the clock" is a genuine first diagnostic step rather than a joke.
The other characteristic failure is name-related. Tickets are issued for service principal names, so a service reached by an unexpected hostname, an alias, or an IP address may have no matching principal and fall back to something weaker or fail entirely. Most Kerberos troubleshooting is therefore about names and clocks rather than cryptography.
Also known as: Kerberos v5