An enterprise systems administrator is troubleshooting a Kerberos authentication issue in an Active Directory environment. Place the steps of the Kerberos ticket exchange process in the correct order from initial user login to final resource access.
- 1The client workstation sends an Authentication Service Request (AS-REQ) containing user pre-authentication data to the Key Distribution Center (KDC).
- 2The KDC verifies the user's credentials and returns an Authentication Service Response (AS-REP) containing the Ticket Granting Ticket (TGT).
- 3The client submits a Ticket Granting Service Request (TGS-REQ) containing the TGT and target Service Principal Name (SPN) to the TGS.
- 4The TGS validates the TGT and returns a Ticket Granting Service Response (TGS-REP) containing the encrypted Service Ticket.
- 5The client presents the Service Ticket to the target application server to gain access to the resource.
Answer
The correct sequence starts with the client sending an AS-REQ with pre-authentication data to the KDC, followed by the KDC returning an AS-REP with the Ticket Granting Ticket (TGT). Next, the client submits a TGS-REQ containing the TGT and target SPN to the TGS, which responds with a TGS-REP containing the Service Ticket. Finally, the client presents the Service Ticket to the target application server.
Kerberos follows a strict authentication flow: First, the client initiates authentication with the Authentication Server via AS-REQ and receives a TGT via AS-REP. Next, the client uses the TGT to request a service-specific ticket from the TGS via TGS-REQ and receives the Service Ticket via TGS-REP. Finally, the client presents the Service Ticket directly to the target application server for resource access.
Step-by-Step Solution
Key Concept
Kerberos Authentication Exchange Process