This document provides an overview and agenda for a presentation on Kerberos survival guide. The presentation covers Kerberos logon process, accessing a web site using Kerberos, troubleshooting Kerberos issues, and demonstrations of Kerberos and delegation. It includes definitions of key Kerberos terms like KDC, TGT, and service tickets. Details of the Kerberos protocol that are out of scope are also listed.

1. Kerberos Survival GuidePresented by:JD Wade, SharePoint Consultant, MCITPMail: jd.wade@hrizns.comBlog: http://wadingthrough.wordpress.comLinkedIn: JD WadeTwitter: http://twitter.com/JDWade

2. AgendaOverview

3. Logon Process

4. Accessing a Web Site

5. Troubleshooting

6. Kerberos Demos

7. Delegation and DemosKerberosMassachusetts Institute of Technology

8. Details Out of ScopeRenewing tickets

9. Ticket expiration

10. Keys

11. Authenticator

12. TGT Structure

13. Service Ticket Structure

14. Encryption/Decryption

15. Multiple domains/forests

16. DependenciesSPN

18. Service Principal NameService ClassHost NamePort

19. Service Classes allowed by hostalerterhttppolicyagentscmappmgmtiasprotectedstorageseclogonbrowseriisadrasmansnmpcifsminremoteaccessspoolercisvcmessengerreplicatorTapisrv clipsrvmsiserverrpctimedcommcsvcrpclocatortrksvrdhcpnetdderpcsstrkwksdmservernetddedsmrsvpupsdnsnetlogonsamssw3svcdnscachenetmanscardsvrwinseventlognmagentscesrvwwweventsystemoakleySchedulefaxplugplay

20. KerberosBenefits

21. Delegated Authentication

22. Interoperability

23. More Efficient Authentication

24. Mutual AuthenticationLogon Process

25. KDCAS

26. KDCAS

27. KDCTGSASSPN

28. KDCTGS

29. Access Web Site

30. 401

31. SPN

33. <system.webServer> <security> <authentication> <windowsAuthentication enabled="true" useAppPoolCredentials="true" /> </authentication> </security></system.webServer>

35. Troubleshooting

37. Demos

38. Delegation

40. FBAKerberos

41. ReferencesKen Schaefer’s Multi-Part Kerberos Blog Posts:http://www.adopenstatic.com/cs/blogs/ken/archive/2006/10/20/512.aspx

42. What Is Kerberos Authentication?http://technet.microsoft.com/en-us/library/cc780469%28WS.10%29.aspx