Hi,
I'm a software developer, and I implemented the SSO function in our product. I have a question about how does the Kerberos 5 Authentication work in cross domain environment.
the current status is:
1. In customer's company, there are two domains, Client Domain and Server Domain.
2. Server Domain trusts Client Domain. (One-way trust)
3. Client want access a service in Server Domain.
Customer found there are data traffic between the following machines:
1. Client machine and Client Domain AD machine.
2. Client machine and Server Domain AD machine.
3. Client machine and Server service provider machine.
Customer think the data traffic 2 (Client machine and Server Domain AD machine.) should not exist.
I read the document of < How the Kerberos Version 5 Authentication Protocol Works> https://technet.microsoft.com/en-us/library/cc772815%28v=ws.10%29.aspx
In the section of Cross-Realm Authentication Between Two Realms,
Cross-Realm Authentication Between Two Realms
To understand how cross-realm authentication works, first consider the simplest case: a network with only two realms, East and West. If administrators for these realms are members of the same organization, or if for some other reason they are willing to treat
the other realm's users as their own, they can enable authentication across realm boundaries simply by sharing an inter-realm key. (In Active Directory domains this happens automatically when two domains establish a trust relationship.) After the inter-realm
key is shared, the ticket-granting service of each realm is registered as a security principal with the other realm's KDC. As a result, the ticket-granting service in each realm can treat the ticket-granting service in the other realm as just another service,
something for which properly authenticated clients can request and receive service tickets.
When a user with an account in West wants access to a server with an account in East, the process is:
- The Kerberos client on the user's workstation sends a request for a service ticket to the ticket-granting service in the user account's realm, West.
- The ticket-granting service in West determines that the desired server is not a security principal in its realm, so it replies by sending the client a referral ticket—a TGT encrypted with the inter-realm key that the KDC in West shares with the KDC in East.
- The client uses the referral ticket to prepare a second request for a service ticket, and this time sends the request to the ticket-granting service in the server account's realm, East.
- The ticket-granting service in East uses its copy of the inter-realm key to decrypt the referral ticket. If decryption is successful, it sends the client a service ticket to the desired server in its domain.
From the above description, I think the data traffic 2 (Client machine and Server Domain AD machine.) is function as designed. Am I right?
Then I want test my thinking, so I shared a file in a Server domain machine. Then I access this shared file from the client machine which is in the Client domain. I captured the data traffic in the client machine, and I did NOT found the data traffic between
Client machine and Server Domain AD machine. This confused me. So my questions are:
1. In my customer's scenario, is the data traffic 2 reasonable?
2. If it's yes for question 1, why there is no data traffic 2 when client accessing the shared file in Server machine?