1. Kerberos Authentication

2. Kerberos Requires shared secret with KDC ( perhaps not for PKINIT) Shared session key established Time synchronization needed Mutual Authentication Credentials allow impersonation

3. Authorization How does the authentication mechanism fit in authorization topology Authorization based on authenticated identity (mapping may be needed) Authorization within authentication messages (Kerberos auth data) What are authorization messages bound to?

4. Kerberos with Pull Model 1 User Org KDC User User Org AAA Server Application TGT AST AST, Auth IDAM OK Secure Channel KDC:Kerberos Key Distribution Center TGT:Ticket Granting Ticket AST:Application Service Ticket ID:Authenticate Identity AM:Message Authorizing Application by User Org

5. Kerberos with Pull Model 2 User Org KDC User User Org Authorization Server Application TGT AST AST,(TGTkey), TGT ASTAuth UOST UOSTAuth AM OK KDC:Kerberos Key Distribution Center TGT:Ticket Granting Ticket TGTKey: TGT key enc. w AST session key (KRB_CRED) UOST:User Org Authorization Server Service Ticket AST:Application Service Ticket AM:Message Authorizing Application by User Org UOST

6. Kerberos with Pull Model 3 User Org KDC User User Org Authorization Server Application TGT UOST UOST, Auth UOST Auth AM OK KDC:Kerberos Key Distribution Center TGT:Ticket Granting Ticket UOST:User Org Authorization Server Service Ticket Auth: Authenticator encrypted with session key AM:Message Authorizing Application by User Org Secure Channel

7. Push Example User Org KDC User User Org Authorization Server Application TGTUOST CERT OK UOST CERT KDC:Kerberos Key Distribution Center TGT:Ticket Granting Ticket UOST:User Org Authorization Server Service Ticket CERT:Authorization For User Signed By User Org / Bind to User principal or ???? AST

8. Inter-Domain Pull User Org KDC User User Org Authorization Server Application TGT Application Org KDC AST OK TGT AST IDAM TR KDC:User Org Kerberos Key Distribution Center KDC:Application Org Kerberos Key Distribution Center TGT:Application Org Ticket Granting Ticket AST:Application Service Ticket ID:Authenticate Identity AM:Message Authorizing Application by User Org TR:Trust Relationship TGT

9. Kerberos Inter-Realm User Org KDC UserApplication TGT Application Org KDC AST OK TGT AST TR TGT