Kerberos
A ticket-based network authentication protocol using symmetric cryptography and a trusted third party, the Key Distribution Center. A client authenticates once, receives a ticket-granting ticket, and exchanges it for short-lived service tickets without resending credentials. Version 5 is specified in RFC 4120.
Kerberos descends from the Needham-Schroeder protocol of 1978 and was built at MIT's Project Athena. It is the primary authentication protocol in Active Directory, which makes it one of the most widely used pieces of security software in existence. Its design, authenticate once then present short-lived tickets, is the same shape as every token-based system that followed, including OAuth. It also means the ticket handling is the attack surface: tickets that can be requested offline and cracked, service accounts with weak passwords, and delegation settings that let one compromise reach further than intended.
See also: Active Directory, Kerberoasting, Kerberos delegation abuse, Clifford Neuman, SSO
Related on Start with Identity
- GlossaryLDAP
Lightweight Directory Access Protocol. A protocol for querying and modifying a hierarchical directory of entries, each identified by a distinguished name. Used
- GlossaryNTLM
A challenge-response authentication protocol used by Windows before Kerberos and still present as a fallback. The client proves knowledge of a password hash wit
- GlossaryRADIUS
RADIUS (Remote Authentication Dial-In User Service) is a protocol, defined in [RFC 2865](https://www.rfc-editor.org/info/rfc2865/), that network devices such as
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- CVEFortinet administrative FortiCloud SSO authentication bypass across accounts
An attacker with their own FortiCloud account and registered device could log in as admin to other customers' Fortinet devices with FortiCloud SSO enabled. CWE-