Every time I have read about the Kerberos protocol in the past, I have just passed through the section that talks about the "Authenticator" and have never thought about its role in the authentication process. For some reason I decided to know more about it today so this post explains what it does and why we need it.
** As you may know, the Kerberos protocol is based on the concept of key distribution and a number of keys are involved in the authentication process so I have used color coding to simplify correlation. Items in the same colour are referring to the same key. **
When a Kerberos client wants to interact with a service (like a secured WCF service), it needs a service ticket to pass its credentials to the service and prove its identity. The client obtains this service ticket by sending a request to the Key Distribution Center (KDC). After verifying the user credentials, the KDC creates and returns the following items back to the client:...