Kerberos: The Definitive Guide

Directories

A common misconception surrounding Kerberos and other authentication technologies is that they somehow replace directories, such as the Unix /etc/passwd file, NIS, NetInfo, or LDAP. Along the same lines, another common misconception is that directories make good authentication systems by themselves. Therefore, a distinction needs to be made between authentication, authorization, and directories. For a real-life analogy of what roles each of these components play, see the sidebar Confusing Authentication, Authorization, and Directories.

Directories contain data describing resources, such as computers, printers, and user accounts that are contained within a particular network. Directories can be as simple as a text file, such as the /etc/passwd and /etc/group files on traditional Unix systems, which list the active user accounts and their group permissions. Or a directory can be a complex LDAP directory structure, such as Microsoft’s Active Directory.

Directories can contain authentication data. Authenticating “against” a directory takes two forms: a client machine can contact a directory, obtain the hashed version of the user’s password, hash the password given by the user, and compare the two. This method is used by NIS, for example. The other form, employed by most LDAP authentication mechanisms, is to attempt to bind to the LDAP directory using the credentials that the user provided. If the user is granted access to the directory, the authentication is successful. The ...