Kerberos White Paper

Glossary
Following is a list of terms used throughout this document:
Name Definition
Authentication Verification of the claimed identity of a principal.
Authenticator A record containing information that can be shown to have
been recently generated using the session key known only by
the client and server.
Authorization The process of determining whether a client can use a
service, which objects the client is allowed to access, and the
type of access allowed for each.
Client A process that makes use of a network service on behalf of a
user. Note that in some cases, a server can itself be a client
of some other server (e.g., a print server can be a client of a
file server).
Credentials A TGT plus the session key sent by the AS in response to an
authentication request. This is stored in the user’s credential
cache, thus eliminating the need to re-key passwords multiple
times during a session.
KDC Key Distribution Center, a network service that supplies
tickets and temporary session keys; or an instance of that
service or the host on which it runs. The KDC services both
initial ticket and ticket-granting ticket requests. The initial
ticket portion is sometimes referred to as the Authentication
Server (or service). The ticket-granting ticket portion is
sometimes referred to as the ticket-granting server (or
service).
Kerberos A network authentication protocol. It is designed to provide
strong authentication for client/server applications by using
secret-key cryptography. A free implementation of this
protocol is available from the
Massachusetts Institute of
Technology.
LDAP Lightweight Directory Access Protocol (LDAP), an Internet
protocol that email programs use to look up contact
information from a server. LDAP was designed at the
University of Michigan to adapt a complex enterprise
directory system (called X.500) to the modern Internet. X.500
is too complex to support on desktops and over the Internet,
so LDAP was created to provide this service. LDAP has
broader applications, such as looking up services and
devices on the Internet and intranets.