Hi,
Do all services running on a server share the same long term key in the
KDC.
What I mean is, lets say on a server that is part of a domain that is
running say a file server and a email server, both of which use the
kerberos protocol... Will a client wishing to communicate with both
services be able to just use the same kerberos ticket?
Thanks
Lyle
Paul Williams [MVP] - 31 Jul 2005 23:57 GMT
> Do all services running on a server share the same long term key in the
> KDC?
The long term key is dependent on the principal's password. Therefore,
which long term key used depends on the principal running the service. Any
services running as local system will use the computer accounts long term
key; any services running as another principal will use that principal's
password as the long term key to establish a session key.
In the case of your example, a new ticket is needed for each SPN. Even
though you and your computer have proved your identity, you still require
tickets for different services as those tickets are for a specific service
and not a generic catch all for a specific system.

Signature
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net