Skip to main content

3.3. The Ticket-Granting Service (TGS) Exchange

Overview​

The TGS exchange is used by clients to obtain service tickets for application servers. The client uses its Ticket-Granting Ticket (TGT) to authenticate to the TGS and request a service ticket.

Message Flow​

  1. KRB_TGS_REQ: Client sends ticket request to TGS
    • Includes TGT
    • Includes authenticator
    • Specifies desired service
  2. KRB_TGS_REP: TGS responds with service ticket
  3. KRB_ERROR: Returned if request cannot be satisfied

Generation of KRB_TGS_REQ Message​

Client constructs request containing:

  • TGT (from previous AS exchange)
  • Authenticator (encrypted with TGT's session key)
  • Service principal name
  • Requested ticket options and flags
  • Requested validity period

Receipt of KRB_TGS_REQ Message​

TGS validates the request:

  1. Decrypts and validates the TGT
  2. Decrypts and validates the authenticator
  3. Checks authorization
  4. Verifies policy constraints
  5. Processes special options (RENEW, VALIDATE, PROXY, FORWARDED, etc.)

Generation of KRB_TGS_REP Message​

If request is valid, TGS issues service ticket:

  • Encrypts ticket in service's long-term key
  • Encrypts reply (containing session key) in TGT's session key
  • Sets appropriate ticket flags
  • Establishes ticket validity period

Receipt of KRB_TGS_REP Message​

Client:

  1. Decrypts reply using TGT's session key
  2. Extracts new service ticket and session key
  3. Can now authenticate to the requested service

Special Processing​

The TGS handles various special cases:

  • Ticket renewal
  • Ticket validation (for postdated tickets)
  • Proxy and forwarded ticket requests
  • Cross-realm referrals
  • User-to-user authentication

Reference​

For complete technical details, refer to RFC 4120 Section 3.3.

Last updated on