How Kerberos Tickets Work (Daily Experience)

• A user first gets a ticket from the Kerberos authentication server. A ticket is like a driver's license issued by the DMV

• When attempting to make use of a network service, the user presents the ticket to the service, along with the user’s “authenticator”. The service then examines the ticket and the authenticator to verify the identity of the user. If all checks out, then the user is accepted

• This is like a customer presenting his driver’s license to a supermarket manager when trying to cash a personal check. In this case, the customer’s “authenticator” is the customer’s face with which the supermarket manager can match the photo on the driver’s license

• Note that a ticket can be used many times until it expires