Kerberos Protocol Architecture: TGT Exchange, SPNs & Replay Drift Thresholds

Kerberos relies on a trusted third party—the Key Distribution Center (KDC), hosted on Active Directory Domain Controllers—to negotiate ticket exchanges between clients and target services without transmitting password hashes over the wire.

Security Advantage

Because Service Tickets are encrypted using the target service account's secret key, the application server never needs to communicate directly with the Domain Controller to validate user identity during the KRB_AP_REQ stage.

Kerberos authentication issues usually stem from two specific infrastructure failures: missing/duplicate SPN mappings or time synchronization collapse.

1. Service Principal Name (SPN) Binding

An SPN is a unique identifier associated with a service account or machine account in Active Directory (e.g., HTTP/web.ad.squirrelworks.dev). If an SPN is missing, clients automatically fall back to legacy NTLM authentication. If duplicate SPNs exist across multiple accounts, ticket requests fail outright with decrypt errors.

2. Replay Protection & The 5-Minute Skew Window

To prevent attackers from capturing valid Kerberos tickets off the wire and replaying them later, Kerberos authenticators include a timestamp encrypted with the session key. The NTP Connection: Active Directory enforces a default maximum tolerance of 5 minutes for computer clock synchronization. If a client or target server clock drifts beyond 5 minutes relative to the KDC, ticket requests return error KRB_AP_ERR_SKEW and authentication breaks completely.

Windows Environment (`klist` & `setspn`)

# Display active Kerberos tickets cached in client LSA memory
klist

# Purge local Kerberos ticket cache to force fresh KDC requests
klist purge

# Query registered SPNs for a specific host or service account
setspn -L APP1

# Scan Active Directory domain for duplicate SPNs across accounts
setspn -X

Linux Environment (`kinit` & `klist`)

# Request TGT ticket from Active Directory KDC via SSSD/MIT Kerberos
kinit adminuser@AD.SQUIRRELWORKS.DEV

# Inspect cached Linux Kerberos ticket credentials and expiration times
klist

Because Kerberos enforces strict 5-minute timestamp validation, maintaining reliable NTP synchronization across member servers, domain controllers, and hypervisors is essential. Review our companion pieces covering NTP mechanics and directory synchronization:

• Network Time Protocol (NTP): Stratum Hierarchy & Hypervisor Drift Control
• Phase 3: Deploying Microsoft Entra Connect & Bridging Hybrid Directory Sync