HP CIFS Server Administrator's Guide (5900-1282, April 2011)

Kerberos CIFS Authentication Example
Figure 22 Kerberos Authentication Environment
indows 2000/2003 KDC
AS TGS
HP CIFS Server
Resource
1
234
6
5
W
Authenticatee
Authenticator
Windows 2000 or XP Client
The following describes a typical Kerberos logon and share service exchange using Kerberos
authentication in an Windows 2000/2003 domain environment shown in Figure 8-1:
1. The Windows Client sends the principal name and password to the Authentication Server (AS)
when running a user netlogon command.
2. The AS validates the principal and sends credentials to the Windows client, including a Ticket
Granting Ticket (TGT) and associated session key that allows the client to access the Windows
KDC.
3. The Windows client uses the session key and the TGT to request a service ticket for a share
service from Ticket Granting Service (TGS).
4. TGS sends the service ticket and other information to the Windows client.
5. The Windows client sends the service ticket to the HP CIFS Server for a share service.
6. The HP CIFS Server verifies the received information and authorizes the Windows client to
access the server's share.
HP-UX Kerberos Application Co-existence
The HP CIFS Server is capable of updating Kerberos keytab file. The HP CIFS Server can co-exist
with other Kerberos applications such as HP-UX Internet as described in the “Configuring
krb5.keytab” (page 111) section.
Components for Kerberos Configuration
The following is a list of the various components that are necessary to configure HP CIFS Server
for Kerberos authentication:
• HP CIFS Server: Version A.02.01 or later (Based upon Samba 3.0.7 or later)
• HP-UX 11i v2 or HP-UX 11i v3
• HP-UX Kerberos Client
110 Kerberos Support