Definition
Kerberos is a network authentication protocol developed at MIT, named after the three-headed dog of Greek myth. It uses a trusted third party — the Key Distribution Center (KDC) — to issue time-limited tickets that prove a user's identity to network services, without ever transmitting the user's password. The Windows Active Directory authentication scheme is built on Kerberos, which is why it is widespread in enterprise environments.
How It Works
When a user logs in, they obtain a Ticket-Granting Ticket (TGT) from the KDC. To access a specific service, they present the TGT to the KDC and receive a service-specific ticket, which they then present to the service. All tickets are encrypted and time-stamped, so a stolen ticket has limited value. Cross-realm trust extends Kerberos across organizational boundaries, allowing single sign-on into partner networks.
Kerberos and VPNs
Many enterprise VPN gateways integrate with Kerberos through Active Directory or an equivalent identity provider. A user who has authenticated to the corporate network on a managed device can connect to the VPN with a Kerberos ticket rather than a separate password — a smoother experience and a centralized place to manage access. SAML and OAuth/OIDC have largely supplanted Kerberos for cloud-era identity, but Kerberos remains foundational in on-premises Windows environments.