Everybody going to the next video in the chorus module and this video and we got talking about the authentication
server.
Now the authentication server just handles the authentication side of things before the ticket is actually
generated for the web service.
Now it's important understand the authentication server does not generate that ticket.
It generates a sub ticket that is that you could use to talk with the TGT or ticket generating server
or the TGA.
Now when a client first sends a request such as when it tries to log in the machine will send a plain
text request for a TGT or ticket generating ticket.
This is going to have your name the name of the service you're trying to access or the workstation the
local IP address that you're coming from and then the lifetime of the ticket.
So each ticket has a set lifetime for itself whether it's short or long.
There's always a lifetime.
And this needs to be consistent.
When do the hold generating process.
Now what the authentication server does now that you've sent this plaintext request is it will check
the local database to see if your user is present.
If there are no issues such as you're not being found or anything like that it generates a session key.
Now this key will be used to communicate with other KDE services in a more secure matter.
Now when it responds it responds with two messages.
The first message is encrypted with the TGA S's or the ticket generating server secret key.
This is something you don't have the key to decrypt it so you won't know what's in it from a client's
perspective.
But what is actually in it is your name.
The TGA name in the KDE or cobras realm.
The timestamp your IP the lifetime that you suggested and then the TGA session key which was generated
right here at the bottom.
So it's important to understand that this happens.
Now the second message is encrypted with your client key.
Now we're going over the client key in a second but this is something you can grab ahold of and what
you're supposed to be keeping track of which is the TGA s name the timestamp lifetime and then the session
key that the authentication server had created.
Now a little behind the scenes your client key is created by prompting the user for the password or
if you're logging in you have the password already it's already been submitted.
So what it does is it depends the user name at whatever the realm Cobra's realm name is in most cases
that's the domain name to the password and then it encrypts it.
Now this is what the client's secret key is.
Now you'll be able to use this key that's local to your machine to decrypt the second message here to
get the Jesus name the lives time the timestamp and the GST the TGA key is what's the important bit
here.
As for going into the next step of this now again you won't be able to decrypt that first message but
once you're done with this process you've finished with the authentication server and now you're going
to be talking to the TGA as her ticket generating server or ticket granting server with the TGA as a
session key that was provided to you by the authentication or.