Kerberos is a network authentication protocol designed to provide strong authentication for client/server applications. It is commonly used in enterprise environments to authenticate users and services over an untrusted network, such as the internet. Kerberos was developed at MIT in the 1980s as part of Project Athena, and it is named after the three-headed dog from Greek mythology.
Key Concepts:
Key Distribution Center (KDC):
- The KDC is the heart of a Kerberos setup, responsible for authenticating users and services.
- It consists of two main parts: the Authentication Server (AS) and the Ticket Granting Server (TGS).
- The AS handles the initial authentication of users, while the TGS issues service tickets for authenticated users to access services.
Tickets:
- Ticket-Granting Ticket (TGT): When a user authenticates with the AS, they receive a TGT, which allows them to request service tickets from the TGS.
- Service Ticket: Once a user has a TGT, they can request a service ticket from the TGS for a specific service. The service ticket is presented to the service to gain access.
Authenticator:
- An authenticator is a piece of encrypted data sent alongside a ticket to verify the user's identity.
Session Keys:
- Kerberos uses session keys for encrypted communication between the client, server, and KDC.
How Kerberos Works:
User Authentication:
- A user starts by logging in and requesting authentication from the AS.
- The AS verifies the user's credentials and, if successful, provides the user with a TGT.
Requesting a Service Ticket:
- When the user wants to access a service, they present their TGT to the TGS and request a service ticket for the desired service.
- If the TGS verifies the TGT, it issues a service ticket to the user.
Accessing a Service:
- The user then presents the service ticket to the desired service.
- The service verifies the ticket and, if valid, grants the user access.
Advantages of Kerberos:
- Strong Authentication: Uses cryptographic techniques for secure authentication.
- Single Sign-On (SSO): Once authenticated, users can access multiple services without re-entering credentials.
- Secure Communication: Communication between components is encrypted using session keys.
Challenges:
- Clock Synchronization: Kerberos relies on time-sensitive tickets, so all parties must have synchronized clocks.
- Complex Configuration: Setting up and maintaining a Kerberos environment can be complex.
Implementing Kerberos Authentication with LoadRunner:
Kerberos authentication provides mutual authentication between users and services over a network. It consists of three key components:
- - Client
- - Key Distribution Center (KDC): Contains both the Authentication Server (AS) and Ticket Granting Server (TGS).
- - Server
Kerberos Authentication Flow:
1. Client Request: The client sends a request with its username to the Authentication Server (AS) for a ticket-granting ticket (TGT).
2. Authentication Server Response: The AS sends back a session key and TGT based on the client’s information.
3. Ticket Granting Server (TGS): The client sends the TGT to the TGS, which creates a service ticket and sends it back to the client.
4. Client and Server Communication: The client uses the service ticket to authenticate with the server and establish a session.
Configuring the Krb5 Configuration File:
The `krb5.ini` configuration file contains detailed information about the Kerberos realm, KDC/AS addresses, keytab file, and default settings like encryption algorithms.
Keytab File: Contains Kerberos principal and encrypted keys derived from the Kerberos password.
Obtain this file from the Kerberos maintenance team or create it yourself.
Configuration Steps:
1. Place krb5.ini: Copy the `krb5.ini` file to the Windows folder (`C:\WINDOWS\` in Windows XP) or specify an environment variable `KRB5_CONFIG` with the file path.
2. Enable Integrated Authentication: In runtime settings, go to Preferences > Options and change "Enable integrated authentication" to "Yes".
3. Set User Credentials: At the start of the script, use the `web_set_user` function to specify login and password strings for web/proxy server authentication.
LoadRunner Runtime Settings:
In run time setting-> preferences-> options, change "Enable integrated authentication" to Yes.
Adjust these configurations as needed based on your specific application and LoadRunner versions.