Kerberos authentication in Hadoop - Step-by-Step Execution

Concept Flow - Kerberos authentication

User requests access

↓

User sends request to KDC

↓

KDC verifies user credentials

↓

KDC issues Ticket Granting Ticket (TGT)

↓

User sends TGT to Ticket Granting Service (TGS)

↓

TGS issues Service Ticket

↓

User presents Service Ticket to Hadoop service

↓

Service verifies ticket and grants access

↓

Access granted

Kerberos authentication uses tickets issued by a trusted server to prove identity and grant access securely.

Execution Sample

Hadoop

1. User requests access
2. KDC issues TGT
3. User requests service ticket
4. TGS issues service ticket
5. User accesses Hadoop service

This sequence shows how a user obtains tickets and accesses a Hadoop service using Kerberos.

Execution Table

Step	Action	Input	Output	Notes
1	User requests access	User credentials	Request sent to KDC	User starts authentication
2	KDC verifies user	Request with credentials	Ticket Granting Ticket (TGT)	TGT proves user identity
3	User requests service ticket	TGT + service name	Request sent to TGS	User asks for service access
4	TGS issues service ticket	Request with TGT	Service Ticket	Ticket for specific Hadoop service
5	User presents service ticket	Service Ticket	Access granted	Hadoop service verifies ticket
6	End	N/A	Authentication complete	User can now use Hadoop securely

💡 Authentication completes after service ticket is verified and access is granted

Variable Tracker

Variable	Start	After Step 2	After Step 4	Final
User Credentials	Provided	Verified by KDC	Used to request service ticket	Not stored after authentication
TGT	None	Issued by KDC	Presented to TGS	Used to get Service Ticket
Service Ticket	None	None	Issued by TGS	Presented to Hadoop service

Key Moments - 3 Insights

Why does the user need a Ticket Granting Ticket (TGT)?

The TGT proves the user's identity to the Ticket Granting Service (TGS) without sending the password again, as shown in steps 2 and 3 of the execution_table.

What happens if the service ticket is invalid or expired?

The Hadoop service will reject access because it cannot verify the ticket, stopping the process at step 5 in the execution_table.

Why is the password not sent to the Hadoop service directly?

Kerberos uses tickets to avoid sending passwords over the network, improving security, as seen in the flow where tickets are exchanged instead of passwords.

Visual Quiz - 3 Questions

Look at the execution_table, what is the output after step 2?

A Ticket Granting Ticket (TGT)

B Service Ticket

C Access granted

D User credentials

💡 Hint

Check the 'Output' column for step 2 in the execution_table.

At which step does the user present the service ticket to the Hadoop service?

A Step 3

B Step 5

C Step 4

D Step 6

💡 Hint

Look for the action involving Hadoop service in the execution_table.

If the KDC does not verify user credentials, what will happen in the flow?

A User gets service ticket directly

B User receives TGT and continues

C User cannot get TGT and authentication stops

D Hadoop service grants access anyway

💡 Hint

Refer to step 2 where KDC verification is critical.

Concept Snapshot

Kerberos authentication uses a trusted server (KDC) to issue tickets.
User first gets a Ticket Granting Ticket (TGT) after verifying credentials.
TGT is used to request service tickets from the Ticket Granting Service (TGS).
Service tickets allow secure access to Hadoop services without sending passwords.
Tickets prove identity and are time-limited for security.

Full Transcript

Kerberos authentication in Hadoop starts when a user requests access by sending credentials to the Key Distribution Center (KDC). The KDC verifies these credentials and issues a Ticket Granting Ticket (TGT). The user then uses this TGT to request a service ticket from the Ticket Granting Service (TGS). Once the service ticket is issued, the user presents it to the Hadoop service. The service verifies the ticket and grants access if valid. This process avoids sending passwords directly and uses time-limited tickets to secure authentication.