Where is Kerberos? about auth-boss

[drcolombo]

Kerberos is actually an implementation of token-based (token there is called ticket) authentication made by Microsoft and used only in intranet (or if you establish a VPN connection, so you're in intranet anyway) based on Windows server. It's not supported by many proxy servers, as well as by Java, as it's not described in RFC-2069 for proxy authentication.
Extremely simple explanation of the difference between classic token-based authentication is that in Windows environment the Kerberos ticket is issued not when you are authenticated by a browser but when you're logged in to your Windows account (although can be re-issued by a special request) and it's stored in your Windows, not in a browser.

[pashkinmv]

Kerberos is actually a protocol developed in MIT. Current version is 5.
Almost all OS have it's implementation, not only Windows server, including GSS-API (RFC 2853). Java has implementation of this RFC. Read here, here and here.
Browser delegates OS to request required TGT from TGS and passes it (TGT) to server if required.
The only server needs to support SSO is to send specified headers and decode received TGT. Google existing implementations.

p.s. Kerberos uses principle of token based authentication

if i was you i wanna be me too

[drcolombo]

Yes, you're right, but the topic starter asked about Active Directory, so my comment was exactly about Microsoft implementation.