The Master Guest List (Active Directory)
Before you even leave your house, your parents go online and register you for the park. They create a profile with your name and a Secret Password. The park’s main computer (the Master Ledger) saves your name and a "scrambled" version of your password. Because USS has many different gates and offices, they "sync" this list to every single computer in the park. This ensures that no matter which entrance you walk toward, the staff there already knows your name and has a copy of your secret handshake.
The Front Gate (The Authentication Service)
When you arrive at the USS entrance, you don't actually tell the staff your password—because if a "bad guy" is standing behind you, they might overhear it. Instead, you use your password to lock a small box with a note inside that says "I’m here!" and hand it to the gatekeeper. The gatekeeper looks up your name on their list, uses their copy of your secret handshake to open the box, and sees your note. Since only you could have locked that box, they know it’s really you. Instead of making you do this for every ride, they slap a high-tech USS Wristband on you. This wristband is special because it’s sealed with a lock that only the park’s staff can open. You can’t open it, and you can't change the name on it.
The Sci-Fi City Kiosk (The Ticket Granting Service)
Now you’re inside the park and you want to ride Transformers. You don't go back to the front gate; you just walk up to a small Ticket Kiosk near the ride. You show them your USS Wristband. The staff at the kiosk uses their special key to unlock the wristband, sees that the Front Gate already verified you, and hands you a specific Transformers Ride Pass. This pass is also inside a sealed envelope, but this one is locked with a key that only the Transformers Ride Operator has. You are basically a messenger carrying a secret note that you can't even read yourself!
The Ride Entrance (The Application Server)
Finally, you reach the front of the line for Transformers. You hand that sealed envelope to the Ride Operator. They use their specific key to open it, see your name inside, and see a "Today's Date" stamp. Because the envelope was sealed by the Kiosk and hasn't expired yet, they know you are allowed to be there. Sometimes, to be extra safe, the operator will give you a secret nod to prove they are a real USS employee and not a "Cylon" in disguise. They open the gate, and you’re on the ride!
Note that your Password was only used once at the very start of the day. For the rest of your time at USS, you just used your wristband and your ride passes. If you lose a ride pass, it’s no big deal because it expires in a few minutes anyway, and the person who finds it can't use it to change your account settings. Everything is kept safe using these "locked envelopes" that move from the Gate, to the Kiosk, and finally to the Ride!
The Authentication Service (AS) Exchange
When the user finally sits down to log in, the Authentication Service (AS) exchange begins. The user’s computer does not send the password to the Domain Controller; instead, it performs "pre-authentication" by encrypting the current system time using the user's Long-Term Key and sending that encrypted blob to the DC. The DC looks up the user in its database, retrieves the matching key, and attempts to decrypt the timestamp. If the decryption is successful and the time is accurate within a five-minute window, the DC is satisfied that the user is authentic. In response, the DC generates a Logon Session Key for temporary use and a Ticket Granting Ticket (TGT). The TGT is a critical data structure containing the user's identity and group memberships, and it is encrypted using the DC’s own master secret key, known as the krbtgt key. This ensures the user can hold the ticket but cannot modify their own permissions, such as adding themselves to the Domain Admins group, because they do not possess the key required to reseal the ticket.
The Ticket Granting Service (TGS) Exchange
Once the user is authenticated and holds a TGT, they may eventually need to access a specific resource, such as a file share on a separate server. This triggers the Ticket Granting Service (TGS) exchange. The user's computer sends the encrypted TGT back to the Domain Controller along with a request for the specific service. The DC uses its master krbtgt key to open the TGT, verifies the user's current standing, and then creates a Service Ticket specifically for that file server. This Service Ticket is encrypted using the unique secret key of the target server itself. The user receives this encrypted blob and passes it along to the file server during the Application (AP) exchange. Because the file server shares a secret key with the Domain Controller, it can decrypt the ticket locally to see the user's identity and the Session Key provided by the DC.
The Application (AP) Exchange and Mutual Authentication
The final stage occurs when the client presents the Service Ticket to the target resource. Because the file server possesses its own long-term secret key (shared with the DC), it can decrypt the Service Ticket without needing to communicate with the Domain Controller at that moment. Inside the ticket, the server finds the user's identity and a temporary Session Key. To ensure that the server itself is not an impostor, the protocol often employs mutual authentication, where the server encrypts a portion of the client's timestamp using that same Session Key and sends it back. This architecture is considered highly secure because it is entirely stateless for the target server; it simply trusts any ticket it can successfully decrypt with its own key. Security is maintained through short-lived timestamps and session keys which prevent attackers from capturing and replaying old traffic.