Patent ID: 8516566

Claim:
A method, comprising: receiving, from a principal of a directory service, a request for pre-authentication of the principal for Kerberos, the directory service configured for managing access to resources within a network system and comprising an authentication service; authenticating the principal for the directory service by the authentication service in response to receiving the request; identifying, by the authentication service, a key associated with the authenticated principle, wherein identifying the key comprises generating a random password for the authenticated principal and deriving the key from the random password; providing, by the authentication service, the key to a Kerberos Key Distribution Center (KDC) by storing the key in a data structure in the directory service that is accessible by the KDC; and sending, by the authentication service, the random password to the authenticated principal for use as pre-authentication information in a Kerberos authentication request subsequently sent by the authenticated principal to the KDC.