Revision Summary Date Revision History Revision Class Comments 3/2/2007 1.0 New Version 1.0 release 4/3/2007 1.1 Minor Version 1.1 release 5/11/2007 1.2 Minor Version 1.2 release 6/1/2007 1.2.1 Editorial Changed language and formatting in the technical content. 7/3/2007 1.2.2 Editorial Changed language and formatting in the technical content. 8/10/2007 1.2.3 Editorial Changed language and formatting in the technical content. 9/28/2007 1.2.4 Editorial Changed language and formatting in the technical content. 10/23/2007 2.0 Major Converted document to unified format. 1/25/2008 2.1 Minor Clarified the meaning of the technical content. 3/14/2008 2.1.1 Editorial Changed language and formatting in the technical content.
technical content. 7/2/2009 3.0 Updated and revised the technical content. 8/14/2009 3.0.1 Editorial Changed language and formatting in the technical content. 9/25/2009 3.1 Minor Clarified the meaning of the technical content. 11/6/2009 4.0 Updated and revised the technical content. 12/18/2009 5.0 Major Updated and revised the technical content. 1/29/2010 5.1 Minor Clarified the meaning of the technical content. 3/12/2010 5.1.1 Editorial Changed language and formatting in the technical content. 4/23/2010 6.0 Major Updated and revised the technical content. 6/4/2010 6.1 Minor Clarified the meaning of the technical content.
7/16/2010 6.2 Minor Clarified the meaning of the technical content. 8/27/2010 6.2 None No changes to the meaning, language, or formatting of the technical content. 10/8/2010 6.3 Minor Clarified the meaning of the technical content. 11/19/2010 6.3 None No changes to the meaning, language, or formatting of the technical content. 1/7/2011 6.4 Minor Clarified the meaning of the technical content. 2/11/2011 7.0 Major Updated and revised the technical content. 3/25/2011 7.0 None No changes to the meaning, language, or formatting of the technical content. 5/6/2011 7.1 Minor Clarified the meaning of the technical content. 6/17/2011 8.0 Major Updated and revised
the technical content. 9/23/2011 8.0 None No changes to the meaning, language, or formatting of the technical content. 12/16/2011 9.0 Major Updated and revised the technical content. 3/30/2012 10.0 Major Updated and revised the technical content. 7/12/2012 11.0 Major Updated and revised the technical content. 10/25/2012 12.0 Updated and revised the technical content. 1/31/2013 13.0 Major Updated and revised the technical content. 8/8/2013 14.0 Major Updated and revised the technical content. 11/14/2013 14.0 None No changes to the meaning, language, or formatting of the technical content. 2/13/2014 14.0 None No changes to the
meaning, language, or formatting of the technical content. 5/15/2014 14.0 None No changes to the meaning, language, or formatting of the technical content. 6/30/2015 15.0 Major Significantly changed the technical content. 10/16/2015 15.0 None No changes to the meaning, language, or formatting of the technical content. 7/14/2016 15.0 None No changes to the meaning, language, or formatting of the technical content. 6/1/2017 15.0 None No changes to the meaning, language, or formatting of the technical content. 9/15/2017 16.0 Major Significantly changed the technical content.
Protocol Details Service Details This section defines the message processing for an application (see Service 1 in the figure specifying entities involved in protocols, section ) using the Service for User (S4U) extensions<8>. Abstract Data Model None. Timers None. Initialization Before sending a KRB_TGS_REQ message with a extension, the MUST have already authenticated to the and received a . Higher-Layer Triggered Events This section contains the following information: S4U2self Triggered Events A (see Service 1 in the figure specifying entities involved in protocols, section ) uses a KRB_TGS_REQ message with the extension when the service is required to make a local access check for a user. This typically occurs when the user has sent some kind of request to the service through a non-Kerberos protocol. The service uses the S4U2self subprotocol extension to obtain about the user from the . S4U2proxy Triggered Events A uses a KRB_TGS_REQ message with the extension when the service determines that it needs to contact another service on behalf of a user for which it has a . S4U2proxy is used when the request to the second service must use the user's credentials, not the credentials of the first service. The service sends a KRB_TGS_REQ with the S4U2proxy information to obtain a service ticket to another service. Message Processing Events and Sequencing Rules Figure 3: Entities Involved in Service for User (S4U) Protocols The previous figure shows the entities involved in protocols and the communications between them. In the following discussions of processing the S4U messages, it is assumed that Service 1 has started up and has already authenticated itself to its own via the standard KRB_AS_REQ and KRB_AS_REP message exchange (b) (also known as an ). In addition, the user has contacted the and authenticated through some mechanism (a) other than using the KDC. Service 1 authenticates to Service 2 via the
Index A Abstract data model 23 19 14 C 14 35 17 17 D Data - abstract 23 19 E Examples 29 27 27 F 14 G 6 H Higher-layer triggered events 24 service 19 19 19 I 30 30 9 Initialization 23 19 6 K KDC 23 24 23 26 message processing 25 24 sequencing rules 25 24 26 23 L events 26 23 M Message processing KDC 25 24 service 22 22 22 21 21 20 Message processing events service 20 Messages 17 16 15 18 17 15 15 27 N 8 O 10 9 P 16 16 15 15 18 30 30 14
14 31 R 8 9 8 13 S 17 17 S4U2proxy 29 10 S4U2self 27 9 27 Security 30 30 Sequencing rules KDC 25 24 service 22 20 22 22 21 21 20 Service 19 triggered events 19 19 19 19 23 message processing 22 22 22 21 21 20 message processing events 20 19 sequencing 22 20 22 22 21 21 20 23 19 21 20 27 14 9 15 T Timer events 26 23 Timers 23 19 35 15 Triggered events - higher-layer 24 service 19 19 19 U User identification 20 21 V 14 14