How does client browser know which KDC to send request to get ticket?

Question

Hi,

Environment: SharePoint & Kerberos

Can someone explain how does client browser know which KDC to send request to get ticket in step 3 below: 1. The user types in a URL in the Internet Explorer (e. g. http://intranet.domain.local) 2. The client browser constructs the SPN, which contains a name of the host and the service type (SPN: http/intranet.domain.local – Service type: HTTP Name: intranet.domain.local) 3. The client sends a request to the KDC to get a ticket for this SPN

Note that domain.local is not KDC server host name.

Thanks in advance, Frank

Answer 1

The algorithm goes pretty much like this:

1. Fist the request is sent to which domain controller you client is communicating

2. If request fails the client queries DNS for SRV recrord containg _kerberos._udp. DnsDomainName . See http://technet.microsoft.com/en-us/library/cc961719.aspx for details. If your DNS server is Active directory you pretty much will get them for free. If not you would have to set them up yourself.