Which authentication service is based on a time-sensitive, ticket-granting system and provides single sign-on across services?

Which authentication service is based on a time-sensitive, ticket-granting system and provides single sign-on across services?

• A. RADIUS
• B. LDAP
• C. Kerberos
• D. SAML

Answer: (C)

Kerberos is a time-sensitive ticket-granting authentication system that enables single sign-on across services. In this setup, a client first proves its identity to a central Key Distribution Center (the KDC) and receives a ticket-granting ticket (TGT). The TGT is then used to request service-specific tickets for any number of services, so the user can access those services without re-entering credentials. Each ticket has a limited lifetime, and clocks on the client and servers must be synchronized to prevent replay and misuse. This time-based, ticket-driven flow is what makes Kerberos well-suited for SSO across multiple services within a trusted domain. RADIUS is primarily a network access authentication protocol used for remote access and device access; it doesn’t provide the broad, ticket-based single sign-on across diverse services that Kerberos does. LDAP is a directory access protocol used to query and manage user information; while it can participate in authentication, it isn’t a time-based ticketing system for SSO. SAML enables web-based SSO by exchanging assertions between an identity provider and service providers, but it relies on token assertions rather than the time-bound tickets used in Kerberos. For a time-sensitive, ticket-granting approach to SSO, Kerberos is the best fit.

Kerberos is a time-sensitive ticket-granting authentication system that enables single sign-on across services. In this setup, a client first proves its identity to a central Key Distribution Center (the KDC) and receives a ticket-granting ticket (TGT). The TGT is then used to request service-specific tickets for any number of services, so the user can access those services without re-entering credentials. Each ticket has a limited lifetime, and clocks on the client and servers must be synchronized to prevent replay and misuse. This time-based, ticket-driven flow is what makes Kerberos well-suited for SSO across multiple services within a trusted domain.

RADIUS is primarily a network access authentication protocol used for remote access and device access; it doesn’t provide the broad, ticket-based single sign-on across diverse services that Kerberos does. LDAP is a directory access protocol used to query and manage user information; while it can participate in authentication, it isn’t a time-based ticketing system for SSO. SAML enables web-based SSO by exchanging assertions between an identity provider and service providers, but it relies on token assertions rather than the time-bound tickets used in Kerberos. For a time-sensitive, ticket-granting approach to SSO, Kerberos is the best fit.