title: How does keytab work exactly?
body: <p>i have some questions on using keytab for Authentication hope the kind people here can enlightend me</p>
  
  <p>Say, i have userA who is going to use a service running at port 1010. First, userA will login to Active Directory to authenticate himself. </p>
  
  <p><img src="https://i.stack.imgur.com/TzXE7.png" alt="enter image description here"></p>
  
  <p>After login, userA will try to connect to the server to use its service 1010.  In order for the server to verify that UserA is who he is, I need to use <code>setspn</code> to register SPN at the Active Directory. eg</p>
  
  <pre><code>setspn -s service1010/mydomain.com serviceaccount1
  </code></pre>
  
  <p>Then need to generate ktab file at Active directory, eg</p>
  
  <pre><code>ktab -a serviceprincal1010/server.domain.com@DOMAIN.COM -k mykeytab.keytab
  </code></pre>
  
  <p>and then bring <code>mykeytab.keytab</code> to the server. </p>
  
  <p>At the server, I would use JAAS with a login config to query the KDC eg</p>
  
  <pre><code>ServicePrincipalLoginContext
  {
    com.sun.security.auth.module.Krb5LoginModule required    
    principal=serviceprincal1010/server.domain.com@DOMAIN.COM 
    doNotPrompt=true useKeyTab=true keyTab=mykeytab.keytab storeKey=true;
  
  };
  </code></pre>
  
  <p>From this point on, I am confused. How does userA get verified (ie, userA is actually who he is? ). </p>