KDC Proxy is a proxy that transports Kerberos exchanges with a KDC over HTTPS when direct network access to the domain controller is unavailable.
Simple definition
KDC Proxy is a proxy that transports Kerberos exchanges with a KDC over HTTPS when direct network access to the domain controller is unavailable. It belongs to the Active Directory / Kerberos vocabulary.
What is it used for?
Its main purpose is to enable Kerberos authentication in selected remote or segmented scenarios without directly exposing domain Kerberos ports.
How does it work?
the client encapsulates Kerberos messages in HTTPS to the proxy service, which relays requests to the appropriate KDC and returns the response.
Key points
- Scope: A proxy that transports Kerberos exchanges with a KDC over HTTPS when direct network access to the domain controller is unavailable.
- Operational goal: Enable Kerberos authentication in selected remote or segmented scenarios without directly exposing domain Kerberos ports.
- Mechanism: the client encapsulates Kerberos messages in HTTPS to the proxy service, which relays requests to the appropriate KDC and returns the response.
Points to watch
The proxy does not replace proper Active Directory connectivity, DNS and trust design and must use appropriate certificates and access controls.
In short
KDC Proxy is a Active Directory / Kerberos concept to know when you need to enable Kerberos authentication in selected remote or segmented scenarios without directly exposing domain Kerberos ports.