Kerberos Privilege Attribute Certificate (PAC) is the authorization structure included in many Microsoft Kerberos tickets that contains user group and privilege information.
Simple definition
Kerberos Privilege Attribute Certificate (PAC) is the authorization structure included in many Microsoft Kerberos tickets that contains user group and privilege information. It belongs to the Active Directory / Kerberos vocabulary.
What is it used for?
Its main purpose is to provide Windows services with authorization information required after Kerberos authentication.
How does it work?
the KDC builds and signs the PAC from account data; the target service can then use it to build an access token and enforce authorization.
Key points
- Scope: The authorization structure included in many Microsoft Kerberos tickets that contains user group and privilege information.
- Operational goal: Provide Windows services with authorization information required after Kerberos authentication.
- Mechanism: the KDC builds and signs the PAC from account data; the target service can then use it to build an access token and enforce authorization.
Points to watch
PAC validation or signature issues can cause access failures and are also important when investigating certain Kerberos attacks.
In short
Kerberos Privilege Attribute Certificate (PAC) is a Active Directory / Kerberos concept to know when you need to provide Windows services with authorization information required after Kerberos authentication.