Re: Keytab, service and contacts with the KDC/AD

>Since the service ticket contains the session key encrypted with the
>service key, and the service knows its key via the keytab file, the
>service is able to decrypt the ticket, get the session key, decrypt the
>remaining part of the authenticator, and compare the identity encrypted
>with the session key with the identity embedded in the ticket service,
>enabling it to authenticate the client.
>
>All of this without the service contacting the KDC. That is the most
>important point.
>
>Am I right ?

Yes.

--Ken