Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I just want to know the difference between NTLM and Kerberos. When to use NTLM and Kerberos and when not to use it? Why do you need to use Kerberos for authenticated feeds? Our admin is asking me why? I just told him because this I need it to be able to access authenticated feeds and I know he's not satisfied with that answer. Can somebody please shed some light on this?

Thanks,
SPNewbie

share|improve this question
    
Thank you guys for your answers, all are very helpful! Now I need to talk with the admin guys ;) –  SPNewbie May 29 '11 at 18:23
add comment

5 Answers

up vote 21 down vote accepted

NTLM is only allow 1-hop solutions because it is transferring user credentials to the first server - in most cases it is IIS on your SharePoint Front End Server. If you want to get some data from a SharePoint server code (WebPart etc) and ask another server for data (it could be external back-end system you want to integrate to), you can't pass user context to that 2nd hop. So only impersonation is the option. Kerberos allow to set up trust between servers so you can pass User context to that back-end server and got security-trimmed (or audience-targeted) data for the User

share|improve this answer
1  
Athough this focuses on SQL server, the essential elements remain true for SharePoint too: blogs.msdn.com/b/sql_protocols/archive/2006/12/02/… –  Andy Burns May 26 '11 at 8:23
1  
very good explanation is here: technet.microsoft.com/en-us/library/ee806870.aspx –  Ivan Padabed Dec 27 '11 at 14:53
add comment

One thing is missing in this discussion that is asked in the question; the difference between NTLM and Kerberos.

NTLM is a properitary AuthN protocol invented by Microsoft whereas Kerberos is a standard protocol.

The big difference is how the two protocols handle the authentication: NTLM uses a three-way handshake between the client and server and Kerberos uses a two-way handshake using a ticket granting service (key distribution center). In Kerberos the client must have access to a domain controller (which issues the tickets) whereas in NTLM the client contacts the server which contacts the domain controller.

The performance benefits, that SPDoctor talks about, are mainly due to the minimized amount of AuthN traffic between servers, client and DCs.

Also Kerberos are considered to be more secure than NTLM.

IMHO, it's worth the initial pain with Kerberos but make sure that you plan for it.

share|improve this answer
add comment

For you, the big reason is that it solves the "double hop" (delegation) problem, as mentioned in another answer. In addition, the Kerberos authentication mechanism starts to become more efficient as user session time increases, and reduces the load on the domain controller. This is because Kerberos is using an authentication ticket and not having to go back to AD with each request. This is more of an issue if the DC is remote from the server. Kerberos is also more secure than the older NTLM protocol.

Your admin is probably not "satisfied" with your answer because he has heard that setting up Kerberos is difficult and doesn't know where to start. It really is not that difficult, although not trivial. The main task is setting up the Service Principal Names in Active Directory, and it has to be done right. Admins often get this wrong and then everyone gets frustrated and this spreads the notion that setting up Kerberos is a pain, which it can be if you don't know what you are doing. Plus you get that scary warning dialog when you try to enable it in Central Administration.

Make sure you read the technet article and double check when your admin sets the SPNs.

share|improve this answer
    
as i understand it this could also be considered a con for low traffic solutions since the ticket is larger in size? So it takes a certain load to take advantage of using Kerb. Another point regarding setup: its a common misconception that you have to "convert to" Kerberos on your entire network, where in fact you can run Kerberos on your SharePoint farm only. Also a good point that you need to train IT to understand Kerberos. –  Anders Rask May 26 '11 at 10:14
1  
It can be slower if your user sessions are brief (a few minutes), but the difference is small either way. I wouldn't avoid Kerberos because of this, or choose it just to get performance (the exception is the slow connection to DC situation where NTLM auth can kill you if you have a lot of traffic). –  SPDoctor May 26 '11 at 10:23
add comment

Here's an example of when you need it and when you don't

  1. User >> SharePoint web page with SSRS report viewer via iFrame. NTLM lets user onto the page. User goes direct to SSRS via the iFrame and uses NTLM to authenticate there. Kerberos not required.
  2. User >> SharePoint web page with SSRS report viewer in Integrated Mode. User goes to SharePoint and SharePoint goes to SSRS directly (i.e. no iFrame). For the User to delegate authority to use SharePoint, you need Kerberos. Without it it's like SharePoint saying "trust me, I'm representing Ted, really, I promise". Kerberos is like having a signed, notarized permission from the user to authenticate to an external system.

Here's a few of my top Kerberos bookmarks. The bottom one links to my list on Delicious

share|improve this answer
    
I think your 3rd link is to all Delicious posts, not just yours. –  Nicolas Raoul Mar 5 '13 at 5:40
add comment

Everything here is correct thus far, but generally which one to use? When I'm setting up SharePoint, Single-Server setups are typically NTLM, Multi-Server setups are typically Kerberos. Usually Multi-Server setups one day will involve third party tools, etc. that wish to setup authentication integrated somewhat with SharePoint and being cognizant of that, I typically start at Kerberos from Day one. Also if I hear mention of any third party tools, that will usually push me into a Kerberos setup.

It's not that hard really...just need to practice SPN Setup and Delegation enough.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.