Simple Kerberos w/TGS

• TGS decrypts the incoming ticket and looks for presence of its ID

• Checks lifetime and authenticates the user

• If user permitted access, sends service granting ticket