Simple Kerberos w/TGS

• Client requests access to service on behalf of the user

• Sends user’s ID and service granting ticket

• This can happen repeatedly without prompting for password