1.3 Overview
The PAC is a structure that conveys authorization-related information provided by domain controllers (DCs). The PAC is used by authentication protocols that verify identities to transport authorization information, which controls access to resources. Once authentication has been accomplished, the next task is to decide if a particular request is authorized. Management of network systems often models broad authorization decisions through groups; for example, all engineers who can access a specific printer or all sales personnel who can access a certain web server. Making group information consistently available to several services allows for simpler management.
The Kerberos protocol is one of the most commonly used authentication mechanisms. However, the Kerberos protocol [RFC4120] does not provide authorization; "kerberized" applications are expected to manage their own authorization, typically through names. Specifically, the Kerberos protocol does not define any explicit group membership or logon policy information to be carried in the Kerberos tickets. It leaves that for Kerberos extensions to provide a mechanism to convey authorization information by encapsulating this information within an AuthorizationData structure ([RFC4120] section 5.2.6). The PAC was created to provide this authorization data for Kerberos Protocol Extensions [MS-KILE].
[MS-KILE] requires that the PAC information be encoded within an AuthorizationData element ([RFC4120] section 5.2.6) which consists of group memberships, additional credential information, profile and policy information, and supporting security metadata. [MS-KILE] also requires that the PAC information be enclosed in an AD-IF-RELEVANT AuthorizationData element, since this information is noncritical authorization data. This clearly indicates to the receiver that this data can be ignored if the receiver does consume the information in the PAC.
Examples of information that can be provided by a DC include:
Authorization data such as security identifiers (SIDs) and relative identifiers (RIDs).
User profile information such as a home directory or logon script.
Password credentials, used during smart card authentication, for password based authentication protocols to use at a later time.
Service for User (S4U) protocol [MS-SFU] data.