I have a web application (hostname: service.domain.com) and I wish to use Kerberos authentication to identify users that are logged into a Windows domain. Microsoft AD (Windows Server 2008 R2) is providing the Kerberos service.
The service is a Java web application using Spring Security Kerberos extension library to implement SPNEGO/Kerberos protocol. I have created a keytab file in AD that contains a shared secret that should be enough to authenticate Kerberos tickets that are sent by the client browsers using the web application.
My question is, is service host (service.domain.com) required to have firewall access (TCP/UDP 88) to KDC (kdc.domain.com) or is the keytab file enough for the service host to be able to decrypt the Kerberos tickets and provide authentication?