How am I able to check emails on outlook in my office windows machine without entering password

Question

I have a basic question. At work, I log on to a domain from my work machine using a password. Then, once I am logged-in, I can read mails in outlook without having to enter any password. What I understand:

-- Outlook connects to exchange server (which stores my emails or gathers emails from where they are stored) and gets my emails

-- How is the above authentication done? Since it doesn't again ask me for password, it must use the windows logon authentication here too. One way I know to achieve single sign-on is kerberization. Is kerberization what is coming into picture here or something else and my understanding is missing something?

Thanks,

Addition: Does NTLM something come into picture here somewhere?

Answer 1

Exchange is using the same kind of authentication/authorisation as, for example, file shares.

When you connect with an appropriately configured transport (Named Pipes are the simplest) then your authentication information is carried across. In a domain (required for Exchange) this uses Active Directory's Kerberos derived system that means you password (or a hash of your password) is not sent, but rather a token that AD gives you computer. The Exchange server then checks that token with an AD to verify you identity.

See Kerberos for more information.

(NTLM also provides SSO in a similar way, but it has some security problems and has been replaced by Kerberos in most places.)

Answer 2

Are you sure you didn't enter your password initially when first setting up Outlook? I believe that as standard it just remembers this.

You can (if wanted) get it to ask your password every time via tools > email accounts > add or modify an existing account > change > more settings > security > "always prompt for username and password"

Answer 3

The system is what's known as Single Sign On (Wikipedia artice here).

Exchange is the back end system for outlook in most enterprise environments and it integrates very tightly with the active directory in Windows Server.