Kerberos

Alice needs to access many internal services. Her password should stay with the central login system, while each service needs reliable proof of her identity.

Kerberos remains actively used for authentication in Active Directory domains. A ticket is encrypted proof of identity with an expiry time. After Alice signs in, the Key Distribution Center (KDC) gives her computer a ticket-granting ticket (TGT), which it uses to request tickets for individual services. To access a file server, her computer sends a service ticket plus proof that it holds the ticket's session key. The server checks both, then decides which files Alice may access. Her password stays out of these service requests.