https://notes.karlmcguinness.com/tags/kerberos/Recent content in Kerberos on Control Plane by Karl McGuinnessHugoen-uspublic@karlmcguinness.com (Karl McGuinness)public@karlmcguinness.com (Karl McGuinness)Wed, 08 Jul 2026 10:00:00 -0700https://notes.karlmcguinness.com/notes/kerberos-won-because-nobody-had-to-implement-it/Wed, 08 Jul 2026 10:00:00 -0700public@karlmcguinness.com (Karl McGuinness)https://notes.karlmcguinness.com/notes/kerberos-won-because-nobody-had-to-implement-it/The question worth asking about AAuth is not whether the protocol is good. Kerberos won because of everything around the protocol: SSPI and GSS-API hid the mechanism from application developers, the LSA owned keys and ticket lifecycle, machine accounts existed as a side effect of domain join, Active Directory shipped the KDC by default, and SPNEGO made rollout incremental. Mapping that stack onto agents shows where the work is: the MCP client is the most SSPI-shaped thing shipping, SPIFFE and vendor brokers are competing for the custody layer, HTTP authentication challenges are a useful but weaker SPNEGO analog, and nobody ships the authority by default. AAuth has specified the wire and named the platform split. The layers that made Kerberos invisible are still unclaimed.