site_name: Kerberos in Active Directory

site_description: Comprehensive guide to Kerberos authentication in Microsoft Windows Active Directory

site_url: https://strongwind.dev/Kerberos/

repo_url: https://github.com/StrongWind1/Kerberos

repo_name: StrongWind1/Kerberos

# Deviation from the shared baseline: this repo keeps its sources in content/

# rather than docs/, so edit_uri points there.

edit_uri: edit/main/content/

copyright: Copyright © 2025 - 2026 StrongWind1

docs_dir: content

theme:

name: material

custom_dir: overrides

font:

text: Inter

code: JetBrains Mono

icon:

repo: fontawesome/brands/github

palette:

# Dark mode (default) - respects system preference

- media: "(prefers-color-scheme: dark)"

scheme: slate

primary: custom

accent: custom

toggle:

icon: material/weather-night

name: Switch to light mode

# Light mode - respects system preference

- media: "(prefers-color-scheme: light)"

scheme: default

primary: custom

accent: custom

toggle:

icon: material/weather-sunny

name: Switch to dark mode

features:

# Navigation

- navigation.instant

- navigation.instant.prefetch

- navigation.instant.progress

- navigation.tracking

- navigation.sections

- navigation.path

- navigation.top

- navigation.indexes

- navigation.footer

# Deviation from the shared baseline: this is a reference site with a

# three-level nav over 50 pages, so top-level sections become tabs rather

# than one very long sidebar, and prune keeps the rendered nav small.

- navigation.tabs

- navigation.tabs.sticky

- navigation.prune

# Table of contents

- toc.follow

# Search

- search.highlight

- search.suggest

- search.share

# Header

- header.autohide

- announce.dismiss

# Content

- content.code.copy

- content.code.annotate

- content.action.edit

- content.action.view

# Project-specific: language selectors on code blocks, and <abbr> tooltips

# driven by the shared abbreviation glossary.

- content.code.select

- content.tooltips

plugins:

- search

# Downloads the Google Fonts requested by theme.font at build time so the

# published site makes no third-party requests.

- privacy

# Project-specific: page footers show real last-modified dates. Requires

# fetch-depth: 0 on the checkout in .github/workflows/docs.yml.

- git-revision-date-localized:

type: date

locale: en

enable_creation_date: true

fallback_to_build_date: false

strict: false

# Emits a legacy `<page>.html` alias beside every directory URL. This site was

# previously built with use_directory_urls disabled, so those URLs are already

# published; the hook keeps them resolving. See the module docstring.

hooks:

- hooks/html_aliases.py

# Corrects markup from Python-Markdown and the theme that the Nu HTML Checker

# rejects (void-element slashes, a few disallowed attributes). See the module

# docstring; CI runs vnu over the built site.

- hooks/html_validity.py

# Corrects the theme's script bundle so Mermaid is loaded from this build rather

# than from the production URL, and so javascripts/layout.js can reach the

# diagrams the theme draws. See the module docstring.

- hooks/mermaid_bundle.py

markdown_extensions:

- admonition

- pymdownx.details

- pymdownx.superfences:

custom_fences:

- name: mermaid

class: mermaid

format: !!python/name:pymdownx.superfences.fence_code_format

- pymdownx.highlight:

# No anchor_linenums: it emits <a name="...">, which is obsolete HTML and

# fails vnu, and no page on this site links to a code line.

line_spans: __span

pygments_lang_class: true

- pymdownx.inlinehilite

- pymdownx.tabbed:

alternate_style: true

- pymdownx.mark

- pymdownx.keys

- tables

- attr_list

- md_in_html

- def_list

- footnotes

- toc:

permalink: true

toc_depth: 3

# Project-specific: typographic substitutions, task lists, and the shared

# abbreviation glossary appended to every page.

- abbr

- pymdownx.smartsymbols

- pymdownx.tasklist:

custom_checkbox: true

- pymdownx.snippets:

base_path:

- .

auto_append:

- includes/abbreviations.md

# Link reference definitions: turns a bare [RFC 4120] or [MS-KILE] on

# any page into a link to the specification.

- includes/references.md

nav:

- Home:

- index.md

- Quick Start Guide: security/quick-start.md

- Protocol:

- protocol/index.md

- Active Directory: protocol/active-directory.md

- Principals & Realms: protocol/principals.md

- Protocol Overview: protocol/overview.md

- AS Exchange: protocol/as-exchange.md

- TGS Exchange: protocol/tgs-exchange.md

- AP Exchange: protocol/ap-exchange.md

- Ticket Structure: protocol/tickets.md

- Pre-Authentication: protocol/preauth.md

- Encryption Types: protocol/encryption.md

- S4U Extensions: protocol/s4u.md

- Cross-Realm Auth: protocol/cross-realm.md

- Delegation: protocol/delegation.md

- Security:

- security/index.md

- Encryption:

- Encryption Negotiation: security/etype-negotiation.md

- Etype Decision Guide: security/etype-decision-guide.md

- Algorithms & Keys: security/algorithms.md

- Configuration:

- msDS-SupportedEncryptionTypes: security/msds-supported.md

- Registry Settings: security/registry.md

- Registry Audit: security/registry-audit.md

- Group Policy: security/group-policy.md

- Hardening:

- "RC4 Enforcement: Am I Affected?": security/enforcement-triage.md

- RC4 Deprecation: security/rc4-deprecation.md

- Auditing Kerberos Keys: security/account-key-audit.md

- AES Standardization Guide: security/aes-standardization.md

- Mitigations: security/mitigations.md

- Troubleshooting: security/troubleshooting.md

- Encryption Type Calculator: security/etype-calculator.md

- Event Decoder: security/event-decoder.md

- Attacks:

- attacks/index.md

- Tools Setup: attacks/tools.md

- Roasting:

- attacks/roasting/index.md

- Kerberoasting: attacks/roasting/kerberoasting.md

- AS-REP Roasting: attacks/roasting/asrep-roasting.md

- AS-REQ Roasting: attacks/roasting/asreq-roasting.md

- Credential Theft:

- attacks/credential-theft/index.md

- Pass-the-Ticket: attacks/credential-theft/pass-the-ticket.md

- Pass-the-Key: attacks/credential-theft/pass-the-key.md

- Password Spraying: attacks/credential-theft/password-spraying.md

- User Enumeration: attacks/credential-theft/user-enumeration.md

- Ticket Forgery:

- attacks/forgery/index.md

- Golden Ticket: attacks/forgery/golden-ticket.md

- Silver Ticket: attacks/forgery/silver-ticket.md

- Diamond Ticket: attacks/forgery/diamond-ticket.md

- Sapphire Ticket: attacks/forgery/sapphire-ticket.md

- Delegation:

- attacks/delegation/index.md

- Delegation Attacks: attacks/delegation/delegation-attacks.md

- S4U2Self Abuse: attacks/delegation/s4u2self-abuse.md

- SPN-jacking: attacks/delegation/spn-jacking.md

extra:

status:

new: Recently updated

social:

- icon: fontawesome/brands/github

link: https://github.com/StrongWind1/Kerberos

name: Kerberos in Active Directory on GitHub

generator: false

extra_css:

# theme.css is the site palette; primary and accent are both `custom`,

# so every Material colour variable is defined there.

- stylesheets/theme.css

- stylesheets/extra.css

extra_javascript:

- javascripts/etype-calculator.js

- javascripts/event-decoder.js

# Wide tables and diagrams: break points in long identifiers, column floors,

# keyboard-reachable sideways scrolling, and diagram colour corrections.

- javascripts/layout.js

strict: true

validation:

omitted_files: warn

absolute_links: warn

unrecognized_links: warn

anchors: warn