manage access to services

[paul b]

Hello,
I have a question about managing the access to the different services
in Kerberos.

When I have my TGT and I ask the TGS to get access to a specific
service(for ex. kerberized FTP), how does the TGS know if I have the
right to access this server. Is there any database on the TGS that
contains the information which user has access to which service or
does the TGS the TGT in any case and the access rights are managed on
the server offering the service.

My second question is how can I specify which user has access to which
service? Are there commands on the TGS(eventually to add users to a
database managing the rights???) or do I have to specify the user
rights on the server offering the service

Thank u very much in advance

CB