Briefly, the client authenticates to AS using a long-term "shared secret" and receives a ticket from the AS. Later the client can use this ticket to get additional tickets for SS using the same shared secret. These tickets can be used to prove authentication to SS.