Kerberos: The Definitive Guide

Cross-Realm Referrals

All of the above also ties into the cross-realm referral capability provided by Kerberos referrals. Traditionally, clients are required to track the mapping of DNS domain names to Kerberos realm names as well as the certification and trust relationships between multiple realms. These mappings exist in the domain_realm and capaths stanzas of the MIT and Heimdal krb5.conf configuration file. The client is responsible for determining the realm that each service it requests a ticket for belongs to, and if necessary, requesting all of the required tickets along the certification path between the client and the service the client wishes to reach. In the case that both client and service are located in the same realm, this is a trivial task since the client can ask its KDC directly for tickets for the service. However, when client and service are located in different realms, the client must request cross-realm tickets from all intermediary Kerberos realms between itself and the destination service.

With Kerberos referrals, the client simply asks its local KDC for tickets to all services, regardless of whether the service is in the local realm or in a remote realm. When the KDC receives a ticket request, the KDC checks to see if the service exists in the local realm. If so, it returns a ticket as usual; if it does not find the service, it will instead return a cross-realm ticket to the next realm in the certification path. The client will then use this cross-realm ticket ...