In this lesson, you will learn how to enable users from one Kerberos realm to authenticate and access services located in a completely different, trusted administrative domain.
The Concept of Trust
In a standard Kerberos environment, a client belongs to a "realm" (e.g., EXAMPLE.COM) and authenticates against a Key Distribution Center (KDC) within that realm. However, in enterprise environments, you often have multiple realms that need to collaborate. To allow a user from DEPT-A.EXAMPLE.COM to access a file server in DEPT-B.EXAMPLE.COM, we establish a Cross-Realm Trust.
When a trust is established, the two KDCs exchange a shared secret key. This allows the KDC in the local realm to issue a "referral ticket" to the user, pointing them toward the remote KDC. The remote KDC then validates the user's identity based on the trust relationship and grants access to the requested service.
Configuring the Environment
To facilitate this, you must define the relationship in the /etc/krb5.conf file on your client and server machines. You need to explicitly map the realms so the system knows how to request cross-realm tickets.
[realms]
DEPT-A.EXAMPLE.COM = {
kdc = kdc1.dept-a.example.com
}
DEPT-B.EXAMPLE.COM = {
kdc = kdc2.dept-b.example.com
}
[capaths]
DEPT-A.EXAMPLE.COM = {
DEPT-B.EXAMPLE.COM = .
}
DEPT-B.EXAMPLE.COM = {
DEPT-A.EXAMPLE.COM = .
}
The [capaths] section is crucial; it acts as a map for the Kerberos client. Without this, the client would not know that a direct trust exists, and the authentication request would fail during the ticket-granting process.
Once configured, the user simply runs kinit user@DEPT-A.EXAMPLE.COM. When they attempt to access a service on DEPT-B.EXAMPLE.COM, the Kerberos library automatically handles the transition across the trust boundary without requiring the user to manage two separate sets of credentials or perform additional logins. This creates a seamless "Single Sign-On" experience across disparate administrative boundaries, provided the administrative domains have securely shared their realm keys.
Key Takeaway: Cross-realm authentication relies on establishing a mutual trust between KDCs and defining the traversal path in the [capaths] section of krb5.conf to allow secure, seamless ticket referrals.