具有可信 Windows 域的 kerberos

Question

I have 2 Windows domains - DOMAINA and DOMAINB with a 2 way trust between them. An account created in DOMAINA has admin rights to DOMAINB and can access the member servers in DOMAINB with full admin rights.

I have a linux server which uses kerberos to access the servers in DOMAINB using the account from DOMAINA. This works oerfectly well - in the /etc/krb5.conf file I have:

DOMAINA.LOCAL = {
         kdc = dc1.domaina.local
}

DOMAINB.LOCAL = {
         kdc = dc1.domaina.local
}

This works as long as the Domain Controllers in each domain are visible to the Linux server. However - the situation here is that the DC from DOMAINB is NOT accessable (firewalled off) to the linux server. Only the DC from DOMAINA can be reached from the linux server, as can servers in DOMAINB.

Is there any way to configure kerberos so that a ticket can be granted for access to DOMAINB using the account in DOMAINA, but without contacting the DC for DOMAINB??

The DCs from DOMAINA and DOMAINB can contact each other.

Answer 1

No. The admin in Domain A is getting a ticket referral to Domain B, where Domain B issues the service ticket for the application.

If you want Domain A to issue tickets to the application you need to configure the application to accept tickets from domain A.