Implementation of Crossrealm Referral Handling in the MIT Kerberos Client

The Windows 2000 Kerberos implementation [1, 2] uses a di erent approach to solve the Kerberos realm resolution problem than has traditionally been used by MIT Kerberos implementations. In this paper, we present the details of the two approaches and compare them. To facilitate more e ective use of the Kerberos ticket cache, we propose a new format for referral data that includes a list of alias names as part of the returned referral information. We include the pseudocode for the algorithm that we have implemented in the MIT Kerberos client that allows a MIT Kerberos client to request and follow referrals from a Windows 2000 Kerberos KDC, thus removing the need for management and administration of DNS to realm mapping les on Kerberos client hosts. We conclude with a discussion of issues that are applicable to any mutual authentication protocol.