No idea if this is the right place for this, hopefully I can get some good answers.

 

Question: Can a client in a un-trusted domain get a Kerberos ticket for another domain and use this to access multiple resourced without having to type username and password in repeatedly? 

 

Scenario:

 

Domain A contains Server B and Server C.  SPN's regsitered for each https/FQDN. Only ports 80 and 443 open to internet.

 

Windows XP Client in Domain X connects to Server B over internet using https/FQDN with Internet Explorer.  Enable Integrated Windows Authentication is checked.  Everything is OK until he/she moves to Server C and is required to end credentials again - this is a major pain for our customer.

 

There is no trust between domain A and domain B and never wi ... Go to the complete details ...

Found interesting? Add this to: