<html dir="ltr"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css" id="owaParaStyle"></style> </head> <body fpstyle="1" ocsi="0"> <div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;"> <div><span style="font-family: monospace; font-size: 16px;">So how would one handle "out of domain principals" ?</span></div> <div><font face="monospace" size="3">example:</font></div> <div><font face="monospace" size="3"><br> </font></div> <div><font face="monospace" size="3">you have an internal domain: internal.ipa</font></div> <div><font face="monospace" size="3">and an external domain: company.com</font></div> <div><font face="monospace" size="3"><br> </font></div> <div><font face="monospace" size="3">You have a host that is external so it's hostname is host.company.com</font></div> <div><font face="monospace" size="3">You want to kerberize the webserver that runs on that host and access it by</font></div> <div><font face="monospace" size="3">it's "real" fqdn host.company.com.</font></div> <div><font face="monospace" size="3"><br> </font></div> <div>Do you create different principals for the different services then?</div> <div>like host/host.internal.ipa@INTERNAL.IPA</div> <div>and for the webserver http/host.company.com@INTERNAL.IPA</div> <div><br> </div> <div>And make sure there are SRV/TXT records for the INTERAL.IPA in the company.com domain?</div> <div><br> </div> <div><br> </div> </div> </body> </html>