Kerberos Transitive Trust Examined

Suppose Alice has logged on to north.eu108.corp108.com with her user account, and she wants to access a resource on a server in east.na108.corp108.com. The following steps walk you through the Kerberos authentication process in a tree that contains five domains:

If you use Windows 2000's (Win2K's) software development kit (SDK) Klist utility to look at the ticket cache on Alice's machine, you'll find one TGT for each domain, one ticket for Alice's machine (part of the north domain), and one ticket for the resource server.

You can shorten this referral process by creating an explicit trust relationship (i.e., a shortcut trust) between the north and east domains. In this case, Alice will go through the following steps to access the resource located in the east domain:

If you look at the ticket cache on Alice's machine after this process, you'll find only four tickets: one TGT for the north domain, one TGT for the east domain, one ticket for Alice's machine, and one ticket for the resource server. A shortcut trust reduces the interdomain authentication traffic and the number of Kerberos tickets issued.