My local computer uses Windows 7 Pro and belongs to realm LR, managed by AD servers. I login to my computer while attached to that realm's network. I can view the TGT with MIT Kerberos for Windows ver. 4.0.1.
I want to access resources on a foreign realm, FR. There is no Kerberos trust between LR and FR, but they allow TCP traffic between one another. I request a TGT for FR with its KDC (Red Hat IdM / FreeIPA) and successfully enter my password when challenged. Again, I can view the TGT with MIT Kerberos for Windows ver. 4.0.1. I can now access resources in FR over SSH without being asked for a password, despite originating from LR.
The problem is when I get the TGT for FR, the TGT for my LR principal disappears. Only the FR TGT is visible in MIT Kerberos. If I lock my computer and then unlock with my password, now the FR TGT is gone, replaced by a new LR TGT.
It seems MIT Kerberos for Windows can only store one TGT at a time. Each TGT completely works for its realm for all intents and purposes. How can I configure MIT Kerberos to let me have two TGTs at once, one for each realm? Is it possible to "compartmentalize" with multiple client instances, each pointing to a different KRB5_CONFIG and local keytab? If I cannot, is there an alternative Windows implementation of client-side Kerberos 5 that will, even when there are no inter-realm trusts?
P.S. - I don't want a trust. Can't get a trust.
UPDATE: I left out some of these details earlier because I thought it might confuse the issue. But based on Brad's answer, it might be warranted. I expect most local software would use the built-in Windows implementation of Kerberos and always use the LR keytab.
However, power users like me use heimdal under Cygwin to SSH into FR. I expect anything going through Cygwin DLLs to use heimdal and never see the LR TGT (which it doesn't, at least not by default). I explicitly kinit and move on.
The tricky part comes in for non-power users I have to support who don't use Cygwin but do use PuTTY. PuTTY does let you specify both the library path and DLL for which GSSAPI implementation to use. For instance, I'm configuring SSH sessions to use MIT Kerberos DLLs instead of built-in Windows DLLs. I was hopeful there was a DLL out there that either never tried to find the LR TGT (like heimdal) or allowed multiple TGTs from multiple realms. It doesn't have to have a GUI window like MIT Kerberos, but it helps.