- Domain1 - Win Server 2016 DC - PATRICA.COM
Win 7 Client is joined to Domain 1 - viewing shares on the DC work fine. www.thomas.com is added to 'local network' in IE 10
Domain2 - MIT Kerberos KDC - THOMAS.COM
- Apache WWW/Mod_auth_kerb - keytabs for HTTP/www.thomas.com@THOMAS.COM and other relevant forms.
- Unix/Ubuntu client
All on 192.168.0.X - test network.
Two-way transitive trust setup w/same password.
The unix client can make a kerberized connection OK to WWW.
The windows client does not seem to lookup how to find THOMAS.COM. It looks up it's DNS name and does get a 401 Negoatiate back from the WWW server and then tries ntlm. I've tried running "ksetup /addkdc REALM IP" on both the windows client and the win 2016 DC. How does the client figure out www.thomas.com is part of THOMAS.COM?