Establishing Trust Between HP's Kerberos Servers and Windows 2000

If you want to establish trust between Kerberos Server KRB.REALM, and Windows 2000, W2K.DOMAIN, you would need to do the following:

Add inter-realm service principals to the Kerberos Server realm. For more information, refer to “Administrator”.
- If the realm is the source realm, the name of the principal is: krbtgt/W2K.DOMAIN@KRB.REALM
- If the realm is the target realm, the name of the principal is: krbtgt/KRB.REALM@W2K.DOMAIN
On the Windows 2000 domain controller, use the Active Directory Domains and Trusts snap-in to create the trust relationship.
- If the domain trusts the Kerberos Server realm, add the realm name to the Domains that this domain trusts' field.
- If the Kerberos Server realm trusts the Windows 2000 domain, add the realm name to the Domains that trust this domain' field. Keep in mind that the passwords in Steps 1 and 2 must be identical.
Update the client configuration files or the DNS configuration with the name of the foreign KDC.
- For the Kerberos Server clients, add the Windows 2000 domain controller domain name and fully qualified domain name to the client's /etc/krb5.conf file, and the host-to-realm name mapping data for each available Windows 2000 service to the client's /etc/krb5.conf file.
- On the Windows 2000 client, invoke the Windows 2000 Ksetup tool as follows:
  Ksetup/addkdc KRB.REALM KRB_KDC_<fqdn>
Reboot the Windows 2000 client system. It is not necessary to reboot the Kerberos Server or Client.

Technical documentation