Configuring for Multi-realm Enterprises

Number of Realms per Database

A single Primary Security Server can support more than one realm. If you have a centralized administration group that controls the security needs for your enterprise, you can support all realms in one primary server.Alternatively, if you have decentralized administration groups, you may need to support a single realm per Primary Server. This arrangement has different configuration requirements.

If you are only supporting one realm per Primary Server, you configure the server normally, and then create the required trust relationships, as described in “Configuring Direct Trust Relationships”. If you are supporting more than one realm per Primary Server, there are additional configuration tasks that you must perform.

Primary Servers That Support Multiple Realms

If you choose to support more than one realm in a Primary Server's database, then you must decide if all the Secondary Servers will support multiple realms. Alternatively, you can have different branches of Secondary Servers, one branch for each realm supported in the principal database.

Propagation can be configured to propagate only selected realms to a Secondary Server. This enables you to maximize the benefits of creating multiple security boundaries in your enterprise. In the event that a authentication server in one branch is compromised, database information about other branches are still secure.

Multiple Primary Servers That Support A Single Realm

You must have one Primary Server for each realm, if you have a de-centralized administrative groups where each group maintains its own realm information.

You cannot propagate changes from one Primary Server to another. You can only propagate changes from a Primary Server to a Secondary Server. Therefore, when you have multiple Primary Servers supporting only a single database, you are not required to change your propagation configuration from the single realm scheme.

Adding More Realms to a Multi-realm Database

Before you can begin adding realms to a database, you must have the basic infrastructure completed. This means you must:

In the following section, we assume that you have not yet configured propagation before you start adding realms.

To add realms to the database, you can authenticate from a client using the administrative principal account and run the Remote Administrator, kadmin_ui, or you can log on to the Primary Security Server and run the Local Administrator, kadminl_ui.

Once you are running Administrator, add additional realms using the Realms tab. For more information on creating realms, refer to“Realms Tab”.

Once all realms are added to the database, you must decide on the Secondary Servers that will support the multiple realms.

Database Propagation for Multi-realm Databases

If you plan to support more than one realm in a single principal database on a Primary Security Server and you plan to propagate only selected realms to certain Secondary Security Servers, you must perform additional steps when you configure propagation.

You can follow the standard propagation configuration if you have configured a multi-realm environment that has only one realm for every Primary Security Server. In other words, you have multiple Primary Security Servers or if you want to propagate all realms from the Primary Server to each Secondary Server, follow the steps mentioned below.

In the following steps, we assume you are familiar with the propagation setup procedure. Refer to, “Propagation Hierarchy”, for details.