Realm Trust is a trust relationship between an Active Directory forest and a non-Windows Kerberos realm.
Simple definition
Realm Trust is a trust relationship between an Active Directory forest and a non-Windows Kerberos realm. It belongs to the Active Directory vocabulary and is useful when reading architecture diagrams, product documentation, logs, or administration procedures.
What is it used for?
Its main purpose is to enable interoperable authentication between AD and an external Kerberos infrastructure. The practical value depends on the surrounding architecture, security model, and operational requirements.
How does it work?
It links the Windows domain to a Kerberos realm and can be one-way or two-way, with appropriate mapping and authorization rules.
Key points
- Scope: A trust relationship between an Active Directory forest and a non-Windows Kerberos realm.
- Operational goal: Enable interoperable authentication between AD and an external Kerberos infrastructure.
- Implementation: It links the Windows domain to a Kerberos realm and can be one-way or two-way, with appropriate mapping and authorization rules.
Points to watch
A trust does not replace ACLs; combine direction, transitivity, SID filtering, and authentication scope with least privilege.
In short
Realm Trust = a trust relationship between an Active Directory forest and a non-Windows Kerberos realm. Use it when you need to enable interoperable authentication between AD and an external Kerberos infrastructure.