Realm Hierarchy

When configuring multiple realms, you need to decide how to tie the realms together. You can establish a hierarchical relation between the realms that provides automatic paths to the related domains, but requires that all realms in the hierarchical chain are configured properly. The automatic paths can ease the administration burden; however, if there are many levels of domains, you might not want to use the default path because it requires too many transactions.

You can also choose to establish the connection directly. A direct connection is most useful when too many levels exist between two hierarchical domains or when there is no hierarchal relationship. The connection must be defined in /etc/krb5/krb5.conf on all hosts using the connection, so some additional work required. See "Realms" for an introduction and "Configuring Cross-Realm Authentication" for the configuration procedures for multiple realms.