When you are configuring multiple realms for cross-realm authentication, you need to decide how to tie the realms together. You can establish a hierarchical relationship among the realms, which provides automatic paths to the related domains. When all realms in the hierarchical chain are configured properly, these automatic paths can ease the administration burden. However, if there are many levels of domains, you might not want to use the automatic path because it requires too many transactions.
You can also choose to establish the trust relationship directly. A direct trust relationship is useful when too many levels exist between two hierarchical realms or when no hierarchal relationship exists. The connection must be defined in the /etc/krb5/krb5.conf file on all hosts that use the connection, so some additional work is required. The direct trust relationship is also referred to as a transitive relationship. For an illustration, see Kerberos Realms. For the configuration procedures, see Configuring Cross-Realm Authentication.