Windows Native Authentication with 2 AD domains

Question

I have installed 10g infrastructure on win2k server. I completed the steps in note 282074.1 and WNA is working for the first domain (norris.intra). I now want to have this work for a second domain (shoremont.intra). These 2 AD domains are in separate forests (no global catalog server). I have sync'd the second domain with OID and configured external authentication. According to note 190312.1 you can merge kerberos Keytabs. I have setup the following krb5.ini files on the domain control in each domain:
File: krb5.ini on AD server monroe2k.norris.intra
[libdefaults]
default_realm = NORRIS.INTRA
clockskew = 300
[realms]
NORRIS.INTRA= {kdc = monroe2k.norris.intra:88}
SHOREMONT.INTRA= {kdc = swtp_fileserver.shoremont.intra:88}
[domain_realm]
.norris.intra = NORRIS.INTRA
norris.intra = NORRIS.INTRA
.shoremont.intra = SHOREMONT.INTRA
shoremont.intra = SHOREMONT.INTRA
File: krb5.ini on AD server swtp_fileserver.shoremont.intra
[libdefaults]
default_realm = SHOREMONT.INTRA
clockskew = 300
[realms]
SHOREMONT.INTRA= {kdc = swtp_fileserver.shoremont.intra:88}
NORRIS.INTRA= {kdc = monroe2k.norris.intra:88}
[domain_realm]
.shoremont.intra = SHOREMONT.INTRA
shoremont.intra = SHOREMONT.INTRA
.norris.intra = NORRIS.INTRA
norris.intra = NORRIS.INTRA
Are the above entries correct? Once I generate and merge the keytab files I will copy the merged file to the OSS server. Following note 282074.1 what other changes need to be made to the various .xml files to implement this configuration? Thanks.

Answer 1

Does anyone have any ideas on how to do this????