Configure cross-domain support for Kerberos - Configure cross-domain support for Kerberos - Alfresco - Alfresco Content Services - Alfresco/Alfresco-Content-Services/23.4/Alfresco-Content-Services/Administer/Manage-Security/Authentication-and-sync/How-is-Alfresco-Office-Services-related-to-external-authentication/Configure-Kerberos/Configure-cross-domain-support-for-Kerberos - 23.4 - 23.4

Alfresco Content Services
Platform
Alfresco
Product
Alfresco Content Services
Release
23.4
License
ft:lastPublication
2026-09-18T00:52:02.442000
ft:locale
en-US

Use this information to configure Kerberos authentication in a multi-domain environment.

Configuring cross-domain support for Kerberos SSO requires two-way trust between the active domains.

  1. Add realm information for the trusted domain into your krb5.ini file:

    In the [realms] section, where domain2.local is the name of your second trusted domain:

     [realms]
 ...
 DOMAIN2.LOCAL = {
 kdc = ad2.domain2.local:88
 admin_server = ad2.domain2.local:749
 default_domain = domain2.local
 }

    and in the [domain_realm] section:

     [domain_realm]
 ...
 .domain2.local = DOMAIN2.LOCAL
 domain2.local = DOMAIN2.LOCAL
  2. Restart the server. When the server has restarted, check that you can access Alfresco Share from both domains.