Kerberos also allows authentication between clients and servers in different domains, although the process is a bit more complex than what you've seen so far. To authenticate itself to any server application, no matter what domain that server is in, a user must acquire a ticket to that server. But only a KDC in the same domain as the target server can issue that ticket, since only it knows that server's password. If a user wants to authenticate herself to a server in a different domain, then she must request a ticket to that server from a KDC in the foreign domain. And as is always the case, requesting a ticket from a KDC requires presenting a TGT to that server. The fundamental problem is for the user to acquire a TGT to the KDC in the foreign domain. Once she has this, she can request and use a ticket to the target server in the normal way.
For this to be possible, the two domains must have a trust relationship between them. When a trust relationship is created between two Windows 2000 domains, a password is also created that is known only to those two domains. As is described next, this shared password can be used to encrypt a ticket that's passed between the two domains.