At IU, what Kerberos realms are in use?

There is currently only one Kerberos realm at Indiana University, ADS.IU.EDU. This domain is provided by Indiana University's Active Directory services on Windows Server operating systems. Any Kerberos-authenticated service can reside in this realm.

Restricting access to services by campus

Kerberos should be used only for authentication, not authorization. To allow only users from a particular campus to access a service, for example, you can't rely on Kerberos alone. In other words, you can use the ADS.IU.EDU Kerberos realm to determine whether users are who they say they are, but use some other service to determine what those users are allowed to access, such as an Active Directory security group.

For more, see In Microsoft Active Directory, what are security and distribution groups?

Comments/Questions/Corrections