Alternate realm for a real domain in BIG-IP

Hi,

I don't understand the issue...

when working with kerberos, 2 informations are used:

• sAMAccountName
• REALM

these information are sent with a format like UPN but not UPN:

sAMAccountName@REALM

when working with Kerberos Auth:

• the client requests the web site
• the server requests a kerberos auth
• the client requests to the KDC to get kerberos ticket.
• the client requests the web site including the token
• the server (here the F5) decrypt the token. if decryption successful, user is authenticated. there is no communication to the KDC from the server.