Kerberos SSO across External trust

Kevin, thank you for your reply!

In our wireshark we have this actions: AS-REQ - client Name - user@EXAMPLE.LOCAL(Server Name - krbtgt/EXAMPLE.LOCAL, Realm - EXAMPLE.LOCAL)

AS-REP - ticket for this user

TGS-REQ - Realm - CONTOSO.LOCAL, Server Name - krbtgt/EXAMPLE.LOCAL

TGS-REP - Realm - CONTOSO.LOCAL, Client name - host/admin.contoso.local, Server Name - krbtgt/EXAMPLE.LOCAL

TGS-REQ - Realm - EXAMPLE.COM, Server Name - host/admin.contoso.local

KRB-ERROR - error_code: KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN (7)

And for other question - Yes, our APM can resolve both domains.