Kerberos SSO with two realms

East Coast, you may already know this, but for the larger audience, your suspicions were correct. Kerberos S4U does in fact require a two-way trust between domains/forests.

 

 

http://support.microsoft.com/?kbid=954739

 

http://msdn.microsoft.com/en-us/magazine/cc188757.aspx

 

 

Thanks to some internal F5 folks for finding these articles. I wasn't sure either.

 

 

That said, I see a potential alternative. Given that you're authenticating the user via form logon, you have the credentials (and I assume the domain) to perform an HTTP Basic or NTLM authentication to the web server.