title: Kerberos authentication using mod_auth_kerb against ActiveDirectory and multiple Realms
body: <p>Our environment looks like this:</p>
  
  <ul>
  <li>we've got a forest of ActiveDirectory servers that trust each other.</li>
  <li>we've got a Linux Apache with mod_auth_kerb that authenticates against the "main" AD server.</li>
  </ul>
  
  <p>For some combinations of clients &amp; domains, we get the following error message:</p>
  
  <pre><code>krb5_get_init_creds_password() failed: KRB5 error code 68
  </code></pre>
  
  <p>Googling says this error:</p>
  
  <pre><code>is being returned by Active Directory because your users are
  attempting to obtain a Kerberos TGT for a realm that
  is not hosted on the server to which they are authenticating.
  </code></pre>
  
  <p>Is there a way to work around this?</p>