Kerberos cross-realm support

[bossinc]

Kerberos cross-realm is not supported in https://github.com/jcmturner/gokrb5. There is a PR to fix it jcmturner/gokrb5#536, but there hasn't been movement in this repo in 2 years.

[fuixx217]

Need some visibility on this as I just discovered this to be a problem after two days of troubleshooting.

domainA\user1 gets a ticket from domainA
domainA ticket connects to SQL Server on domainB.
The result is KRB_AP_ERR_BADMATCH.

The working scenario, with a single domain, works as expected:
domainA\user1 gets a ticket from domainA
domainA ticket connects to SQL Server on domainA.
The result is a successful connection.

[shueybubbles]

if there's an alternate krb5 implementation to use, please suggest one. krb5 support was a community contribution altogether.

[bossinc]

It doesn't seem like anyone is maintaining a fork of krb5 😞
Would it be realistic for this repo to absorb it?

[shueybubbles]

this repo already has forks of swisscom's always encrypted module and of a named pipe implementation, so maybe a fork of krb5 isn't a big deal. Just be aware that we have a tiny set of folks babysitting this repo currently. Most contributions coming from us now will be Copilot authored.