When trust between two Kerberos environments is established, KDC may allow to issue service tickets to pass through the cross-realm boundary. It would be helpful to have a policy that controls who can request such tickets and towards what trusted link.

FreeIPA uses MS-PAC information to encode details about accounts. This information is validated within the realm. When a principal from the trusted realm A1 attempts to access a service in the trusted realm B1 using cross-realm service ticket to our realm C (issued by A1), the resulting ticket will be denied by the KDC from realm B1 because it would contain SIDs of domain A1 which is not trusted by B1 (it only trusts C).

We need a mechanism that allows administrators to define rules for selective permission of transiting through the cross-realm trusts hold by the specific IPA realm. These rules should be accounting for clients from different realms and handle wildcard definitions.