Is it possible to authenticate to SPNEGO/Kerberos server in domain A with an account from the same domain (obviously) when the client is connecting from computer in one of the following (quite similar) situations:
- client is authenticated to domain B (different account, no trust between domains) or
- user's computer is currently not authenticated against domain A (local login, e.g. when accessing intranet via VPN)
Of course both these cases can not lead to integrated authentication (as the primary computer authentication is different from what needs to be used in Kerberos). However is it possible with Internet Explorer (or Firefox) to ask for credentials and use Kerberos?
When using Kerberos, a connection to KDC required (as far as I know). Is Windows or browser capable locating KDC for the server's SPN?