title: Default ports to be open for a kerberos protected web server on different domain from the user
body: <p>A client computer ClientA (with IE) belonging to DomainA, domain controller DCA. </p>
  
  <p>A server computer ServerB (with IIS) belonging to DomainB, domain controller DCB.</p>
  
  <p>Which are the minimum required default ports between machines from the two domains I need to open to allow a user in Client A, to login into a kerberos protected Web Application hosted in IIS on ServerB with its DomainA credentials?</p>
  
  <p>At a minimum ClientA to ServerB TCP 80 :)</p>
  
  <p>When the ClientA makes a request to ServerB:80 it receives a NEGOTIATE Authorize Header. Then ClientA does a SPN request to DCA on port 88. Then I don't know if DCA need to contact DCB or if it is required for DCA and DCB to have been established some kind of configuration (one-way trust?) between them and which ports need to be opened for that.</p>
  
  <p>I guess ClientA doesn't need to contact DCB in any case.</p>
  
  <p>Let's imagine ClientA have received the required service token from DCA. Then it sends its own credentials to ServerB. In order to decrypt the token and figure out if I am who I am, ServerB needs to contact DCB? Or ServerB needs to contact DCA? I guess not. </p>
  
  <p>Be aware that in principle I don't have the requirement to be able to list DomainA users from the ServerB machine. I could manually add users in web.config Authorization section.</p>
  
  <p>It seems to me that the ports listed here <a href="https://support.microsoft.com/en-us/kb/179442" rel="nofollow noreferrer">https://support.microsoft.com/en-us/kb/179442</a>
  is too much for my scenario.</p>
  
  <p>EDIT:
  After reading several info on the subject, it seems ClientA computer need to have TCP 88 (Kerberos) connectivity to DCB. And between DomainA and DomainB a one-way trust should be established previously so a TDO object exists in the two domains, so DCA would be able to generate referals tickets for DCB to consume. It seems there is no need for direct connectivity between DCA and DCB except the one needed to have the TDO objects synchronized.</p>