University of Murcia University of Murcia University of Murcia University of Murcia This draft defines an alternative to the standard cross-realm operation in Kerberos, to allow users from an organization can obtain a TGT from the KDC of a different one, both belonging to the same AAA-based federation. This proposal makes use of the GSS-API pre- authentication for Kerberos and the GSS-API Mechanism for the Extensible Authentication Protocol to carry out the required functionality.