Does DCE Security interoperate with other Kerberos systems?
Basically, no, or maybe yes, depending on what you want to do. To use authenticated DCE services, you must have credentials from the DCE security service; vanilla Kerberos v5 tickets aren’t sufficient. But then, to use DCE services you must be using DCE RPC, so this is not really a problem. Going the other way, it is expected that a DCE security server can issue tickets that can be used by vanilla Kerberos applications. The Open Group was wary of promising this until the Kerberos v5 specs were published, but now that the Kerberos RFC has been published, Open Group anticipates guaranteeing interoperability sometime “soon”. In a little more detail, the way to think about this is as follows: Kerberos offers 2 services (Authentication Service, Ticket Granting Service) over 1 communication mechanism (UDP port 88). DCE security offers 3 services (AS, TGS, Privilege Service) over 2 communication mechanisms (UDP port 88, RPC). Where Kerberos and DCE security intersect (AS, TGS over UDP port 88
