When enterprise names are used we may know that a particular Name belongs to a different realm we know of (for example via trusts).

In that case the DB driver can return a referral to the client to direct it to ask to a different KDC/Realm.

We should use this feature to redirect AD users of a trusted realm trying to authenticate against our KDC as this can reduce the need to set CApaths in client machines and improve interop.