A MIT KDC policy plugin for cross-realm authorization

This is good... really clear explanation of a subtle Kerberos problem, and a nice example of turning a real enterprise pain point into something upstreamable and reusable.