Questions[cross-domain](server)

I'm not a Windows person at all, but I understand the basic idea that an Active Directory is LDAP + Kerberos 5 + microsoft special sauce. So, in a situation where I have a windows machine over which I have no control which is in an existing Active Directory Domain, is it possible to have a person on this machine explicitly acquire a Kerberos ticket for a foreign realm and then get resources on the Linux server that I have control over which is in a Kerberos/LDAP realm that I control?

Specifically, suppose I have in my realm a user "[email protected]", and this user logs into a random windows machine in "BAR.COM" which is a microsoft AD realm using username "baz". Now, they want to grab files off a share on my machine quux.myrealm.com via Samba or NFSv4 or access a web page that requires Kerberos auth, and they need to do it as [email protected] instead of [email protected] which is the identity they used to login to windows.

the Linux/Unix/MIT Kerberos way would be to "kinit [email protected]" and then go for it. Is there an equivalent on windows? Is there an equivalent that doesn't require installing anything unusual (ie. MIT Kerberos for Windows).

Cross-realm trust is not an option here, because I doubt the existing AD administrators will put the appropriate TGT entries even for one-way authentication, and besides, I don't have any desire to trust this domain.

I'm using Nginx to serve static files in response to CORS requests using the technique outlined in this question. However, when the file doesn't exist the 404 response does not contain the Access-Control-Allow-Origin: * header and so is block by the browser.

How can I send Access-Control-Allow-Origin: * on 404 responses?

I have a web-page on my domain (ecmazing.com), and I'd like to be able to send AJAX requests to this URL:

http://hacheck.tel.fer.hr/xml.pl

It's a Perl script that is located on a different domain (and it returns an XML response).

The "Same origin policy" doesn't allow for Ajax communication from a web-page on my domain.

Now, I've heard about CORS, and I think that it could solve my issue. If I understand correctly, the admin of the hacheck.tel.fer.hr domain would have to configure the web-server so that Ajax requests from my domain (ecmazing.com) would be permitted.

Could you tell my what actions specifically the admin would have to perform? I'm going to contact him so I'd like to be able to give him the specifics...

CORS spec is here: http://www.w3.org/TR/cors/

Info about CORS is here: http://www.w3.org/wiki/CORS_Enabled

I'm testing an internal web application that pulls content from servers that I'd rather leave 100% alone, and some of them send the "X-Frame-Options" header. While that's the right setting in production, while we're testing, I'd like to strip it out on just our browsers.

Is that possible? Googling turned up nothing.

Does Amazon S3 allow custom headers? Or am I out of luck?

Access-Control-Allow-Origin: *