Cross Realm MIT <-> Active Directory

[Miguel Sanders]

Hi
I have been through many documents for several times but I just can't
seem to find the problem.
Here is the idea.
Users are defined in Active Directory (domain/realm WINDOWS.COM)
Host and service principals are defined in MIT Kerberos (realm
UNIX.COM).
Now I want the Windows users to be able to login to the Unix machines(
and thus the UNIX.COM realm).
Since users and host/service principals are in separated realms, cross
realm authentication should be set up, right?
So the point is that users XYZ (Windows Domain User) should be able to
logon to the Unix Machines.
1) Does the Windows user XYZ need to be defined in MIT Kerberos? I
presume that this is the case (although set with a random password).
2) Is something wrong with the given krb5.conf ?
[libdefaults]
        default_realm = UNIX.COM
        default_keytab_name = FILE:/etc/krb5/krb5.keytab
        default_tkt_enctypes = des-cbc-md5 des-cbc-crc
        default_tgs_enctypes = des-cbc-md5 des-cbc-crc

[realms]
        UNIX.COM= {
                kdc = server1.unix.com:88
                admin_server = server1.unix.com:749
                default_domain = unix.com
        }

       WINDOWS.COM= {
                kdc = server1.windows.com:88
                admin_server = server1.windows.com:749
                default_domain = unix.com
        }

[domain_realm]
        .windows.com = WINDOWS.COM
        windows.com = WINDOWS.COM
        .unix.com = UNIX.COM
        unix.com = UNIX.COM

[capaths]
        WINDOWS.COM = {
                UNIX.COM = .
        }

        UNIX.COM = {
                WINDOWS.COM = .
        }

3) In kdc.conf I edited the following
master_key_type = des-cbc-md5
supported_enctypes = des-cbc-md5:normal des-cbc-crc:normal

4) In MIT Kerberos I defined krbtgt/WINDOWS.COM at UNIX.COM and
krbtgt/UNIX.COM at WINDOWS.COM principals with password ABC

5) In Active Directory I defined the MIT realm and MIT kerberos master
with ksetup
>ksetup
default realm = windows.com (NT Domain)
UNIX.COM:
        kdc = server1.unix.com
        Realm Flags = 0x0 none
Mapping XYZ at UNIX.COM to XYZ

6) In Active Directory I defined the realm trust (one way, incoming)
with the password ABC
7) In Active Directory Users and Computers I created the name mapping
for user XYZ to XYZ at UNIX.COM (since the mapping set up by ksetup wasn't
visible here, did this just to be sure)

Now why can't user XYZ at UNIX.COM login successfully with his Windows
password?
I am quite desperate on this one. What am I missing?
Any help would be greatly appreciated.

Kind regards

Miguel