A PennKey may be a User PennKey, a Service PennKey or a KAdmin PennKey. All PennKeys will be in the same realm, which is
The realm must be typed in capital letters.
For most purposes, an individual will connect to a computer or use a network service in coordination with their User PennKey. An example of a User PennKey is
When a computer offers a service that users may make use of, a Service PennKey on that computer exists which, via Kerberos, ascertains to the user that the machine they've connected to is actually the desired machine. An example of a Service PennKey is
Finally, the KAdmin PennKey type allows the owner to create Service PennKeys and other, more specific KAdmin PennKeys (but note KAdmin PennKeys do not allow creating User PennKeys). An example of a KAdmin PennKey is
allowing the owner to create Service and KAdmin PennKeys for philly.athletics.upenn.edu, a1.philly.athletics.upenn.edu and other domains more specific than athletics.upenn.edu.