-Thee are three parts of a Kerberos name: a ''principal'', an optional ''instance'', and a ''realm''. The principal is typically your username (for Kerberos identities belonging to a user), and the realm, at MIT, is usually ATHENA.MIT.EDU. (Other realms you may see are CSAIL.MIT.EDU, ZONE.MIT.EDU, CS.CMU.EDU, etc.) For the Kerberos identity you typically regard as your own, the one that you use to log in to Athena with your regular password, the instance is null (empty). However, you can ask for additional instances, usually a "root" or "extra" instance. You can use them in places where you wouldn't want to use your regular Athena password. You usually write a non-null instance as, e.g., joeuser/root@ATHENA.MIT.EDU.
+= Root and Extra Instances =
+
+This page explains why you want a ''root instance'' `joeuser/root@ATHENA.MIT.EDU` and an ''extra instance'' `joeuser/extra@ATHENA.MIT.EDU`, how to get them, and how to use them well.
+
+=== Background ===
+
+There are three parts of a Kerberos name: a ''principal'', an optional ''instance'', and a ''realm''. The principal is typically your username (for Kerberos identities belonging to a user), and the realm, at MIT, is usually ATHENA.MIT.EDU. (Other realms you may see are CSAIL.MIT.EDU, ZONE.MIT.EDU, CS.CMU.EDU, etc.) For the Kerberos identity you typically regard as your own, the one that you use to log in to Athena with your regular password, the instance is null (empty). However, you can ask for additional instances, usually a "root" or "extra" instance. You can use them in places where you wouldn't want to use your regular Athena password. You usually write a non-null instance as, e.g., joeuser/root@ATHENA.MIT.EDU.