Two kprop bugs: (1) It uses krb5_get_in_tkt_with_keytab; it should use the get_init_creds functions. (Okay, this is nitpicking.) (2) Since it gets no TGT, and instead gets a ticket for the host service on the slave host, it can't cope with a slave host that's not in the local realm. Ken