I've just checked in a patch to the KDC, loosely based on the patch from Denis. (See ticket 5517 in RT.) Briefly tested on Mac OS X and Linux. I don't want to touch the RPC code until we figure out the API problems, so I'll leave this ticket open...