When requesting a cross-realm TGT, use the KDC instance of the current TGT (the second data component), not the realm which the TGT came from. http://mv.ezproxy.com.ezproxyberklee.flo.org/fisheye/changelog/krb5/?cs=25121 Commit By: ghudson Revision: 25121 Changed Files: U trunk/src/lib/krb5/krb/get_creds.c