I dont know if this is an old topic or not. I would like to replace the mechanism that kerberos uses for locating KDCs. My proposal would be to allow the calling application to do something along these lines krb5_set_locator(); This function sets a callback pointer in the context block And then have krb5_locate_kdc look to see of this function pointer is non null and if so call instead of the standard sequence. Of course I could simply hack this into the code base but would much prefer to have it in the main code line. It seems that this could be useful for many people with non standard kdc discovery processes.