kprop uses krb5_sname_to_principal() to determine its client principal. If the local hostname cannot be mapped to a realm based on the profile's domain_realm section, krb5_sname_to_principal() will (as of 1.6) return a principal with the referral realm (""), which does not work in a client principal. Handle this by substituting the default realm. https://github.com/krb5/krb5/commit/c85548fbd98abfece8148cf4c15ddb6a6c6f34a9 Commit By: ghudson Revision: 24518 Changed Files: U trunk/src/slave/kprop.c