Always treat the WELLKNOWN/ANONYMOUS principal as requiring pre-authentication.  The anonymous draft depends on a pre-auth exchange to invoke pkinit.

https://github.com/krb5/krb5/commit/7f6947ecb4c919e7970337e7bfccae053e19b0b4
Commit By: hartmans
Revision: 23603
Changed Files:
U   trunk/src/kdc/do_as_req.c