PAC_CLIENT_INFO principal names do not contain a realm, so parse them with the KRB5_PRINCIPAL_PARSE_NO_REALM flag. Otherwise we'll wind up using the default realm (and then ignoring it) which fails if one isn't configured. https://github.com/krb5/krb5/commit/1261faf0569fc172dafa7c39262d177e3ab38848 Commit By: ghudson Revision: 25050 Changed Files: U trunk/src/lib/krb5/krb/pac.c