When requesting a cross-realm TGT, use the KDC instance of the current TGT (the second data component), not the realm which the TGT came from. https://github.com/krb5/krb5/commit/5c94d680e4e9cbffa763ad69b112385492fd4ebf Commit By: ghudson Revision: 25121 Changed Files: U trunk/src/lib/krb5/krb/get_creds.c