On Wed, Jul 18, 2007 at 05:13:08PM -0400, Sam Hartman via RT wrote: > OUr position is that changing current behavior is inappropriate. > However we'd like to add a new behavior that says "only delegate if > the flag is set on the ticket." I agree with this. But note that it effectively means additional client-side knobs for telnet, ftp, rlogin, rsh, ssh, etcetera, and/or in krb5.conf. Painful. Nico --