Greg notes that we might want to use the default or fallback realm if krb5_sname_to_principal 
yields the referral realm.
I'm at the EAKC this week and will not be able to look into it immediately.