Hi.  Looking at the section in the Kerberos admin guide titled
capaths, the documentation looks fairly clear to me.

It does seem a bit complicated though.