Don't treat local krbtgt principal as referral If we look up a principal and in the KDB and get back the local TGS principal, the KDC should treat this as an alias, not a referral, and should therefore issue a ticket for the requested principal rather the canonical name. https://github.com/krb5/krb5/commit/22f00f6b8233fa281e5aad854789bd14abdda91b Author: Greg Hudson Commit: 22f00f6b8233fa281e5aad854789bd14abdda91b Branch: master src/kdc/do_tgs_req.c | 15 +++++++-------- 1 files changed, 7 insertions(+), 8 deletions(-)