The code trying to authenticate to kadmin/whatever_admin_host will force the hostname to lowercase. But when we create such an entry at database creation time, it appears we use whatever case the host (or DNS?) thinks it's name is supposed to be. Ah, yes, in kadm5_create.c: sprintf(service_name, "kadmin/%s", ai->ai_canonname); The name needs to be forced to lowercase. So, depending on the returned canonical name, this can probably cause an incompatibility with SEAM where we thought we were compatible...