Some ancillary wrinkles:<br />
<br />
* krb5_sname_to_principal() allows :port suffixes (used by MSSQLSvc principals), but the current fallback processing in get_creds.c does not.<br />
<br />
* krb5_get_init_creds_keytab() iterates over the keytab to find the available enctypes so it can put those first in the request, and errors out if it doesn&#39;t find any.&nbsp; This operation does not substitute the default realm for the referral realm like krb5_kt_get_entry() does.<br />
<br />
* krb5_sname_to_principal() looks up the realm (in [domain_realm] or a hostrealm plugin module) of the first expanded hostname candidate.&nbsp; The current fallback processing does not repeat this lookup.&nbsp; If qualify_shortname is &quot;&quot;, the lookup is unlikely to succeed for the local hostname or a short hostname.<br />
&nbsp;