Always treat the WELLKNOWN/ANONYMOUS principal as requiring pre-authentication. The anonymous draft depends on a pre-auth exchange to invoke pkinit. http://src.mit.edu/fisheye/changelog/krb5/?cs=23603 Commit By: hartmans Revision: 23603 Changed Files: U trunk/src/kdc/do_as_req.c