Hi, How are FAST plugins in the KDC supposed to generate and verify the PA-FX-COOKIE pa-data entry? I ended up adding krb5_pa_data *cookie to preauth_server_edata_proc and preauth_server_verify_proc but I'm not sure that you'd like my patch. Thanks, Linus