I have reproduced this problem. Can you confirm that: * Things work with your 1.2.1 KDC? * IT doesn't matter what version of your clients you are using? Thanks, --Sam