I got it working! It was the encryption keys that where at fault!! Starting kadmin with '-e des-cbc-crc:normal' and then recreated the principal solved the problem. Wee, nice one folks. Thanx for all the help I got about this. Tried again, this time with all the principals having +require_preauth. Still work. Now I'm happy!