>I've been thinking about this recently, and I think what you want to do >(though there is no clear API for this) is check the enctype of the >long-term key that was actually used in getting the TGT. Good point. Hrm, I guess that's not actually available currently (although there's no reason an API couldn't be added to get that). --Ken