I think that particular error can appear if the client tries NTLM instead of Kerberos; some versions of mod_auth_kerb do not recognize this and choke on it. -- Richard Silverman res at qoxp.net