Anybody know how to use auth_to_local with Redhat's Kerberos?

[Scott Simpson]

"Ken Raeburn" <raeburn at mit.edu> wrote in message 
news:8F3A91F9-179E-4881-9EF5-04EAEC04B7AA at mit.edu...
> The braces aren't for grouping *values*, they're for introducing a
> deeper level in the hierarchy, and the line breaks are significant.
> The "{ DEFAULT }" case doesn't match the syntax for starting a new
> level, so the whole string is taken as a value.  And "DEFAULT" on a
> line by itself isn't specifying a value for a tag; a line giving a
> value has to be of the form "foo = bar".

OK. How do I put two rules in then like

auth_to_local = {
    RULE:[2:$1](^root;.*)s/^.*$/root/
    DEFAULT
}

but without the braces? There is an example with very similar syntax at 
http://web.mit.edu/kerberos/krb5-1.3/krb5-1.3/doc/krb5-admin.html (search 
for auth_to_local). That is why I'm confused about why the braces don't 
work.
    Scott