auth_to_local_names

[grackle]

I want Kerberos principal user1 to be able to log into user account
user2 on a particular host.  I specified

auth_to_local_names {
   user1 = user2
}

in the krb5.conf file on the host.  When I kinit on another machine as
user1 and ssh to the host, I get a password prompt.  When I enter my
password, I am logged in as user1.  If I change the above lines to

auth_to_local_names {
   xxxxx = user2
}

then the host logs me in as user1 without asking for a password.

What am I missing?  Also, I did my best to turn on logging (see my
logging section below), but nothing gets logged when I try to
connect.  I'm completely new to this; what approach could I take to
debugging this myself?

Thanks,
-David

[logging]
   default = SYSLOG:DEBUG:AUTH
   default = SYSLOG:DEBUG:ERR
   default = SYSLOG:DEBUG:DAEMON
   default = SYSLOG:DEBUG:USER
   default = SYSLOG:DEBUG:KERN