client side password store best practices?

[Greg Hudson]

On Tue, 2011-08-09 at 19:05 -0400, Chris Hecker wrote:
> However, I've hit a snag:  when creating a keytab on the client using 
> the code from ktutil as a reference, how do I know what kvno to use?

If you're only using the keytab with krb5_get_init_creds_keytab, then it
doesn't matter if you get the kvno right.  The client code will use the
keytab entry with the most recent kvno, since the KDC doesn't mention
the kvno during an AS exchange.