Seems like it should be outside this ifdef, since it's needed for adding the tl data for supporting -x... #ifdef SECURID #define KRB5_TL_SECURID_STATE 0x0006 #define KRB5_TL_DB_ARGS 0x7fff #endif /* SECURID */ I assume this is why it's defined locally in kadmin.c and kdb5.c, and why kdb5_ldap_realm.c defines SECURID? Chris