On Tue, Mar 20, 2012 at 9:23 PM, Greg Hudson <ghudson at mit.edu> wrote: > krb5_init_creds_get_error and krb5_set_real_time(), but given what I > know about your deployment, it's probably easier to modify get_in_tkt.c > to set the offsets when a preauth-required error is received. Is there any reason that there couldn't be a built-in option to just do that?