If you decide to go with patching the KDC, the candidate fixes are here: https://github.com/krb5/krb5/pull/129 These changes should get pushed to master within a week or so, and will eventually make their way into 1.12 and probably 1.11 patch releases.