Is there a reason why the kadm5_hook interface does not seem to have any support for a principal "rename" operation? John