As Paul suggests, some way of indicating that krb524 is not supported would be helpful, though I think we should consider some means that causes the krb524 code to return an appropriate error indication right away, rather than doing it entirely in kinit.