Two kprop bugs:
(1) It uses krb5_get_in_tkt_with_keytab; it should use the
    get_init_creds functions.  (Okay, this is nitpicking.)
(2) Since it gets no TGT, and instead gets a ticket for the host
    service on the slave host, it can't cope with a slave host that's
    not in the local realm.
Ken