Two kprop bugs:
(1) It uses krb5_get_in_tkt_with_keytab; it should use the
get_init_creds functions. (Okay, this is nitpicking.)
(2) Since it gets no TGT, and instead gets a ticket for the host
service on the slave host, it can't cope with a slave host that's
not in the local realm.
Ken