One work around might be to convince the Heimdal KDC to send the appropriate etype_info2 s2kparams to indicate that the AFS3 salt should be used. If your KDC does this, our code should do the right thing.