>>>>> "Douglas" == Douglas E Engert <deengert at anl.gov> writes: Douglas> If preauth is required, a krb-error SHOULD be sent saying Douglas> which preauths can be used. That's not how Kerberos works. Se section 2 of draft-ietf-krb-wg-preauth-framework-00.txt for a discussion.