In krb5_get_cred_via_tkt, strip the ok-as-delegate flag from credentials obtained using a foreign TGT, unless the TGT also has ok-as-delegate set. http://src.mit.edu/fisheye/changelog/krb5/?cs=22272 Commit By: ghudson Revision: 22272 Changed Files: U trunk/src/lib/krb5/krb/gc_via_tkt.c