When requesting a cross-realm TGT, use the KDC instance of the current TGT (the second data component), not the realm which the TGT came from. http://src.mit.edu/fisheye/changelog/krb5/?cs=25121 Commit By: ghudson Revision: 25121 Changed Files: U trunk/src/lib/krb5/krb/get_creds.c