Also mentioned by Stef Walter on krbdev: http://mailman.mit.edu/pipermail/krbdev/2012-April/010790.html I'm evaluating which solution comes out to be more elegant (adding an ignore-realm flag to krb5_parse_name_flags or preprocessing the in_tkt_service string).