Greg notes that we might want to use the default or fallback realm if krb5_sname_to_principal yields the referral realm. I'm at the EAKC this week and will not be able to look into it immediately.