Oops, looks like you've beaten me to it. I suppose I should just put a new krb5.conf in my KfW redistribution rather than waiting for KfW 2.5.1?