Is the intent of this routine to, by default, return saying successful verification if a keytab entry cannot be found? I'm confused by the names of the option and variable which says "nofail". But one must set the "nofail" option to get a failure? Thanks for any clarification. K.C.