Any SASL profile has to include a service name, which means a principal name with a host name in the second component for both Kerberos v5 (via GSSAPI) or Kerberos v4. From the IANA registry for SASL/GSSAPI service names, this also includes acap, beep, and mupdate, which don't appear on your list. Ken