Based on feedback, further review of previous work, and some rough implementation work, I've created a project page for client principal selection in 1.10 at: http://k5wiki.kerberos.org/wiki/Projects/Client_principal_selection Comments are welcome.