I'm going to implement the krb5_kt_have_content() from Heimdal. Since it adds a new API, I did a quick project page writeup: http://k5wiki.kerberos.org/wiki/Projects/keytab_have_content_API I don't think any feedback is required. The only edge case is that non-iterable keytabs (i.e. the KDB keytab) will always be deemed to have content.