Currently, GSSAPI will select a non-default ccache if a realm/domain mapping exists in krb5.conf. However, this doesn't work if the KDC was found via discovery. Does MIT have any thoughts about implying an implicit mapping in this case? Nathaniel