Also, historically it's the responsibility of the Kerberos client library to manage a replay cache. I don't believe Heimdal has one, though. -- Luke -- Luke Howard | PADL Software Pty Ltd | www.padl.com