Jerry, >Shouldn't we actually be doing what the admin specified in krb5.conf ? Perhaps. But don't forget that as an acceptor you have no control over what enctype the KDC used when issuing a service ticket to a client, so it's good to be prepared to accept whatever you may be presented with. -- Luke --