>>> It doesn't seem to be inheriting any appdefaults or libdefaults (It
>>> acquires 10 hour, non-forwardable, non-addressless tickets, despite my
>>> configuration settings), but I know how to fix that if I get motivated
>>> to do so.
>> How? I was assuming that the Kerberos libraries would take care of
>> that for me, but apparently not. (Do they even on MIT, or does one
>> always have to do that manually?)
> Under heimdal, the mechanism is:
> krb5_get_init_creds_opt_set_default_flags (
> krb5_context /*context*/,
> const char */*appname*/,
> krb5_const_realm /*realm*/,
> krb5_get_init_creds_opt */*opt*/);
> It will acquire defaults from the appname's section of [appdefaults],
> the realm's section in [realms] (I think), and the [libdefaults]
> section, in that order.