Hm. If I remember correct, at least parts of the kerberos ticket in the ticket cache are endian dependent. As the principal name seems to be broken to start with, maybe the error is there. Do you have the same problems if you use the FILE: ticket cache type or the kinit and afslog from heimdal to handle tickets and tokens? Harald.