Dave Botsch wrote: As long as I remember to kinit -f (to get forwardable credentials), You can also do this in krb5.conf: [libdefaults] forwardable = true