diff --git a/lib/krb5/get_in_tkt.c b/lib/krb5/get_in_tkt.c
index 78ba7fe1e..6136f4341 100644
--- a/lib/krb5/get_in_tkt.c
+++ b/lib/krb5/get_in_tkt.c
@@ -189,10 +189,10 @@ extract_ticket(krb5_context context,
 
     krb5_timeofday (context, &sec_now);
     if (context->kdc_sec_offset == 0
-	&& krb5_config_get_string (context->cf,
-				   "libdefaults",
-				   "kdc_timesync",
-				   NULL) != NULL) {
+	&& krb5_config_get_bool (context->cf,
+				 "libdefaults",
+				 "kdc_timesync",
+				 NULL)) {
 	context->kdc_sec_offset = rep->part2.authtime - sec_now;
 	krb5_timeofday (context, &sec_now);
     }
diff --git a/lib/krb5/verify_init.c b/lib/krb5/verify_init.c
index 633bd8b64..c02640fc8 100644
--- a/lib/krb5/verify_init.c
+++ b/lib/krb5/verify_init.c
@@ -167,11 +167,10 @@ krb5_verify_init_creds(krb5_context context,
 	const char *p;
 
 	if (options->flags & KRB5_VERIFY_INIT_CREDS_OPT_AP_REQ_NOFAIL
-	    || ((p = krb5_config_get_string (context->cf,
-					     "libdefaults",
-					     "verify_ap_req_nofail",
-					     NULL))
-		&& ison(p))) {
+	    || krb5_config_get_bool (context->cf,
+				     "libdefaults",
+				     "verify_ap_req_nofail",
+				     NULL))
 	    goto cleanup;
 	} else {
 	    ret = 0;