diff --git a/tests/kdc/check-referral.in b/tests/kdc/check-referral.in
index f718ee6e2..642790b8d 100644
--- a/tests/kdc/check-referral.in
+++ b/tests/kdc/check-referral.in
@@ -44,7 +44,9 @@ testfailed="echo test failed; cat messages.log; exit 1"
 ../db/have-db || exit 77
 
 R=TEST.H5L.SE
-R2=TEST2.H5L.SE
+R2=SUB.TEST.H5L.SE
+
+service=ldap/host.sub.test.h5l.se
 
 port=@port@
 
@@ -59,7 +61,6 @@ kgetcred="${TESTS_ENVIRONMENT} ../../kuser/kgetcred -c $cache"
 kdestroy="${TESTS_ENVIRONMENT} ../../kuser/kdestroy -c $cache --no-unlog"
 
 
-
 KRB5_CONFIG="${objdir}/krb5.conf"
 export KRB5_CONFIG
 
@@ -84,6 +85,8 @@ ${kadmin} \
 ${kadmin} add -p foo --use-defaults foo@${R} || exit 1
 ${kadmin} modify --alias=alias1 --alias=alias2 foo@${R} || exit 1
 
+${kadmin} add -p foo --use-defaults  ${service}@${R2} || exit 1
+
 ${kadmin} add -p cross1 --use-defaults krbtgt/${R2}@${R} || exit 1
 ${kadmin} add -p cross2 --use-defaults krbtgt/${R}@${R2} || exit 1
 
@@ -107,15 +110,35 @@ trap "kill ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
 
 ec=0
 
-echo "Getting client alias1 tickets"; > messages.log
-${kinit} --canonicalize \
-	--password-file=${objdir}/foopassword alias1@${R}@${R} || \
+echo "Test AS-REQ"
+
+echo "Getting client (no canon)"; > messages.log
+${kinit} --password-file=${objdir}/foopassword foo@${R} || \
 	{ ec=1 ; eval "${testfailed}"; }
 echo "checking that we go back right principal"
 ${klist} | grep "Principal: foo@${R}" > /dev/null || \
 	{ ec=1 ; eval "${testfailed}"; }
 ${kdestroy}
 
+echo "Getting client client tickets (default realm, enterprisename)"; > messages.log
+${kinit} --canonicalize \
+	--password-file=${objdir}/foopassword foo@${R} || \
+	{ ec=1 ; eval "${testfailed}"; }
+echo "checking that we go back right principal"
+${klist} | grep "Principal: foo@${R}" > /dev/null || \
+	{ ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "Getting client alias1 tickets"; > messages.log
+${kinit} --canonicalize \
+	--password-file=${objdir}/foopassword foo@${R} || \
+	{ ec=1 ; eval "${testfailed}"; }
+echo "checking that we go back right principal"
+${klist} | grep "Principal: foo@${R}" > /dev/null || \
+	{ ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+
 echo "Getting client alias2 tickets"; > messages.log
 ${kinit} --canonicalize \
 	--password-file=${objdir}/foopassword alias2@${R}@${R} || \
@@ -140,6 +163,32 @@ ${kinit} --canonicalize \
 echo "Remove alias"
 ${kadmin} modify --alias= foo@${R} || { ec=1 ; eval "${testfailed}"; }
 
+echo "Test TGS-REQ"
+
+#echo "Getting client for ${service}@${R} (kdc referral)"
+#> messages.log
+#${kinit} --password-file=${objdir}/foopassword foo@${R} || \
+#	{ ec=1 ; eval "${testfailed}"; }
+#${kgetcred} --server ${service}@${R} ||
+#	{ ec=1 ; eval "${testfailed}"; }
+#${klist}
+#echo "checking that we go back right principal"
+#${klist} | grep "${service}@${R2}" > /dev/null || \
+#	{ ec=1 ; eval "${testfailed}"; }
+#${kdestroy}
+#
+#echo "Getting client for ${service}@${R2} (client side guessing)"
+#> messages.log
+#${kinit} --password-file=${objdir}/foopassword foo@${R} || \
+#	{ ec=1 ; eval "${testfailed}"; }
+#${kgetcred} --server ${service}@${R2} ||
+#	{ ec=1 ; eval "${testfailed}"; }
+#${klist}
+#echo "checking that we go back right principal"
+#${klist} | grep "${service}@${R2}" > /dev/null || \
+#	{ ec=1 ; eval "${testfailed}"; }
+#${kdestroy}
+
 
 echo "killing kdc (${kdcpid})"
 kill $kdcpid || exit 1