diff --git a/kdc/kerberos4.c b/kdc/kerberos4.c
index bdf846954..65c807b91 100644
--- a/kdc/kerberos4.c
+++ b/kdc/kerberos4.c
@@ -62,12 +62,17 @@ make_err_reply(krb5_context context, krb5_data *reply,
 			   kdc_time, code, msg, reply);
 }
 
+struct valid_princ_ctx {
+    krb5_kdc_configuration *config;
+    unsigned flags;
+};
+
 static krb5_boolean
 valid_princ(krb5_context context,
 	    void *funcctx,
 	    krb5_principal princ)
 {
-    krb5_kdc_configuration *config = funcctx;
+    struct valid_princ_ctx *ctx = funcctx;
     krb5_error_code ret;
     char *s;
     hdb_entry_ex *ent;
@@ -75,14 +80,14 @@ valid_princ(krb5_context context,
     ret = krb5_unparse_name(context, princ, &s);
     if (ret)
 	return FALSE;
-    ret = _kdc_db_fetch(context, config, princ, &ent);
+    ret = _kdc_db_fetch(context, ctx->config, princ, ctx->flags, &ent);
     if (ret) {
-	kdc_log(context, config, 7, "Lookup %s failed: %s", s,
+	kdc_log(context, ctx->config, 7, "Lookup %s failed: %s", s,
 		krb5_get_err_text (context, ret));
 	free(s);
 	return FALSE;
     }
-    kdc_log(context, config, 7, "Lookup %s succeeded", s);
+    kdc_log(context, ctx->config, 7, "Lookup %s succeeded", s);
     free(s);
     _kdc_free_ent(context, ent);
     return TRUE;
@@ -90,18 +95,23 @@ valid_princ(krb5_context context,
 
 krb5_error_code
 _kdc_db_fetch4(krb5_context context,
-	  krb5_kdc_configuration *config,
-	  const char *name, const char *instance, const char *realm,
-	  hdb_entry_ex **ent)
+	       krb5_kdc_configuration *config,
+	       const char *name, const char *instance, const char *realm,
+	       unsigned flags,
+	       hdb_entry_ex **ent)
 {
     krb5_principal p;
     krb5_error_code ret;
+    struct valid_princ_ctx ctx;
+
+    ctx.config = config;
+    ctx.flags = flags;
     
     ret = krb5_425_conv_principal_ext2(context, name, instance, realm, 
-				       valid_princ, config, 0, &p);
+				       valid_princ, &ctx, 0, &p);
     if(ret)
 	return ret;
-    ret = _kdc_db_fetch(context, config, p, ent);
+    ret = _kdc_db_fetch(context, config, p, flags, ent);
     krb5_free_principal(context, p);
     return ret;
 }
@@ -181,7 +191,8 @@ _kdc_do_version4(krb5_context context,
 	kdc_log(context, config, 0, "AS-REQ (krb4) %s from %s for %s",
 		client_name, from, server_name);
 
-	ret = _kdc_db_fetch4(context, config, name, inst, realm, &client);
+	ret = _kdc_db_fetch4(context, config, name, inst, realm, 
+			     HDB_F_GET_CLIENT, &client);
 	if(ret) {
 	    kdc_log(context, config, 0, "Client not found in database: %s: %s",
 		    client_name, krb5_get_err_text(context, ret));
@@ -189,8 +200,8 @@ _kdc_do_version4(krb5_context context,
 			   "principal unknown");
 	    goto out1;
 	}
-	ret = _kdc_db_fetch4(context, config, sname, sinst, 
-			     config->v4_realm, &server);
+	ret = _kdc_db_fetch4(context, config, sname, sinst, config->v4_realm,
+			     HDB_F_GET_SERVER, &server);
 	if(ret){
 	    kdc_log(context, config, 0, "Server not found in database: %s: %s",
 		    server_name, krb5_get_err_text(context, ret));
@@ -360,7 +371,8 @@ _kdc_do_version4(krb5_context context,
 	    goto out2;
 	}
 
-	ret = _kdc_db_fetch(context, config, tgt_princ, &tgt);
+	ret = _kdc_db_fetch(context, config, tgt_princ,
+			    HDB_F_GET_KRBTGT, &tgt);
 	if(ret){
 	    char *s;
 	    s = kdc_log_msg(context, config, 0, "Ticket-granting ticket not "
@@ -455,7 +467,8 @@ _kdc_do_version4(krb5_context context,
 	    goto out2;
 	}
 	
-	ret = _kdc_db_fetch4(context, config, ad.pname, ad.pinst, ad.prealm, &client);
+	ret = _kdc_db_fetch4(context, config, ad.pname, ad.pinst, ad.prealm,
+			     HDB_F_GET_CLIENT, &client);
 	if(ret && ret != HDB_ERR_NOENTRY) {
 	    char *s;
 	    s = kdc_log_msg(context, config, 0,
@@ -475,7 +488,8 @@ _kdc_do_version4(krb5_context context,
 	    goto out2;
 	}
 
-	ret = _kdc_db_fetch4(context, config, sname, sinst, config->v4_realm, &server);
+	ret = _kdc_db_fetch4(context, config, sname, sinst, config->v4_realm,
+			     HDB_F_GET_SERVER, &server);
 	if(ret){
 	    char *s;
 	    s = kdc_log_msg(context, config, 0,