diff --git a/kdc/Makefile.am b/kdc/Makefile.am
index 3b283cb03..96ef4f83b 100644
--- a/kdc/Makefile.am
+++ b/kdc/Makefile.am
@@ -12,7 +12,7 @@ sbin_PROGRAMS = kstash
 
 libexec_PROGRAMS = hprop hpropd kdc digest-service
 
-noinst_PROGRAMS = kdc-replay
+noinst_PROGRAMS = kdc-replay kdc-tester
 
 man_MANS = kdc.8 kstash.8 hprop.8 hpropd.8 string2key.8
 
@@ -31,6 +31,10 @@ kdc_SOURCES = connect.c	\
 	announce.c	\
 	main.c
 
+kdc_tester_SOURCES = \
+	config.c	\
+	kdc-tester.c
+
 libkdc_la_SOURCES = 		\
 	kdc-private.h	 	\
 	kdc-protos.h	 	\
@@ -119,6 +123,7 @@ digest_service_LDADD = \
 	$(top_builddir)/lib/ipc/libheim-ipcs.la \
 	$(LDADD) $(LIB_pidfile)
 kdc_replay_LDADD = libkdc.la $(LDADD) $(LIB_pidfile)
+kdc_tester_LDADD = libkdc.la $(LDADD) $(LIB_pidfile)
 
 include_HEADERS = kdc.h kdc-protos.h
 
diff --git a/kdc/config.c b/kdc/config.c
index a437bbd12..485f20be2 100644
--- a/kdc/config.c
+++ b/kdc/config.c
@@ -55,6 +55,21 @@ static int builtin_hdb_flag;
 static int help_flag;
 static int version_flag;
 
+/* Should we enable the HTTP hack? */
+int enable_http = -1;
+
+/* Log over requests to the KDC */
+const char *request_log;
+
+/* A string describing on what ports to listen */
+const char *port_str;
+
+krb5_addresses explicit_addresses;
+
+size_t max_request_udp;
+size_t max_request_tcp;
+
+
 static struct getarg_strings addresses_str;	/* addresses to listen on */
 
 char *runas_string;
@@ -134,15 +149,17 @@ add_one_address (krb5_context context, const char *str, int first)
 }
 
 krb5_kdc_configuration *
-configure(krb5_context context, int argc, char **argv)
+configure(krb5_context context, int argc, char **argv, int *optidx)
 {
     krb5_kdc_configuration *config;
     krb5_error_code ret;
-    int optidx = 0;
+    
     const char *p;
 
-    while(getarg(args, num_args, argc, argv, &optidx))
-	warnx("error at argument `%s'", argv[optidx]);
+    *optidx = 0;
+
+    while(getarg(args, num_args, argc, argv, optidx))
+	warnx("error at argument `%s'", argv[*optidx]);
 
     if(help_flag)
 	usage (0);
@@ -162,12 +179,6 @@ configure(krb5_context context, int argc, char **argv)
 	exit(0);
     }
 
-    argc -= optidx;
-    argv += optidx;
-
-    if (argc != 0)
-	usage(1);
-
     {
 	char **files;
 
diff --git a/kdc/connect.c b/kdc/connect.c
index 8ecf375b8..2d0fe5367 100644
--- a/kdc/connect.c
+++ b/kdc/connect.c
@@ -33,20 +33,6 @@
 
 #include "kdc_locl.h"
 
-/* Should we enable the HTTP hack? */
-int enable_http = -1;
-
-/* Log over requests to the KDC */
-const char *request_log;
-
-/* A string describing on what ports to listen */
-const char *port_str;
-
-krb5_addresses explicit_addresses;
-
-size_t max_request_udp;
-size_t max_request_tcp;
-
 /*
  * a tuple describing on what to listen
  */
diff --git a/kdc/kdc-tester.c b/kdc/kdc-tester.c
new file mode 100644
index 000000000..a3aaf8194
--- /dev/null
+++ b/kdc/kdc-tester.c
@@ -0,0 +1,160 @@
+/*
+ * Copyright (c) 1997-2005 Kungliga Tekniska Högskolan
+ * (Royal Institute of Technology, Stockholm, Sweden).
+ * All rights reserved.
+ *
+ * Portions Copyright (c) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * 3. Neither the name of the Institute nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "kdc_locl.h"
+
+static krb5_kdc_configuration *kdc_config;
+static krb5_context kdc_context;
+
+#if 0
+
+static struct sockaddr_storage sa;
+static krb5_socklen_t salen = sizeof(sa);
+static const char *astr = "0.0.0.0";
+
+static void
+send_to_kdc(krb5_context context)
+{
+    krb5_error_code ret;
+
+    ret = krb5_kdc_process_request(kdc_context, kdc_config,
+				   d.data, d.length,
+				   &r, NULL, astr,
+				   (struct sockaddr *)&sa, 0);
+    if (ret)
+	krb5_err(context, 1, ret, "krb5_kdc_process_request");
+}
+#endif
+
+static void eval_object(heim_object_t);
+
+
+static void
+eval_array(heim_object_t o, void *ptr)
+{
+    eval_object(o);
+}
+
+static void
+eval_object(heim_object_t o)
+{
+    heim_tid_t t = heim_get_tid(o);
+
+    if (t == heim_array_get_type_id()) {
+	heim_array_iterate_f(o, NULL, eval_array);
+    } else if (t == heim_dict_get_type_id()) {
+	const char *op = heim_dict_get_value(o, HSTR("op"));
+
+	heim_assert(op != NULL, "op missing");
+
+	printf("op: %s\n", op);
+
+	if (strcmp(op, "repeat") == 0) {
+	    heim_object_t or = heim_dict_get_value(o, HSTR("value"));
+	    heim_number_t n = heim_dict_get_value(o, HSTR("num"));
+	    int i, num;
+
+	    heim_assert(or != NULL, "value missing");
+	    heim_assert(n != NULL, "num missing");
+
+	    num = heim_number_get_int(n);
+	    heim_assert(num >= 0, "num >= 0");
+
+	    printf("num %d\n", num);
+
+	    for (i = 0; i < num; i++)
+		eval_object(or);
+
+	} else if (strcmp(op, "kinit") == 0) {
+
+	} else {
+	    errx(1, "unsupported ops %s", op);
+	}
+
+    } else
+	errx(1, "unsupported");
+}
+
+
+int
+main(int argc, char **argv)
+{
+    krb5_error_code ret;
+    int optidx = 0;
+
+    setprogname(argv[0]);
+
+    ret = krb5_init_context(&kdc_context);
+    if (ret == KRB5_CONFIG_BADFORMAT)
+	errx (1, "krb5_init_context failed to parse configuration file");
+    else if (ret)
+	errx (1, "krb5_init_context failed: %d", ret);
+
+    ret = krb5_kt_register(kdc_context, &hdb_kt_ops);
+    if (ret)
+	errx (1, "krb5_kt_register(HDB) failed: %d", ret);
+
+    kdc_config = configure(kdc_context, argc, argv, &optidx);
+
+    argc -= optidx;
+    argv += optidx;
+
+    if (argc == 0)
+	errx(1, "missing operations");
+
+
+    void *buf;
+    size_t size;
+    heim_object_t o;
+
+    if (rk_undumpdata(argv[0], &buf, &size))
+	errx(1, "undumpdata: %s", argv[0]);
+
+    o = heim_json_create_with_bytes(buf, size, NULL);
+    free(buf);
+    if (o == NULL)
+	errx(1, "heim_json");
+
+    /*
+     * do the work here
+     */
+
+    eval_object(o);
+
+    heim_release(o);
+
+    krb5_free_context(kdc_context);
+    return 0;
+}
diff --git a/kdc/kdc_locl.h b/kdc/kdc_locl.h
index 9d3c73a32..804eebeaf 100644
--- a/kdc/kdc_locl.h
+++ b/kdc/kdc_locl.h
@@ -120,7 +120,7 @@ void
 loop(krb5_context context, krb5_kdc_configuration *config);
 
 krb5_kdc_configuration *
-configure(krb5_context context, int argc, char **argv);
+configure(krb5_context context, int argc, char **argv, int *optidx);
 
 #ifdef __APPLE__
 void bonjour_announce(krb5_context, krb5_kdc_configuration *);
diff --git a/kdc/main.c b/kdc/main.c
index fc42e9dcd..1edd14219 100644
--- a/kdc/main.c
+++ b/kdc/main.c
@@ -108,6 +108,7 @@ main(int argc, char **argv)
     krb5_error_code ret;
     krb5_context context;
     krb5_kdc_configuration *config;
+    int optidx = 0;
 
     setprogname(argv[0]);
 
@@ -121,7 +122,7 @@ main(int argc, char **argv)
     if (ret)
 	errx (1, "krb5_kt_register(HDB) failed: %d", ret);
 
-    config = configure(context, argc, argv);
+    config = configure(context, argc, argv, &optidx);
 
 #ifdef HAVE_SIGACTION
     {