diff --git a/tests/kdc/Makefile.am b/tests/kdc/Makefile.am
index ecf74e5d1..398cb6391 100644
--- a/tests/kdc/Makefile.am
+++ b/tests/kdc/Makefile.am
@@ -2,6 +2,7 @@ include $(top_srcdir)/Makefile.am.common
 
 noinst_DATA = \
 	krb5.conf \
+	krb5-hdb-mitdb.conf.in \
 	krb5-weak.conf \
 	krb5-pkinit.conf \
 	krb5-pkinit-win.conf \
@@ -15,6 +16,7 @@ SCRIPT_TESTS = \
 	check-des \
 	check-digest \
 	check-kadmin \
+	check-hdb-mitdb \
 	check-kdc \
 	check-kdc-weak \
 	check-keys \
@@ -63,6 +65,11 @@ check-des: check-des.in Makefile krb5.conf
 	chmod +x check-des.tmp
 	mv check-des.tmp check-des
 
+check-hdb-mitdb: check-hdb-mitdb.in Makefile krb5-hdb-mitdb.conf
+	$(do_subst) < $(srcdir)/check-hdb-mitdb.in > check-hdb-mitdb.tmp
+	chmod +x check-hdb-mitdb.tmp
+	mv check-hdb-mitdb.tmp check-hdb-mitdb
+
 check-kdc: check-kdc.in Makefile
 	$(do_subst) < $(srcdir)/check-kdc.in > check-kdc.tmp
 	chmod +x check-kdc.tmp
@@ -120,6 +127,13 @@ krb5.conf: krb5.conf.in Makefile
 	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5.conf.in > krb5.conf.tmp
 	mv krb5.conf.tmp krb5.conf
 
+krb5-hdb-mitdb.conf: krb5-hdb-mitdb.conf.in Makefile
+	$(do_subst) \
+	   -e 's,[@]WEAK[@],false,g' \
+	   -e 's,[@]dk[@],,g' \
+	   -e 's,[@]kdc[@],,g' < $(srcdir)/krb5-hdb-mitdb.conf.in > krb5-hdb-mitdb.conf.tmp
+	mv krb5-hdb-mitdb.conf.tmp krb5-hdb-mitdb.conf
+
 krb5-weak.conf: krb5.conf.in Makefile
 	$(do_subst) \
 	   -e 's,[@]WEAK[@],true,g' \
@@ -196,6 +210,7 @@ EXTRA_DIST = \
 	check-digest.in \
 	check-iprop.in \
 	check-kadmin.in \
+	check-hdb-mitdb.in \
 	check-kdc.in \
 	check-kdc-weak.in \
 	check-keys.in \
diff --git a/tests/kdc/check-hdb-mitdb.in b/tests/kdc/check-hdb-mitdb.in
new file mode 100644
index 000000000..57c987be9
--- /dev/null
+++ b/tests/kdc/check-hdb-mitdb.in
@@ -0,0 +1,117 @@
+#!/bin/sh
+#
+# Copyright (c) 2006 - 2007 Kungliga Tekniska Högskolan
+# (Royal Institute of Technology, Stockholm, Sweden). 
+# All rights reserved. 
+#
+# Redistribution and use in source and binary forms, with or without 
+# modification, are permitted provided that the following conditions 
+# are met: 
+#
+# 1. Redistributions of source code must retain the above copyright 
+#    notice, this list of conditions and the following disclaimer. 
+#
+# 2. Redistributions in binary form must reproduce the above copyright 
+#    notice, this list of conditions and the following disclaimer in the 
+#    documentation and/or other materials provided with the distribution. 
+#
+# 3. Neither the name of the Institute nor the names of its contributors 
+#    may be used to endorse or promote products derived from this software 
+#    without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
+# SUCH DAMAGE. 
+
+top_builddir="@top_builddir@"
+env_setup="@env_setup@"
+objdir="@objdir@"
+
+. ${env_setup}
+
+KRB5_CONFIG="${1-${objdir}/krb5-hdb-mitdb.conf}"
+export KRB5_CONFIG
+
+testfailed="echo test failed; cat messages.log; exit 1"
+
+# If there is no ldap support compile in, disable test
+if ${kdc} --builtin-hdb | grep mit-db > /dev/null ; then
+    :
+else
+    echo "no MIT KDB support"
+    exit 77
+fi
+
+# If there is no useful db support compile in, disable test
+${have_db} || exit 77
+
+R=TEST.H5L.SE
+
+port=@port@
+
+kadmin="${kadmin} -l -r $R --config-file=${KRB5_CONFIG}"
+kdc="${kdc} --addresses=localhost -P $port"
+
+server=host/datan.test.h5l.se
+cache="FILE:${objdir}/cache.krb5"
+keytabfile=${objdir}/server.keytab
+keytab="FILE:${keytabfile}"
+
+kinit="${kinit} -c $cache ${afs_no_afslog}"
+klist="${klist} -c $cache"
+kgetcred="${kgetcred} -c $cache"
+kdestroy="${kdestroy} -c $cache ${afs_no_unlog}"
+
+rm -f ${keytabfile}
+rm -f current-db*
+rm -f out-*
+rm -f mkey.file*
+
+> messages.log
+
+echo Database should exist
+
+${kadmin} ext -k ${keytab} ${server}@${R} || exit 1
+
+echo foo > ${objdir}/foopassword
+
+echo Starting kdc
+env MallocStackLogging=1 MallocStackLoggingNoCompact=1 MallocErrorAbort=1 MallocLogFile=${objdir}/malloc-log \
+${kdc} &
+kdcpid=$!
+
+sh ${wait_kdc}
+if [ "$?" != 0 ] ; then
+    kill -9 ${kdcpid}
+    exit 1
+fi
+
+trap "kill -9 ${kdcpid}; echo signal killing kdc; exit 1;" EXIT
+
+ec=0
+
+echo "Getting client initial tickets"; > messages.log
+${kinit} --password-file=${objdir}/foopassword foo@$R || \
+	{ ec=1 ; eval "${testfailed}"; }
+echo "Getting tickets"; > messages.log
+${kgetcred} ${server}@${R} || { ec=1 ; eval "${testfailed}"; }
+echo "Listing tickets"; > messages.log
+${klist} > /dev/null || { ec=1 ; eval "${testfailed}"; }
+${test_ap_req} ${server}@${R} ${keytab} ${cache} || \
+	{ ec=1 ; eval "${testfailed}"; }
+${kdestroy}
+
+echo "killing kdc (${kdcpid})"
+sh ${leaks_kill} kdc $kdcpid || exit 1
+
+trap "" EXIT
+
+exit $ec
diff --git a/tests/kdc/hdb-mitdb b/tests/kdc/hdb-mitdb
new file mode 100644
index 000000000..b667c65a9
Binary files /dev/null and b/tests/kdc/hdb-mitdb differ
diff --git a/tests/kdc/hdb-mitdb.kadm5 b/tests/kdc/hdb-mitdb.kadm5
new file mode 100644
index 000000000..5128b719f
Binary files /dev/null and b/tests/kdc/hdb-mitdb.kadm5 differ
diff --git a/tests/kdc/hdb-mitdb.mkey b/tests/kdc/hdb-mitdb.mkey
new file mode 100644
index 000000000..b2ac1538f
Binary files /dev/null and b/tests/kdc/hdb-mitdb.mkey differ
diff --git a/tests/kdc/krb5-hdb-mitdb.conf.in b/tests/kdc/krb5-hdb-mitdb.conf.in
new file mode 100644
index 000000000..219218322
--- /dev/null
+++ b/tests/kdc/krb5-hdb-mitdb.conf.in
@@ -0,0 +1,59 @@
+[libdefaults]
+	default_realm = TEST.H5L.SE TEST2.H5L.SE
+	no-addresses = TRUE
+	allow_weak_crypto = @WEAK@
+
+[appdefaults]
+	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
+	reconnect-min = 2s
+	reconnect-backoff = 2s
+	reconnect-max = 10s
+
+[realms]
+	TEST.H5L.SE = {
+		kdc = localhost:@port@
+		admin_server = localhost:@admport@
+		kpasswd_server = localhost:@pwport@
+	}
+
+[domain_realm]
+	.test.h5l.se = TEST.H5L.SE
+	localhost = TEST.H5L.SE
+	
+[kdc]
+	enable-digest = true
+	allow-anonymous = true
+	digests_allowed = chap-md5,digest-md5,ntlm-v1,ntlm-v1-session,ntlm-v2,ms-chap-v2
+
+	enable-http = true
+
+	enable-pkinit = true
+	pkinit_identity = FILE:@srcdir@/../../lib/hx509/data/kdc.crt,@srcdir@/../../lib/hx509/data/kdc.key
+	pkinit_anchors = FILE:@srcdir@/../../lib/hx509/data/ca.crt
+	pkinit_pool = FILE:@srcdir@/../../lib/hx509/data/sub-ca.crt
+#	pkinit_revoke = CRL:@srcdir@/../../lib/hx509/data/crl1.crl
+	pkinit_mappings_file = @srcdir@/pki-mapping
+	pkinit_allow_proxy_certificate = true
+
+	database = {
+		label = { 
+			dbname = mit-db:@objdir@/hdb-mitdb
+			realm = TEST.H5L.SE
+			mkey_file = @objdir@/hdb-mitdb.mkey
+			acl_file = @srcdir@/heimdal.acl
+			log_file = @objdir@/current@kdc@.log
+		}
+	}
+
+	signal_socket = @objdir@/signal
+	iprop-stats = @objdir@/iprop-stats
+	iprop-acl = @srcdir@/iprop-acl
+
+[logging]
+	kdc = 0-/FILE:@objdir@/messages.log
+	default = 0-/FILE:@objdir@/messages.log
+
+[kadmin]
+	save-password = true
+	@dk@
+