f73f08eef1
The target (acceptor) name for GSS-API pre-authentication should be the name of the TGS, not the server name in the AS-REQ, as it is the KDC which is being mutually authenticated. If the client is not requesting a TGT, they may differ.