well, first of all, the kerberos reported the wrong error.. figures.
something is Not Quite Right(tm) with the error reporting.  the actual
error was returned as RD_AP_BAD. (incorrect net address)  it checks to
see if the net addresses are the same.  oddly, one of the addresses
was that of my aliased interface..  how does this happen?  a bug?

well, that was a lot of fun..

later,
chris