> It sounds > like you want all the IdP traffic going to one realm but the box to have a different default, in which case adding it with that bean and > then stripping it via c14n is the right thing. Vaguest memories: Is there not a capability of having a per-process krb5.ini?