don't use krb5_sname_to_principal