anchor.diff:  	(make-kdc-rep :type :as 
   		      :crealm (kdc-req-body-realm body)
   		      :cname (kdc-req-body-cname body)
  -		      :ticket (make-ticket :enc-part (encrypt-data (make-enc-ticket-part)))
  +		      :ticket (make-ticket :realm realm
  +					   :sname (krbtgt-principal realm)
  +					   :enc-part (encrypt-data (make-enc-ticket-part)))
   		      :enc-part (encrypt-data (make-enc-kdc-rep-part)))))))
   
   ;; this is to request a ticket for any principal
  
positive.code: 	(body (kdc-req-req-body req)))
      ;; try and find the principal
      (let ((srv (find-spn (principal-string (kdc-req-body-sname body) (kdc-req-body-realm body))))
  	  (clt (find-spn (principal-string (kdc-req-body-cname body) (kdc-req-body-realm body)))))
        (unless srv (error 'krb-error-t :err (make-krb-error)))
        (unless clt (error 'krb-error-t :err (make-krb-error)))
        (unless (string= (car (principal-name-name (kdc-req-body-sname body))) "krbtgt")
  	(error 'krb-error-t :err (make-krb-error)))
        ;; one of the preauth MUST be a :PA-TIMESTAMP
        (let ((a (find-if (lambda (pa)
  			  (eq (pa-data-type pa) :pa-timestamp))
  			preauth)))
  	(unless a (error 'krb-error-t :err (make-krb-error)))
  	;; validate the timestamp by decrypting it and checking against current time 
  	;; FIXME: validate the timestamp 
  
  
negative.code: 
  
  (in-package #:cerberus)
  
  (defun generate-error (error-code realm &key ctime cusec cname etext edata)
    (make-krb-error :pvno 5
  		  :type 30
  		  :ctime ctime
  		  :cusec cusec
  		  :stime (get-universal-time)
  		  :susec 0
  		  :error-code error-code
  		  :cname cname
  		  :crealm realm
  		  :realm realm
  		  :sname (krbtgt-principal realm)
  		  :etext etext
  		  :edata edata))
  
  ;; this is to request a ticket for the TGS, i.e. krbtgt principal
  (defun generate-as-rep (req)
  