anchor.diff:  <% if ! @capaths.empty? -%>
   
   [capaths]
  -<% @capaths.each_pair do |key, val| -%>
  -  <% val.each_pair do |val1, val2| -%>
  -      <%= key %> = {
  -                <%= val1 %> = <%= val2 %>
  +<% @capaths.each_pair do |client_realm, subtags| -%>
  +        <%= client_realm %> = {
  +<% subtags.each do |subtag| -%>
  +<% subtag.each_pair do |server_realm, intermediate_realm| -%>
  +                <%= server_realm %> = <%= intermediate_realm %>
  +<% end -%>
  +<% end -%>
           }
   <% end -%>
   <% end -%>
  -<% end -%>
  
positive.code: [libdefaults]
  	default_realm = <%= @realm %>
  
  # The following krb5.conf variables are only for MIT Kerberos.
  	krb4_config = /etc/krb.conf
  	krb4_realms = /etc/krb.realms
  	kdc_timesync = 1
  	ccache_type = 4
  	forwardable = <%= @forwardable %>
  	proxiable = <%= @proxiable %>
  	dns_lookup_realm = <%= @dns_lookup_realm %>
  	dns_lookup_kdc = <%= @dns_lookup_kdc %>
  <% if @pkinit_anchors -%>
  	pkinit_anchors = <%= @pkinit_anchors %>
  <% end -%>
  
          # set to true for OpenAFS to work
          allow_weak_crypto = <%= @allow_weak_crypto %>
  
  # The following libdefaults parameters are only for Heimdal Kerberos.
  	fcc-mit-ticketflags = true
  
  [realms]
          <%= @realm %> = {
  
negative.code: <% if ! @extra_realms.empty? -%>
  <% @extra_realms.each_pair do |realm, relations| -%>
  <% if relations -%>
          <%= realm %> = {
  <% relations.each do |relation| -%>
  <% relation.each_pair do |key, val| -%>
                  <%= key %> = <%= val %>
  <% end -%>
  <% end -%>
          }
  <% else -%>
          <%= realm %> = {}
  <% end -%>
  