kc: allow $PRINCIPAL in aliases