use base lib for passwords, simplify refs to parent_domain
kerberos realm is the dnsdomanname