3rd part of kerberos blog