Currently, the JAAS login module for Kerberos obtains forwardable tickets only if the krb5.conf contains the forwardable flag in the [libdefaults] section.

There are two issues with this: W2K users might not use a krb5.conf file, and Solaris users by default, list the forwardable option in the [appdefaults].kinit section, not [libdefaults].

Same thing with renewable.