The behaviors of the simple KDC in test/sun/security/krb5/auto can be configured with either options or policies, and in fact there is no real difference between these two concepts. It's better to use only one set of configurations.

Also, remove two shell tests and use multiple @run inside java tests.