use krb5_principal_is_krbtgt