kadm5_init_with_creds_ctx using the wrong server principal

I have code which, simplified, looks like this:

    code = krb5_init_context(&ctx);
    code = krb5_set_default_realm(ctx, realm);
    memset(&params, 0, sizeof(params));
    params.realm = (char *) realm;
    params.mask = KADM5_CONFIG_REALM;
    code = kadm5_init_with_creds_ctx(ctx, (char *) user, cc,
                                     (char *) KADM5_ADMIN_SERVICE,
                                     &params, KADM5_STRUCT_VERSION,
                                     KADM5_API_VERSION_2, &handle);
    memset(&ent, 0, sizeof(ent));
    ent.principal = princ;
    ent.pw_expiration = time(NULL) - 1;
    code = kadm5_modify_principal(handle, &ent, mask);

realm is set to "heimdal.stanford.edu".  And yet, when it runs and
attempts to connect to the kadmin server, it tries to obtain
kadmin/[email protected] credentials and fails while trying to get
cross-realm tickets.  This is despite the fact that it correctly chooses
to connect to the configured admin server for the heimdal.stanford.edu
realm.

What am I missing?

Maybe it's significant that (since heimdal.stanford.edu is a test realm)
the domain_realm mapping for the server providing the admin interface for
that realm points to the stanford.edu production realm?

Passing a fully-qualified principal name in as the fourth argument of
kadm5_init_with_creds_ctx works.

-- 
Russ Allbery ([email protected])             <http://www.eyrie.org/~eagle/>