Hi Ben,

   Are you referring to a sample for KerberosToken, or KerberosToken2 for
tcp? If you are referring to KerberosToken2, then there is a good reason
why WSE did not ship with a sample. Well, in order to run a KerberosToken2
sample on soap.tcp, you would
   a) need to map the account that you are running the server executable to
the appropriate machine - this can be done using a tool called setspn.exe
   b) need to be running on a private domain

In order for you to run (a), you need to be domain administrator of your
domain. This is because WSE2 supports only one-shot kerberos. In WSE3, there
is support for user to user kerberos, which means that you don't have to go
through the hassle of running setspn.

   The actual sample for KerberosToken2 is exactly the same in tcp as it
looks like in ASMX, with the additional steps highlighted above. For
KerberosToken, the sample should
run by default out of the box with no needed changes. The only caveat is
that this behavior changes in Win2K3 SP1 where even this scenario stops
working.

   Please let me know if you have any more questions.

Thanks,

Sidd [MSFT]