6 files changed, 18 insertions, 4 deletions
diff --git a/src/lib/krb5/asn.1/krb5_decode.c b/src/lib/krb5/asn.1/krb5_decode.c
index ca0eb9e37..f21ecfc01 100644
--- a/src/lib/krb5/asn.1/krb5_decode.c
+++ b/src/lib/krb5/asn.1/krb5_decode.c
@@ -215,6 +215,7 @@ error_out: \
 #define free_field(rep,f) free((rep)->f)
 #define clear_field(rep,f) (*(rep))->f = 0
 
+#ifndef LEAN_CLIENT
 krb5_error_code decode_krb5_authenticator(const krb5_data *code, krb5_authenticator **rep)
 {
     setup();
@@ -254,6 +255,7 @@ error_out:
     }
     return retval;
 }
+#endif
 
 krb5_error_code
 KRB5_CALLCONV
diff --git a/src/lib/krb5/krb/auth_con.c b/src/lib/krb5/krb/auth_con.c
index ba62d687e..8ac121a6e 100644
--- a/src/lib/krb5/krb/auth_con.c
+++ b/src/lib/krb5/krb/auth_con.c
@@ -243,13 +243,14 @@ krb5_auth_con_getlocalseqnumber(krb5_context context, krb5_auth_context auth_con
     *seqnumber = auth_context->local_seq_number;
     return 0;
 }
-
+#ifndef LEAN_CLIENT
 krb5_error_code KRB5_CALLCONV
 krb5_auth_con_getauthenticator(krb5_context context, krb5_auth_context auth_context, krb5_authenticator **authenticator)
 {
     return (krb5_copy_authenticator(context, auth_context->authentp,
 				    authenticator));
 }
+#endif
 
 krb5_error_code KRB5_CALLCONV
 krb5_auth_con_getremoteseqnumber(krb5_context context, krb5_auth_context auth_context, krb5_int32 *seqnumber)
diff --git a/src/lib/krb5/krb/copy_athctr.c b/src/lib/krb5/krb/copy_athctr.c
index 2694776c2..4d23c8470 100644
--- a/src/lib/krb5/krb/copy_athctr.c
+++ b/src/lib/krb5/krb/copy_athctr.c
@@ -28,7 +28,7 @@
  */
 
 #include "k5-int.h"
-
+#ifndef LEAN_CLIENT
 krb5_error_code KRB5_CALLCONV
 krb5_copy_authenticator(krb5_context context, const krb5_authenticator *authfrom, krb5_authenticator **authto)
 {
@@ -79,3 +79,5 @@ krb5_copy_authenticator(krb5_context context, const krb5_authenticator *authfrom
     *authto = tempto;
     return 0;
 }
+#endif
+
diff --git a/src/lib/krb5/krb/rd_req_dec.c b/src/lib/krb5/krb/rd_req_dec.c
index 3a92107a7..653afa0db 100644
--- a/src/lib/krb5/krb/rd_req_dec.c
+++ b/src/lib/krb5/krb/rd_req_dec.c
@@ -178,10 +178,12 @@ krb5_rd_req_decoded_opt(krb5_context context, krb5_auth_context *auth_context,
     /* XXX this is an evil hack.  check_valid_flag is set iff the call
        is not from inside the kdc.  we can use this to determine which
        key usage to use */
+#ifndef LEAN_CLIENT
     if ((retval = decrypt_authenticator(context, req, 
 					&((*auth_context)->authentp),
 					check_valid_flag)))
 	goto cleanup;
+#endif
     if (!krb5_principal_compare(context, (*auth_context)->authentp->client,
 				req->ticket->enc_part2->client)) {
 	retval = KRB5KRB_AP_ERR_BADMATCH;
@@ -491,6 +493,8 @@ krb5_rd_req_decoded_anyflag(krb5_context context,
 				   0); /* don't check_valid_flag */
   return retval;
 }
+
+#ifndef LEAN_CLIENT
 static krb5_error_code
 decrypt_authenticator(krb5_context context, const krb5_ap_req *request,
 		      krb5_authenticator **authpp, int is_ap_req)
@@ -525,5 +529,5 @@ free(scratch.data);}
     clean_scratch();
     return retval;
 }
-
+#endif
 
diff --git a/src/lib/krb5/krb/ser_actx.c b/src/lib/krb5/krb/ser_actx.c
index 5e4be29c2..347b300f5 100644
--- a/src/lib/krb5/krb/ser_actx.c
+++ b/src/lib/krb5/krb/ser_actx.c
@@ -550,8 +550,10 @@ krb5_ser_auth_context_init(krb5_context kcontext)
 	kret = krb5_ser_authdata_init(kcontext);
     if (!kret)
 	kret = krb5_ser_address_init(kcontext);
+#ifndef LEAN_CLIENT
     if (!kret)
 	kret = krb5_ser_authenticator_init(kcontext);
+#endif
     if (!kret)
 	kret = krb5_ser_checksum_init(kcontext);
     if (!kret)
diff --git a/src/lib/krb5/krb/ser_auth.c b/src/lib/krb5/krb/ser_auth.c
index d76ec500a..6951f92fa 100644
--- a/src/lib/krb5/krb/ser_auth.c
+++ b/src/lib/krb5/krb/ser_auth.c
@@ -28,6 +28,9 @@
 /*
  * ser_auth.c - Serialize krb5_authenticator structure.
  */
+
+#ifndef LEAN_CLIENT
+
 #include "k5-int.h"
 #include "int-proto.h"
 
@@ -335,7 +338,6 @@ krb5_authenticator_internalize(krb5_context kcontext, krb5_pointer *argp, krb5_o
     }
     return(kret);
 }
-
 /*
  * Register the authenticator serializer.
  */
@@ -344,3 +346,4 @@ krb5_ser_authenticator_init(krb5_context kcontext)
 {
     return(krb5_register_serializer(kcontext, &krb5_authenticator_ser_entry));
 }
+#endif