diff --git a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequestWithTgt.java b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequestWithTgt.java
index 41fb0c1..52c7d03 100644
--- a/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequestWithTgt.java
+++ b/kerby-kerb/kerb-client/src/main/java/org/apache/kerby/kerberos/kerb/client/request/TgsRequestWithTgt.java
@@ -50,6 +50,9 @@
         setAllowedPreauth(PaDataType.TGS_REQ);
         ticket = tgt;
         clientPrincipal = tgt.getClientPrincipal();
+        if (clientPrincipal.getRealm() == null) {
+            clientPrincipal.setRealm(tgt.getRealm());
+        }
     }
 
     public TgsRequestWithTgt(KrbContext context, SgtTicket sgt) {
@@ -57,6 +60,9 @@
         setAllowedPreauth(PaDataType.TGS_REQ);
         ticket = sgt;
         clientPrincipal = sgt.getClientPrincipal();
+        if (clientPrincipal.getRealm() == null) {
+            clientPrincipal.setRealm(sgt.getRealm());
+        }
     }
 
     public PrincipalName getClientPrincipal() {
diff --git a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java
index 168862f..56e8c62 100644
--- a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java
+++ b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/KdcRequest.java
@@ -588,10 +588,14 @@
         return tgsEntry;
     }
 
-    public boolean checkCrossRealm(String remoteRealm) {
-        isCrossRealm = !(kdcContext.getKdcRealm().equals(remoteRealm));
-        this.remoteRealm = remoteRealm;
-        return isCrossRealm;
+    public boolean checkCrossRealm(String remoteRealm) throws KrbException {
+        if (remoteRealm != null && kdcContext.getKdcRealm() != null) {
+            isCrossRealm = !(kdcContext.getKdcRealm().equals(remoteRealm));
+            this.remoteRealm = remoteRealm;
+            return isCrossRealm;
+        } else {
+            throw new KrbException("Missing the realm.");
+        }
     }
 
     public boolean isCrossRealm() {
@@ -647,7 +651,7 @@
                 throw new KrbException(KrbErrorCode.KDC_ERR_CLIENT_REVOKED);
             }
         } else {
-            LOG.info("Client entry is empty.");
+            LOG.info("Client entry is empty, token preauth or cross realm.");
         }
     }
 
diff --git a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java
index 98e1176..e1e3dd2 100644
--- a/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java
+++ b/kerby-kerb/kerb-server/src/main/java/org/apache/kerby/kerberos/kerb/server/request/TgsRequest.java
@@ -186,10 +186,15 @@
 
         PrincipalName serverPrincipal = tgtTicket.getSname();
         serverPrincipal.setRealm(tgtTicket.getRealm());
-        PrincipalName clientPrincipal = authenticator.getCname();
-        clientPrincipal.setRealm(authenticator.getCrealm());
-        KrbIdentity clientEntry = getEntry(clientPrincipal.getName());
-        setClientEntry(clientEntry);
+
+        /* The client principal does not exist in backend when it's a cross realm request */
+        if (authenticator.getCrealm() != null
+            && authenticator.getCrealm().equals(getKdcContext().getKdcRealm())) {
+            PrincipalName clientPrincipal = authenticator.getCname();
+            clientPrincipal.setRealm(authenticator.getCrealm());
+            KrbIdentity clientEntry = getEntry(clientPrincipal.getName());
+            setClientEntry(clientEntry);
+        }
 
         if (!authenticator.getCtime().isInClockSkew(
             getKdcContext().getConfig().getAllowableClockSkew() * 1000)) {