krb5.conf lense, kdc lists have two approaches

[jcpunk]

The following stanzas are both parsed out by MIT kerberos

[realms]
        FNAL.GOV = {
                kdc = krb-fnal-2.fnal.gov:88
                kdc = krb-fnal-3.fnal.gov:88
                kdc = krb-fnal-1.fnal.gov:88
                kdc = krb-fnal-4.fnal.gov:88
                master_kdc = krb-fnal-admin.fnal.gov:88
                admin_server = krb-fnal-admin.fnal.gov
                default_domain = fnal.gov
        }
        SLAC.STANFORD.EDU = {
                kdc = k5auth1.slac.stanford.edu:88 k5auth2.slac.stanford.edu:88 k5auth3.slac.stanford.edu:88
                master_kdc = k5auth1.slac.stanford.edu:88
                admin_server = k5admin.slac.stanford.edu
                kpasswd_server = k5passwd.slac.stanford.edu
                default_domain = slac.stanford.edu
        }

Yet augeas does not correctly parse out the SLAC.STANFORD.EDU section.

[domcleal]

The multiple values on the 'kdc' line are the issue here I think, commenting it out lets the snippet parse.