diff --git a/lib/krb5_wrap/krb5_samba.c b/lib/krb5_wrap/krb5_samba.c
index ad737a8c647..427e4beb91a 100644
--- a/lib/krb5_wrap/krb5_samba.c
+++ b/lib/krb5_wrap/krb5_samba.c
@@ -120,6 +120,12 @@ void krb5_free_enctypes(krb5_context context, krb5_enctype *val) {
 }
 #endif
 
+#if !defined(HAVE_KRB5_FREE_STRING)
+void krb5_free_string(krb5_context context, char *val) {
+	SAFE_FREE(val);
+}
+#endif
+
 #if defined(HAVE_KRB5_PRINCIPAL_GET_COMP_STRING) && !defined(HAVE_KRB5_PRINC_COMPONENT)
 const krb5_data *krb5_princ_component(krb5_context context,
 				      krb5_principal principal, int i);
diff --git a/lib/krb5_wrap/krb5_samba.h b/lib/krb5_wrap/krb5_samba.h
index c7928fda519..82f66f51815 100644
--- a/lib/krb5_wrap/krb5_samba.h
+++ b/lib/krb5_wrap/krb5_samba.h
@@ -174,6 +174,10 @@ void krb5_free_unparsed_name(krb5_context ctx, char *val);
 void krb5_free_enctypes(krb5_context context, krb5_enctype *val);
 #endif
 
+#if !defined(HAVE_KRB5_FREE_STRING)
+void krb5_free_string(krb5_context context, char *val);
+#endif
+
 /* Stub out initialize_krb5_error_table since it is not present in all
  * Kerberos implementations. If it's not present, it's not necessary to
  * call it.
diff --git a/wscript_configure_system_mitkrb5 b/wscript_configure_system_mitkrb5
index 8362efb4159..8bd1ab5ea43 100644
--- a/wscript_configure_system_mitkrb5
+++ b/wscript_configure_system_mitkrb5
@@ -171,6 +171,7 @@ conf.CHECK_FUNCS('''
        krb5_get_prompt_types
        krb5_mk_req_extended krb5_kt_compare
        krb5_free_enctypes
+       krb5_free_string
        ''',
      lib='krb5 k5crypto',
      headers='krb5.h')