diff --git a/cli/koji_cli/commands.py b/cli/koji_cli/commands.py
index 362340e3..681b4eeb 100644
--- a/cli/koji_cli/commands.py
+++ b/cli/koji_cli/commands.py
@@ -2065,7 +2065,14 @@ def handle_edit_user(goptions, session, args):
     usage += _("\n(Specify the --help global option for a list of other help options)")
     parser = OptionParser(usage=usage)
     parser.add_option("--rename", help=_("Rename the user"))
-    parser.add_option("--krb", help=_("Change kerberos principal of the user"))
+    parser.add_option("--edit-krb", action="append", default=[],
+                      metavar="OLD=NEW",
+                      help=_("Change kerberos principal of the user"))
+    parser.add_option("--add-krb", action="append", default=[], metavar="KRB",
+                      help=_("Add kerberos principal of the user"))
+    parser.add_option("--remove-krb", action="append", default=[],
+                      metavar="KRB",
+                      help=_("Remove kerberos principal of the user"))
     (options, args) = parser.parse_args(args)
     if len(args) < 1:
         parser.error(_("You must specify the username of the user to edit"))
@@ -2073,7 +2080,15 @@ def handle_edit_user(goptions, session, args):
         parser.error(_("This command only accepts one argument (username)"))
     activate_session(session, goptions)
     user = args[0]
-    session.editUser(user, options.rename, options.krb)
+    princ_mappings = []
+    for p in options.edit_krb:
+        old, new = p.split('=', 1)
+        princ_mappings.append({'old': arg_filter(old), 'new': arg_filter(old)})
+    for a in options.add_krb:
+        princ_mappings.append({'old': None, 'new': arg_filter(a)})
+    for r in options.remove_krb:
+        princ_mappings.append({'old': arg_filter(r), 'new': None})
+    session.editUser(user, options.rename, princ_mappings)
 
 
 def handle_list_signed(goptions, session, args):
diff --git a/tests/test_cli/test_edit_user.py b/tests/test_cli/test_edit_user.py
index 1dcd497b..843f1b33 100644
--- a/tests/test_cli/test_edit_user.py
+++ b/tests/test_cli/test_edit_user.py
@@ -20,10 +20,11 @@ class TestEditUser(unittest.TestCase):
     def test_handle_edit_user(self, activate_session_mock, stdout):
         user = 'user'
         rename = 'user2'
-        krb_principal = 'krb'
         args = [user]
         args.append('--rename=' + rename)
-        args.append('--krb=' + krb_principal)
+        args.append('--add-krb=addedkrb')
+        args.append('--remove-krb=removedkrb')
+        args.append('--edit-krb=oldkrb=newkrb')
         options = mock.MagicMock()
 
         # Mock out the xmlrpc server
@@ -38,7 +39,10 @@ class TestEditUser(unittest.TestCase):
         self.assertMultiLineEqual(actual, expected)
         # Finally, assert that things were called as we expected.
         activate_session_mock.assert_called_once_with(session, options)
-        session.editUser.assert_called_once_with(user, rename, krb_principal)
+        session.editUser.assert_called_once_with(user, rename,
+                                                 [{'new': 'oldkrb', 'old': 'oldkrb'},
+                                                  {'new': 'addedkrb', 'old': None},
+                                                  {'new': None, 'old': 'removedkrb'}])
         self.assertEqual(rv, None)
 
         stdout.seek(0)
@@ -67,9 +71,11 @@ class TestEditUser(unittest.TestCase):
 (Specify the --help global option for a list of other help options)
 
 Options:
-  -h, --help       show this help message and exit
-  --rename=RENAME  Rename the user
-  --krb=KRB        Change kerberos principal of the user
+  -h, --help          show this help message and exit
+  --rename=RENAME     Rename the user
+  --edit-krb=OLD=NEW  Change kerberos principal of the user
+  --add-krb=KRB       Add kerberos principal of the user
+  --remove-krb=KRB    Remove kerberos principal of the user
 """ % progname
         expected_stderr = ''
         self.assertMultiLineEqual(actual_stdout, expected_stdout)