I'm impressed with IBM's error logging in this instance; seldom do Kerberos implementations actually manage to give such clear errors and explanations of what they are trying to do.