I added the kadmin/{kdc host name}@realm and no longer need the -O flag when running kadmin -p principal