kerberos Authentication failed on shibboleth

[xinyi yu]

Hi,
  I use kerberos on shibboleth, but I get "Authentication failed" on the
login page. I create the HTTP/idp.aa.com and write the key in the
/etc/krb5.keytab . I use kinit -k HTTP/idp.aa.com
-t /etc/krb5.keytab and scp the krb5.keytab file to sp

 idp-process.log
21:47:40.989 - INFO [ch.SWITCH.aai.idp.kerberos.KrbLoginServlet:125] -
kerberos idp servlet started
21:47:40.990 - DEBUG [ch.SWITCH.aai.idp.kerberos.HttpNegotiator:72] - HTTP:
Returning response code '401'. Authorization header not found.
21:47:41.757 - INFO [ch.SWITCH.aai.idp.kerberos.KrbLoginServlet:125] -
kerberos idp servlet started
21:47:41.758 - DEBUG [ch.SWITCH.aai.idp.kerberos.KrbLoginServlet:156] -
Authentication process error.

Any clue will be appreciated.
Thanks
xinyi