kadm5_init in the client library does not correctly perform fallback when the kadmin/fqdn at REALM principal does not exist in the realm. It should attempt kadmin/admin at REALM if the former fails, before returning an error of KADM5_SECURE_PRINC_MISSING. Workaround for kadmin client is to use the '-O' flag.