"Additional preauthentication required"

[<Bob.Smart@csiro.au>]

With an AD kerberos server I used the new samba feature
"use kerberos keytab = true" to generate /etc/krb5.keytab.
However the server keys don't work. When I used MIT krb5
it reported that it couldn't find a KDC. Heimdal gives
the slightly more accurate message

krb5_get_init_creds: Additional pre-authentication required

(e.g. when doing a kinit -k principal). But what does it 
mean in terms of things that I might actually do to fix it?

Bob