"shishi user SERVICE" borked?

[Elrond]

Hi,

Either I'm doing something wrong, or something is catching
me here:

        Rivendell:~% shishi address@hidden                 
        Enter password for address@hidden': 
        ...
        Server:         krbtgt/W2K3DOM.SAMBA-TNG.ORG key arcfour-hmac (23)
        Ticket key:     des-cbc-md5 (3) protected by des-cbc-md5 (3)
        Ticket flags:   INITIAL PREAUTHENT (1536)
        Rivendell:~% shishi address@hidden host/m3-w2k3-srv
        Generic error from server:
        shishi: Could not get ticket as `elrond' for `host/m3-w2k3-srv'.

same against heimdal, just different error:

        Error code from server:
        Integrity check on decrypted field failed
        shishi: Could not get ticket as `elrond' for `imap/rivendell'.

heimdal-kdc.log has a simple:

        Failed to verify checksum: Decrypt integrity check failed
        Failed to verify authenticator: Decrypt integrity check failed

(heimdal has preauth disabled again.)

What am I doing wrong there?


    Elrond

p.s.:   kinit elrond
        kgetcred imap/rivendell
        from heimdal/client works.