Shouldn't I be getting a Kerberos ticket when logging in to my Lion Server?

Question

I have a very small OS X network setup: one server, one client.  OD, DNS, etc. all working well.  One thing I noticed though is when I log into the server directly, I never have a Kerberos ticket and have to use kinit; when I log into the client, I always get a ticket automatically. 
After logging in to the server (directly via console, not ssh), I open a terminal and klist shows:
klist: krb5_cc_get_principal: No credentials cache file found
I can 'kinit' at this point, provide my password and I will get a working ticket, but isn't this supposed to happen at login time the way it does on my client?
I've made no modifications to /etc/pam.d/authorization:
# authorization: auth account
auth       optional       pam_krb5.so use_first_pass use_kcminit
auth       optional       pam_ntlm.so use_first_pass
auth       required       pam_opendirectory.so use_first_pass nullok
account    required       pam_opendirectory.so
What am I missing here?  Why woudn't I bet getting tickets at login on this system?
Many thanks,
-O

Answer 1

@Strontium, not sure what the basis for your opinion is, the server login processes *is* a client of  OpenDirectory and Kerberos and subject to the same PAM authorization process and thus the creation of a Kerberos ticket.
After nearly two days of digging, I found the issue was caused by the existance of user records for some of my network users in the /Local/Default directory on the server which had  an AuthenticationAuthority value pointing to an old, no longer used, Kerberos domain.  As these were OpenLDAP users, I hadn't even thought of examing the local directory until I noticed that the expected Kerberos ticket behavior was working properly for one of my accounts which was not a 'mobile' account.  I then realized only my 'mobile' accounts (which were nearly all of them) were the only accounts showing this problem. 
I believe what happened is when I changed server's kerberos name at some point in the past (by backing up the OpenLDAP records, demoting the master, re-creating the master with the new Kerberos name, importing the records, and resetting passwords); I never thought to clean up any locally cached user records for my 'mobile' users.
To fix: I used the Directory Utility to delete the users from the local cache.  On next login by a mobile user, a correct local user record was created reflecting the proper Kerberos authority and now I'm getting Kerberos tickets on login again.