After moving to JDK 1.5.0_17 - KrbException: The ticket isn't for us (35)

Question

Hello, I met following problem.
As we try to use more recent update of JDK 5.0 (1.5.0_17) our SSO-module brings exception. With previous update of the same JDK (1.5.0_09) everything works without any problems. Here is exception:
Using builtin default etypes for default_tgs_enctypes
default etypes for default_tgs_enctypes: 3 1 23 16 17.
CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType
EType: sun.security.krb5.internal.crypto.DesCbcMd5EType
KrbKdcReq send: kdc=<NAME_OF_KDC> UDP:88, timeout=30000, number of retries =3, #bytes=1305
KDCCommunication: kdc=<NAME_OF_KDC> UDP:88, timeout=30000,Attempt =1, #bytes=1305
KrbKdcReq send: #bytes read=88
KrbKdcReq send: #bytes read=88
KDCRep: init() encoding tag is 126 req type is 13
KRBError:         sTime is Wed Jan 28 18:23:19 CET 2009 1233163399000
         suSec is 821809
         error code is 35
         error Message is The ticket isn't for us
         realm is <NAME_OF_REALM>
         sname is oas
         msgType is 30
KrbException: The ticket isn't for us (35)
Caused by: KrbException: Identifier doesn't match expected value (906)Remarks:
1. OS is WindowsXP SP2
2. allowtgtsessionkey is specified in registry
3. "use DES encryption" in the AD account settings is specified and in krb5.conf it is specified:
default_tgs_enctypes = des-cbc-crc
default_tkt_enctypes = des-cbc-crc
So, as I've written above these settings are not changed by moving from one update of JDK to another.
And one more remark: if not to use "useTicketCache=true" or if to start application while not being logged in to domain, it means application promts to enter login data manually - login is also successful. Only using "useTicketCache=true" and SSO-login exception is thrown.

Answer 1

From "Troubleshooting Kerberos Errors" at
http://download.microsoft.com/download/5/9/c/59c349f5-f0c8-4b9e-9f70-dbc5f2a8c330/Troubleshooting_Kerberos_Errors.DOC
0x23 - KRB_AP_ERR_NOT_US: The ticket isn�t for us
Associated internal Windows error codes
o SEC_E_WRONG_PRINCIPAL
Corresponding debug output messages
o DebugLog(�KLIN(%x) Ticket (%s) not for this service (%wZ).\n�)
o D_DebugLog(�KLIN(%x) Tgt reply is not for our realm: %s instead of %s\n�)
o D_DebugLog(�KLIN(%x) Verified ticket client realm is wrong: %s instead of %s\n�)
Possible Cause and Resolution
o The server has received a ticket that was meant for a different realm.
Resolution
Verify that DNS is set up correctly. Verify that packets are correctly routed across the network.