Ktadmin error - anyone know the cause?

Question

I'm working on supporting Open Directory Kerberos authentication from a Java application. As a part of kerberizing the service the service principal has to be added to Open Directory and a keytab file needs to be exported, using kadmin.
I'm perplexed by the following error on one Open Directory / Mac OS X Server instance I have running, when I try to run sudo kadmin:
"kadmin: Missing parameters in krb5.conf required for kadmin client while initializing kadmin interface."
This is a fairly new (and mostly unused) server and there is no /etc/krb5.conf file at all. In earlier testing on a different Leopard server machine, these commands worked; I checked and the machine where it works also doesn't have an /etc/krb5.conf file by default. I didn't find any differences in Open Directory settings apart from the
Why might this error occur on one Leopard Server and not another?

Answer 1

Thanks, this was indeed the problem, so in writing up instructions I'll explicitly say use kadmin.local.
For curiosity I'm still interested in the root cause; there must still be some difference between the two servers because kadmin works on one while kadmin.local is required on the other.
A long shot - could SMB and acting as a Windows PDC have anything to do with it? That's the only difference I could find - the second server (the one that forces me to use kadmin.local) has SMB running and is a Windows PDC (though no Windows clients are actually bound to it currently).
There are examples in the 10.5 Server Command Line Administration guide of using kadmin (not kadmin.local) on the KDC machine. From page 264:
To kerberize a service (from a terminal *+running on that host+*):
1 To create the service principal, use kadmin.
$ sudo kadmin -p admin_principal -q “addprinc -randkey service-principal”
2 Import the principal key into the keytab file.
$ sudo kadmin -p admin_principal -q “ktadd service-principal”
3 Configure the service to use the new principal.
This step is service-specific. For information about how to perform this step, see the service documentation.
The man page says "the difference is that kadmin.local runs on the master KDC if the database is db2 and does not use Kerberos to authenticate to the database." I don't read this as indicating that kadmin shouldn't work on the KDC host.
The particular warning about a krb5.conf file indicates to me that the problem isn't in using kadmin but in some subtle configuration difference. Perhaps there's a setting somewhere to control whether or not kadmin is enabled and/or itself capable for kerberos authentication? As mentioned, neither server has an /etc/krb5.conf file.
(FWIW I installed and set up the server that works with kadmin, while IT set up the one that requires kadmin.local - no word from them on anything they did differently, apart from the SMB service and PDC status).