I'm seeing this error message:
NEEDED_PREAUTH: admin@THIS.LAN for for kadmin/admin@THIS.LAN, Additional pre-authentication required
How do I disable Kerberos pre-authentication? The server and client do not have access to UDP on port 123, i.e., NTP, and I cannot change that -- and this is important for syncing the times as required by Kerberos.
Following up on a reference inspired by the answer below, the answer is to use
modify_principal *user* -requires_preauth in kadmin.