I'm having trouble with kerberos.

On ipa:

$ kinit <username>

[1625] 1581094928.1017: Response was from master KDC
[1625] 1581094928.1018: Processing preauth types: 19

-and-

$ kinit admin

[1626] 1581094962.274365: Received error from KDC: -1765328360/Preauthentication failed
[1626] 1581094962.274368: Preauthenticating using KDC method data

and from the logs:

Feb 07 12:13:19 ipa1.practichem.com krb5kdc[1224](info): AS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-hmac-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.10.1.80: NEEDED_PREAUTH: admin@practichem.com for krbtgt/practichem.com@practichem.com, Additional pre-authentication required