According to my understanding of Kerberos, a client is supposed to only enter its password once for obtaining the TGT from the Kerberos server and the authentication against the web services (f.e. SSH, Apache, SMB ...) is only done through the service ticket obtained from the Kerberos server.
In my current setup (check here for details), the client is being prompted for its Kerberos (!) password when authenticating to SSH. This happens after the client has already obtained a TGT from the Kerberos server.
To me, this behaviour seems quite odd since the whole idea about Kerberos seems to be that the authentication to a web service is done through tickets instead of passwords. But my colleague is convinced that this behaviour is expected and that the advantage of Kerberos is that the password never leaves the client. It's only used to validate the service ticket on the client's machine.
Can anyone clarify whether or not it is expected behaviour to be prompted for a password when authenticating to SSH via MIT Kerberos?