> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kerberos-error-code.md).

# XDM\_CONST.KERBEROS\_ERROR\_CODE

Kerberos error code.

| Original | Mapped                                                                      | Description                                      |
| -------- | --------------------------------------------------------------------------- | ------------------------------------------------ |
| 0        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_NONE                            | No error                                         |
| 1        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_NAME\_EXP                       | Client's entry in database has expired.          |
| 2        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_SERVICE\_EXP                    | Server's entry in database has expired.          |
| 3        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_BAD\_PVNO                       | Requested protocol version number not supported. |
| 4        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_C\_OLD\_MAST\_KVNO              | Client's key encrypted in old master key.        |
| 5        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_S\_OLD\_MAST\_KVNO              | Server's key encrypted in old master key.        |
| 6        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_C\_PRINCIPAL\_UNKNOWN           | Client not found in Kerberos database.           |
| 7        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_S\_PRINCIPAL\_UNKNOWN           | Server not found in Kerberos database.           |
| 8        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_PRINCIPAL\_NOT\_UNIQUE          | Multiple principal entries in database.          |
| 9        | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_NULL\_KEY                       | The client or server has a null key.             |
| 10       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_CANNOT\_POSTDATE                | Ticket not eligible for postdating.              |
| 11       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_NEVER\_VALID                    | Requested start time is later than end time.     |
| 12       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_POLICY                          | KDC policy rejects request.                      |
| 13       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_BADOPTION                       | KDC cannot accommodate requested option.         |
| 14       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_ETYPE\_NOSUPP                   | KDC has no support for encryption type.          |
| 15       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_SUMTYPE\_NOSUPP                 | KDC has no support for checksum type.            |
| 16       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_PADATA\_TYPE\_NOSUPP            | KDC has no support for padata type.              |
| 17       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_TRTYPE\_NOSUPP                  | KDC has no support for transited type.           |
| 18       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_CLIENT\_REVOKED                 | Clients credentials have been revoked.           |
| 19       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_SERVICE\_REVOKED                | Credentials for server have been revoked.        |
| 20       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_TGT\_REVOKED                    | TGT has been revoked.                            |
| 21       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_CLIENT\_NOTYET                  | Client not yet valid; try again later.           |
| 22       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_SERVICE\_NOTYET                 | Server not yet valid; try again later.           |
| 23       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_KEY\_EXPIRED                    | Password has expired; change password to reset.  |
| 24       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_PREAUTH\_FAILED                 | Pre-authentication information was invalid.      |
| 25       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_PREAUTH\_REQUIRED               | Additional pre-authentication required.          |
| 26       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_SERVER\_NOMATCH                 | Requested server and ticket don't match.         |
| 27       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_MUST\_USE\_USER2USER            | Server principal valid for user2user only.       |
| 28       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_PATH\_NOT\_ACCEPTED             | KDC Policy rejects transited path.               |
| 29       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_SVC\_UNAVAILABLE                | A service is not available.                      |
| 31       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_BAD\_INTEGRITY                   | Integrity check on decrypted field failed.       |
| 32       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_TKT\_EXPIRED                     | Ticket expired.                                  |
| 33       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_TKT\_NYV                         | Ticket not yet valid.                            |
| 34       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_REPEAT                           | Request is a replay.                             |
| 35       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_NOT\_US                          | The ticket isn't for us.                         |
| 36       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_BADMATCH                         | Ticket and authenticator don't match.            |
| 37       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_SKEW                             | Clock skew too great.                            |
| 38       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_BADADDR                          | Incorrect net address.                           |
| 39       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_BADVERSION                       | Protocol version mismatch.                       |
| 40       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_MSG\_TYPE                        | Invalid message type.                            |
| 41       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_MODIFIED                         | Message stream modified.                         |
| 42       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_BADORDER                         | Message out of order.                            |
| 44       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_BADKEYVER                        | Specified version of key is not available.       |
| 45       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_NOKEY                            | Service key not available.                       |
| 46       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_MUT\_FAIL                        | Mutual authentication failed.                    |
| 47       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_BADDIRECTION                     | Incorrect message direction.                     |
| 48       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_METHOD                           | Alternative authentication method required.      |
| 49       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_BADSEQ                           | Incorrect sequence number in message.            |
| 50       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_INAPP\_CKSUM                     | Inappropriate type of checksum in message.       |
| 51       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_PATH\_NOT\_ACCEPTED              | Policy rejects transited path.                   |
| 52       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_RESPONSE\_TOO\_BIG              | Response too big for UDP; retry with TCP.        |
| 60       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_GENERIC                              | Generic error (description in e-text).           |
| 61       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_FIELD\_TOOLONG                       | Field is too long for this implementation.       |
| 62       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_\_CLIENT\_NOT\_TRUSTED          | Reserved for PKINIT.                             |
| 63       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_\_KDC\_NOT\_TRUSTED             | Reserved for PKINIT.                             |
| 64       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_\_INVALID\_SIG                  | Reserved for PKINIT.                             |
| 65       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_KEY\_TOO\_WEAK                  | Reserved for PKINIT.                             |
| 66       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_CERTIFICATE\_MISMATCH           | Reserved for PKINIT.                             |
| 67       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_NO\_TGT                          | No TGT available to validate USER-TO-USER.       |
| 68       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_WRONG\_REALM                    | Reserved for future use.                         |
| 69       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_AP\_USER\_TO\_USER\_REQUIRED         | Ticket must be for USER-TO-USER.                 |
| 70       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_CANT\_VERIFY\_CERTIFICATE       | Reserved for PKINIT.                             |
| 71       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_INVALID\_CERTIFICATE            | Reserved for PKINIT.                             |
| 72       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_REVOKED\_CERTIFICATE            | Reserved for PKINIT.                             |
| 73       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_REVOCATION\_STATUS\_UNKNOWN     | Reserved for PKINIT.                             |
| 74       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_REVOCATION\_STATUS\_UNAVAILABLE | Reserved for PKINIT.                             |
| 75       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_CLIENT\_NAME\_MISMATCH          | Reserved for PKINIT.                             |
| 76       | XDM\_CONST.KERBEROS\_ERROR\_CODE\_ERR\_KDC\_KDC\_NAME\_MISMATCH             | Reserved for PKINIT.                             |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/xsiam-data-model-schema/consts/kerberos-error-code.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.