I've traced an issue that's been plaguing us down to a "simple" problem:
Kerberos tickets are not syncing with Open Directory password changes
(from System Preferences). Another way to put this: Expired/expiring
ticket renewal requests are being sign...