While setting up Kerberos authentication on the TIBCO Spotfire Server, running the "kinit" command might show the following exception.

 KrbException: KDC has no support for encryption type (14)         at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:76)         at sun.security.krb5.KrbAsReqBuilder.send(KrbAsReqBuilder.java:316)         at sun.security.krb5.KrbAsReqBuilder.action(KrbAsReqBuilder.java:361)         at sun.security.krb5.internal.tools.Kinit.<init>(Kinit.java:219)         at sun.security.krb5.internal.tools.Kinit.main(Kinit.java:113) Caused by: KrbException: Identifier doesn't match expected value (906)         at sun.security.krb5.internal.KDCRep.init(KDCRep.java:140)         at sun.security.krb5.internal.ASRep.init(ASRep.java:64)         at sun.security.krb5.internal.ASRep.<init>(ASRep.java:59)         at sun.security.krb5.KrbAsRep.<init>(KrbAsRep.java:60)         ... 4 more

• Check that the encryption method used in the "ktpass" is supported on the Domain Controller and the TIBCO Spotfire Server. See the resolution of Knowledge Base article "Error while executing kinit command while setting Kerberos authentication: "KrbException : no supported default etypes for default_tkt_enctypes"" (KB 000033761) for more details.
• Check that kinit command syntax is correct and pointing to correct keytab path. 
• Check the Domain Functional Level of the Domain Controller. If the Domain Controller is at Domain Functional Level 2003, it will not support "AES" encryption. Hence "AES" encryption must not be used in ktpass/kinit command/krb5.conf file in this case.  Follow below steps to know the domain functional level: 
  • On Domain controller machine(s) , from the “Administrative Tools” menu, select “Active Directory  Domains  and Trusts“.
  • Right-click the root domain, then select “Properties“.
  • Under the “General” tab, the “Domain functional level” and “Forest functional level” is displayed on the  screen.

• If "AES" encryption is used, make sure that "AES" encryption is enabled for the service account. This can be done from the service account properties.

• https://docs.tibco.com/pub/spotfire_server/12.0.3/doc/html/TIB_sfire_server_tsas_admin_help/server/topics/setting_up_kerberos_authentication_on_spotfire_server.html

• https://support.tibco.com/s/article/Error-while-executing-kinit-command-while-setting-Kerberos-authentication-KrbException-no-supported-default-etypes-for-default-tkt-enctypes