title: kinit: Client's credentials have been revoked while getting initial credentials
body: <p>I have hdp cluster configured with kerberos with AD. All HDP service accounts have principals and keytabs generated including spark.</p>
  
  <p>I know service accounts will not have passwords and set to unexpire.
  Now while doing <code>kinit -kt spark.keytab -p spark-PRINCIPAL</code> I get the following error (see the title). </p>
  
  <p>I read in MIT website it happens due to many unsuccessful login attempts or account expiry set in default policy in KDC.account can be unlocked using kadmin commands such as <code>kadmin:modprinci</code> spark/principal but I have cross checked with AD admin. He says we don't use kdc server to execute kadmin commands where as we use AD but says spark account is unlocked state when checked using AD UI.</p>
  
  <p><strong>My questions</strong>:</p>
  
  <p>Is there any commands to unlock spark account in AD?</p>
  
  <p>I have tired removing spark service and re install in my cluster which did regenerate new keytab or principal to avoid revoked error from AD. Saw if any spark local account causing this error.</p>
  
  <p>AD admin has given me server details and password with limited privileges to do ldap search and delete commands. Can I use these privileges to unlock spark? And how to do this?</p>