AFP/Kerberos Unknown user

I’ve been kicking this server for two days trying to get this to work. Forgive my copying/pasting from another forum:

I just reinstalled my 10.4 os x server file server yesterday. Got it patched up, imported the old users, set a few passwords, and then set up AFP, firewall (reimported my old ipfw rules) and Windows services. Added an entry for the computer in Workgroup manager (spelled it wrong the first time), then added a Kerberos record.

I had to rebind the clients to the server, but now users can login (they authenticate against the server). When they try to connect to AFP, however, it chokes. Clients are getting a Kerberos tickets, and the Kerberos app is showing I’ve got a ticket granting ticket, and an afpserver ticket.

When I try to connect, I get “Connection failed. Unknown user, incorrect password, or login is disabled. Please retype the name and password or contact the server’s administrator.” If I destroy the ticket and connect again, cancel the Kerberos window so it takes me back to plain old AFP authentication, it authenticates just fine, and I can connect to the server.

I’ve googled this, and found one other person (on this forum) who had the same problem and it ended up being DNS. I’ve checked both forward and reverse lookups from client and server, and they resolve just fine. There are no CNAMES. The logs say nothing, other than if I try to get a new ticket, it does so successfully. AFP access log shows login followed by immediate logout. KDC log shows, as best as I can tell, successful authentication:
Jul 18 08:29:22 host.name.edu krb5kdc[233](info): AS_REQ (1 etypes {1}) xxx.xxx.xxx.xxx: NEEDED_PREAUTH: test@HOST.NAME.EDU for krbtgt/HOST.NAME.EDU@HOST.NAME.EDU, Additional pre-authentication required
Jul 18 08:29:22 host.name.edu krb5kdc[233](info): AS_REQ (1 etypes {1}) xxx.xxx.xxx.xxx: ISSUE: authtime 1153225762, etypes {rep=1 tkt=16 ses=1}, test@HOST.NAME.EDU for krbtgt/HOST.NAME.EDU@HOST.NAME.EDU
Jul 18 08:29:48 host.name.edu krb5kdc[233](info): TGS_REQ (1 etypes {1}) xxx.xxx.xxx.xxx: ISSUE: authtime 1153225762, etypes {rep=1 tkt=16 ses=1}, test@HOST.NAME.EDU for afpserver/host.name.edu@HOST.NAME.EDU

`klist -k /etc/krb5.keytab` shows afpserver/host.name.edu@HOST.NAME.EDU. `defaults read /Library/Preferences/com.apple.AppleFileServer kerberosPrincipal` shows the same.
I get the same results for newly created users and old imported users. Access isn’t restricted by user. Password Service log shows that not only is my user in good standing, but authentication succeeded. AFP error log shows the power outage last night.

I’m all out of ideas on what to try next.