Have you setup java on your client to know about your Kerberos realm, KDC etc?
When using a client, I usually get that error if the client’'s not aware of the KDC it should be talking to or when there is no reverse DNS lookup for identifying service principal name.