kerberos login debugging

Domain login failures aren't very easy to troubleshoot.  This is what the log says:

lowdenjk@njlrlp61[Compustat]$ TDSDUMP=stdout tsql -S $S -D $D -U '' -P '' 
locale is "en_US.UTF-8"
locale charset is "UTF-8"
log.c:196:Starting log file for FreeTDS 0.83.dev.20091104
        on 2010-09-27 15:02:44 with debug flags 0x4fff.
iconv.c:337:tds_iconv_open(0x1faed2d0, UTF-8)
iconv.c:78:Using trivial iconv
iconv.c:197:local name for ISO-8859-1 is ISO-8859-1
iconv.c:197:local name for UTF-8 is UTF-8
iconv.c:197:local name for UCS-2LE is UCS-2LE
iconv.c:197:local name for UCS-2BE is (null)
iconv.c:365:setting up conversions for client charset "UTF-8"
iconv.c:367:preparing iconv for "UTF-8" <-> "UCS-2LE" conversion
iconv.c:404:preparing iconv for "ISO-8859-1" <-> "UCS-2LE" conversion
iconv.c:407:tds_iconv_open: done
net.c:217:Connecting to 10.82.32.177 port 2500 (TDS version 8.0)
net.c:273:tds_open_socket: connect(2) returned "Operation now in progress"
net.c:313:tds_open_socket() succeeded
util.c:162:Changed query state from DEAD to IDLE
login.c:470:login packet rejected
util.c:162:Changed query state from IDLE to DEAD
util.c:334:tdserror(0x1faec140, 0x1faed2d0, 20002, 0)
Msg 20002, Level 9, State -1, Server OpenClient, Line -1
Adaptive Server connection failed
util.c:364:tdserror: client library returned TDS_INT_CANCEL(2)
util.c:393:tdserror: returning TDS_INT_CANCEL(2)
mem.c:603:tds_free_all_results()

Problems:

1.  Message 20002 is wrong.  The *connection* succeeded.  The login failed, cf.  SYBENEG or possibly SYBEORPF among others.  We need error status from the underlying library.  But how?  

2.  The log says only the login packet was rejected.  I'm not a Kerberos expert.  What could the library tell me that I could report to the sysadmin or engineering group?  

I know FreeTDS can use Kerberos to log in to SQL server.  What I don't know is how to set that up externally, or how to tell the admin folks where to look.  

Any advice appreciated.  

--jkl