Welcome back to Centrify.
Note that you are adding a comment to a thread that has been resolved. In the future, try a new thread.
In your case, are you running in zone mode or in workstation (Auto Zone/Express) mode? (adinfo --zone)
You can always kinit (obtain a Kerberos TGT) regardless of the user being valid for the system (valid = resolvable, authorized to log in), since you're bypassing the NSS and PAM stacks.
However, as your output demonstrates, does not mean that the user is valid for the system. Possible causes:
In Auto Zone - user is not in a favorable side of a one-way trust (Kerberos will work because KDCs are available and configured).
In Zone Mode:
a) User may not have a UNIX profile (e.g. login, UID, GID, Home, GECOS, Shell).
b) User is not authorized to log in (e.g. does not have the PAM right).
c) Incorrectly created role.
d) User's role assignment has expired.
R.P