When trying to get MIT kerberos tickets or get a MIT web certificate you may get an error message:
This means that the person's MIT account is not allowed to get kerberos tickets, which also blocks the account from getting web certificates.
This most commonly happens if someone has left MIT and their account is deactivated, but it can also happen for other reasons (such as if the account was blocked to stop a spammer from using it).
Solution: if you are an MIT affiliate, contact the IS&T User Accounts office and give your MIT username, the error message, and say where you saw the error message.
Location: Building E19, 50 Ames Street
The technical details is that the person's kerberos principal has been modified in the KDC.
Toggling the "active" state of an account in Moira will trigger an incremental update that automatically toggles the DISALLOW_ALL_TIX setting, and also someone with kadmin access can toggle the setting manually with
kadmin: modprinc +allow_tix username