ksu command doesn't use service ticket in the cache file but always re-requests to TGS (or fails when there is no TGT in cache)

The documentation states it should not re-request the service ticket (for end-server) but use the already cached quote:

Otherwise, ksu looks for an appropriate Kerberos ticket in the source cache. The ticket can either be for the end-server or a ticket granting ticket (TGT) for the target principal’s realm. If the ticket for the end-server is already in the cache, it’s decrypted and verified. If it’s not in the cache but the TGT is, the TGT is used to obtain the ticket for the end-server. The end-server ticket is then verified.

Details about the problem (my experiments and my enviroment) in this (long) serverfault question:


I already asked to but got no solution in the Krb5 mailing lists and no response on serverfault.