Contrary to the manpage, the smbcacls utility doesn't actually honor the '-k' flag to do kerberos authentication to a share. This patch propagates the request for kerberos authentication to the actual call to cli_full_connection(). This bug (and the patch) was submitted over two years ago to the samba-technical list by Nick Williams, but doesn't appear to have ever made it into the repository. See http://lists.samba.org/archive/samba-technical/2005-August/042340.html for the original mail.
Created attachment 3087 [details] patch to allow smbcalcs to do kerberos authentication
Great catch - thanks for pointing that out ! Applied for 3.0.28a and 3.2. Jeremy.