Contrary to the manpage, the smbcacls utility doesn't actually honor the '-k' flag to do kerberos authentication to a share. This patch propagates the request for kerberos authentication to the actual call to cli_full_connection().
This bug (and the patch) was submitted over two years ago to the samba-technical list by Nick Williams, but doesn't appear to have ever made it into the repository. See
for the original mail.
Created attachment 3087 [details]
patch to allow smbcalcs to do kerberos authentication
Great catch - thanks for pointing that out ! Applied for 3.0.28a and 3.2.