ERROR: VAS_ERR_KRB5: Kerberos error Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed (4375747)

ERROR: VAS_ERR_KRB5: Kerberos error Caused by: KRB5KRB_AP_ERR_BAD_INTEGRITY (-1765328353): Decrypt integrity check failed

Authentication fails.

The keytab was made with bad AES entries due to QAS 4.X bug 201442, but it used RC4 entries, so it wasn't failing.
Once SAS was upgraded to 5.X, it starts using the bad AES entries.
 

These commands make it use RC4 only, and then rotate/change the password and stores correct AES entries. In this example the keytab is QAS.keytab

sudo cp /etc/opt/quest/vas/QAS.keytab /etc/opt/quest/vas/QAS.keytab.`date +"%Y_%m_%d"

sudo /opt/quest/bin/vastool ktutil -k /etc/opt/quest/vas/QAS.keytab remove -e aes256-cts-hmac-sha1-96

sudo /opt/quest/bin/vastool ktutil -k /etc/opt/quest/vas/QAS.keytab remove -e aes128-cts-hmac-sha1-96

sudo /opt/quest/bin/vastool -u QAS/ passwd -rk /etc/opt/quest/vas/QAS.keytab
 

201442