The keytab was made with bad AES entries due to QAS 4.X bug 201442, but it used RC4 entries, so it wasn't failing. Once SAS was upgraded to 5.X, it starts using the bad AES entries.
解决办法
These commands make it use RC4 only, and then rotate/change the password and stores correct AES entries. In this example the keytab is QAS.keytab