I made a mistake while attempting to figure out why password changing wasn’t working and fixed the problem.
It turns out the kerberos database was corrupted somehow — not enough to stop authentication, but enough to hurt password changing.
The mistake was that I deleted the database. After I had recreated it and added myself back in, I attempted to change passwords … and it worked.
I should add the error I was getting and the solution to my GSSAPI troubleshooting page. I’m convinced that there aren’t enough troubleshooting pages for sysadmins (or people who want to do stuff with *nix), so I’ve taken it upon myself to add a couple of howto’s and such.