kinit: KDC can't fulfill requested option while renewing credentials

Users are unable to renew the ticket-granting ticket

testuser@nfs:/home/testuser> kinit -R
kinit: KDC can't fulfill requested option while renewing credentials

Kerberos/KDC server reports TICKET NOT RENEWABLE

kdc:~ # tail -f -n 0 /var/log/krb5/krb5kdc.log
Apr 08 09:57:42 kdc krb5kdc[5352](info): TGS_REQ (8 etypes {aes256-cts-hmac-sha1-96(18), aes128-cts-hmac-sha1-96(17), aes256-cts-hmac-sha384-192(20), aes128-cts-hmac-sha256-128(19), DEPRECATED:des3-cbc-sha1(16), DEPRECATED:arcfour-hmac(23), camellia128-cts-cmac(25), camellia256-cts-cmac(26)}) 10.10.1.251: TICKET NOT RENEWABLE: authtime 0, etypes {rep=UNSUPPORTED:(0)} testuser@domain.lab for krbtgt/domain.lab@domain.lab, KDC can't fulfill requested option

To enable and configure the renewal lifetime, on the client side, please add the following line to the [libdefaults] section of the /etc/krb5.conf file:
renew_lifetime = 10d

Please ensure that the parameter is configured with the appropriate value.
After requesting a new ticket with kinit, verify with klist -f that the R flag is present

testuser@nfs:/home/testuser> klist -f
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: testuser@domain.lab

Valid starting       Expires              Service principal
04/08/2024 10:01:36  04/08/2024 10:11:36  krbtgt/domain.lab@domain.lab
        renew until 04/15/2024 10:01:36, Flags: RI
04/08/2024 10:01:42  04/08/2024 10:11:36  nfs/nfsserver.domain.lab@domain.lab
        renew until 04/15/2024 10:01:36, Flags: RT