Occasionally, you might find that even though you have created the proper credentials and assigned the proper access rights, some principal requests still get denied. The most common cause of this problem is the existence of stale objects with old versions of a server's public key. You can usually correct this problem by:
Running nisupdkeys on the domain you are trying to access. (See "The nisupdkeys Command" for information on using the nisupdkeys command and "Stale and Outdated Credential Information" for information on how to correct this type of problem.)
Killing the nis_cachmgr on your machine, removing /var/nis/NIS_SHARED_DIRCACHE, and then restarting nis_cachemgr.