It appears that it is necessary to kinit prior to starting ambari-server, even after ambari-server setup-security (#3). It seems that this should be automatically handled by Ambari.
Ambari-server should NOT use the same ticket cache as the interactive user.
2. ambari-server start
3. verify that ambari-server can authenticate with ticket specified in #1
5. try to authenticate through Ambari again (it will not work)
Ensure JAAS Login works properly such that the Kerberos tickets for the account that executes Ambari is not relevant.