R – How to get JNDIRealm in Tomcat to use Kerberos auth

I am trying to run a tomcat JNDIRealm using using Kerberos for authentication (authentication="GSSAPI").

However, I'm getting this:

SEVERE: Catalina.start:
LifecycleException:  Exception opening directory server connection:  
javax.naming.AuthenticationException: GSSAPI 
[Root exception is javax.security.sasl.SaslException: GSS initiate failed 
 [Caused by GSSException: No valid credentials provided 
 (Mechanism level: Attempt to obtain new INITIATE credentials failed! (null))
]]

I have this in server.xml:

 <Realm className="org.apache.catalina.realm.JNDIRealm"
                        authentication="GSSAPI"
                        connectionName="CN=XXX User,OU=XXXGenericAccounts,\
                                                   DC=xxx,DC=com"
                        connectionPassword="blah"
                        connectionURL="ldap://blah.xxx.com:389"
                        alternateURL="ldap://blah.xxx.com:389"
                        roleBase="OU=XXXGroups,DC=xxx,DC=com"
                        roleName="cn"
                        roleSearch="member={0}"
                        roleSubtree="true"
                        userBase="OU=XXXUsers,DC=xxx,DC=com"
                        userSearch="sAMAccountName={0}"
                        userSubtree="true"/>

any idea what I am missing here?