A: You can use Kerberos ticket only for login to ui.farm.particle.cz.
Add to a configuration file:
[libdefaults]
...
dns_lookup_realm = true
dns_lookup_kdc = true
...
[realms]
FARM.PARTICLE.CZ = {
}
[domain_realm]
.farm.particle.cz = FARM.PARTICLE.CZ
farm.particle.cz = FARM.PARTICLE.CZ