Has anyone used pass through authentication to Kerberos with the principal coming from an attribute like krbPrincipalName?
I have pass through auth working where the list of users (nsswitch) comes from the LDAP server and the authentication is using pam such as:
auth required pam_env.so
auth sufficient pam_krb5.so
auth required pam_deny.so
account required pam_krb5.so
session optional pam_keyinit.so revoke
session required pam_limits.so
-session optional pam_systemd.so
session required pam_krb5.so
The pass through plugin is configured to use the RDN where everyone's RDN is like "uid=xxx".
This works fine, but that's because the uid is the same as the part before the realm in the principal.