What are the consequences of adding such an attribute when replication is occurring? I assume I must extend the schema on each server, what happens if I neglect to extend the schema on one server and it receives replica info that has this new attribute populated for some users?
I would also entertain the idea of having an attribute with just the realm (or a proxy for the realm), and constructing the krbuid equivalent via some operational attribute that constructs it via uid + "@" + realm on the fly, if this is possible. I might even be able to do this using existing location attribute or another existing attribute, I can easily determine the correct realm from corresponding location-specific info associated with each user. But, I don't know how to do this in practice.
Also, if anyone has an example pam ldapserver file they could share, I would appreciate it.