I've successfully setup Koji with Kerberos authentication. The issue
with this is that for notifications, it seems to expect usernames to
be valid email addresses - our krb5 principals have nothing to do with
any email address. There should be a way to specify what email to use
(or a mapping of usernames to email). I guess I could setup postfix
locally with an aliases file, but that seems like an ugly hack :(