The problem with the Samba team's advice is that it essentially
prevents the MIT Kerberos AD-DC implementation from getting any
better. Without people using it, we can't know what needs to be fixed.
The Red Hat FreeIPA team has been working on making this functionality
work well with MIT Kerberos for nearly a decade. The main reason it's
not in RHEL/CentOS 8 is because the functionality is too new for them
to turn it on.
Also, declaring that it is experimental is meaningless. What defines
it as experimental? Is there any particular known massive breakage?
We're not going to ship Heimdal Kerberos because the two Kerberos
implementations are incompatible and supporting both would be a
massive nightmare.
At this point, the only way Samba Team will stop calling it
experimental is when lots of folks are using it. That's why Fedora
ships with it enabled. We have the opportunity to help make that
better upstream.