[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = EXAMPLE.COM
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 forwardable = yes

[realms]
 EXAMPLE.COM = {
  kdc = IP.OF.THE.DC:88
  default_domain = example.com
 }

[domain_realm]
 .example.com = EXAMPLE.COM
 example.com = EXAMPLE.COM

auth            required        pam_nologin.so
auth            sufficient      pam_stack.so service=system-auth
auth            sufficient      pam_winbind.so

account         sufficient      pam_stack.so service=system-auth
account         sufficient      pam_wibind.so

password        required        pam_stack.so service=system-auth

session         required        pam_mkhomedir.so skel=/etc/skel umask=0022
session         sufficient      pam_stack.so service=system-auth
session         required        pam_limits.so
session         optional        pam_console.so

session         required        pam_mkhomedir.so skel=/etc/skel umask=0022

$ ssh EXAMPLE.COM+quan.ta@ip.of.linux.server
EXAMPLE.COM+quan.ta@ip.of.linux.server's password: 
Creating directory '/home/EXAMPLE/quan.ta'.
Creating directory '/home/EXAMPLE/quan.ta/.mozilla'.
Creating directory '/home/EXAMPLE/quan.ta/.mozilla/plugins'.
Creating directory '/home/EXAMPLE/quan.ta/.mozilla/extensions'.
Last login: Sat Jul 18 11:58:20 2009 from x.x.x.x

winbind use default domain = yes

/etc/ldap.conf
host 192.168.17.30
base dc=example,dc=com
ldap_version 3

binddn <a href="mailto:ldap@example.com">ldap@example.com</a>
bindpw P@ssw0rd

rootbinddn cn=manager,dc=example,dc=com

scope sub

timelimit 120
bind_timelimit 120
idle_timelimit 3600

# RFC 2307 (AD) mappings
nss_map_objectclass posixAccount user
nss_map_objectclass shadowAccount user
nss_map_attribute uid sAMAccountName
nss_map_attribute homeDirectory unixHomeDirectory
nss_map_attribute gecos cn
nss_map_attribute shadowLastChange pwdLastSet
nss_map_objectclass posixGroup group
nss_map_attribute uniqueMember member
pam_login_attribute sAMAccountName
pam_filter objectclass=User
pam_password ad

/etc/krb5.conf
[libdefaults]
	default_realm = EXAMPLE.COM

# The following krb5.conf variables are only for MIT Kerberos.
	krb4_config = /etc/krb.conf
	krb4_realms = /etc/krb.realms
	kdc_timesync = 1
	ccache_type = 4
	forwardable = true
	dns_lookup_realm = true
  	dns_lookup_kdc = true
	proxiable = true
	v4_instance_resolve = false
	v4_name_convert = {
		host = {
			rcmd = host
			ftp = ftp
		}
		plain = {
			something = something-else
		}
	}
	fcc-mit-ticketflags = true

[realms]
	EXAMPLE.COM = {
		kdc = chuong-2k3.example.com:88
		admin_server = chuong-2k3.example.com
		kpasswd_server = chuong-2k3.example.com:464
		kpasswd_protocol = SET_CHANGE 
		default_domain = example.com
	}
[domain_realm]
	.example.com = EXAMPLE.COM
	example.com = EXAMPLE.COM
[login]
	krb4_convert = true
	krb4_get_tickets = false

/etc/nsswitch.conf
passwd: files ldap
group: files ldap
shadow: files ldap

hosts:          files dns
networks:       files

protocols:      files ldap
services:       files ldap
ethers:         files
rpc:            files ldap

netgroup: nis files ldap

/etc/pam.d/login
auth        sufficient    /lib/security/pam_unix.so
auth        sufficient    /lib/security/pam_krb5.so use_first_pass
auth        sufficient    /lib/security/pam_ldap.so use_first_pass

account sufficient      pam_unix.so debug
account sufficient      pam_krb5.so debug
account sufficient      pam_ldap.so debug
account required        pam_permit.so

password    sufficient    /lib/security/pam_unix.so
password    sufficient    /lib/security/pam_krb5.so use_first_pass
password    sufficient    /lib/security/pam_ldap.so use_first_pass
password required       pam_deny.so

login : u2
Password :
Insufficient credentials to access authentication data

/var/log/auth.log
May 18 10:34:39 chuong-ubuntu login[1352]: pam_unix(login:auth): check pass; user unknown
May 18 10:34:39 chuong-ubuntu login[1352]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/tty1 ruser= rhost= 
May 18 10:34:39 chuong-ubuntu login[1352]: pam_unix(login:account): could not identify user (from getpwnam(u2))
May 18 10:34:39 chuong-ubuntu login[1352]: (pam_krb5): u2: pam_sm_acct_mgmt: entry (0x0)
May 18 10:34:39 chuong-ubuntu login[1352]: (pam_krb5): u2: retrieving principal from cache
May 18 10:34:39 chuong-ubuntu login[1352]: (pam_krb5): u2: pam_sm_acct_mgmt: exit (success)
May 18 10:34:39 chuong-ubuntu login[1352]: pam_unix(login:session): session opened for user u2 by LOGIN(uid=0)
May 18 10:34:39 chuong-ubuntu login[1352]: pam_mkhomedir(login:session): User unknown.
May 18 10:34:39 chuong-ubuntu login[1352]: (pam_krb5): u2: pam_sm_setcred: entry (0x2)
May 18 10:34:39 chuong-ubuntu login[1352]: (pam_krb5): u2: getpwnam failed for u2
May 18 10:34:39 chuong-ubuntu login[1352]: (pam_krb5): u2: pam_sm_setcred: exit (failure)
May 18 10:34:39 chuong-ubuntu login[1352]: Insufficient credentials to access authentication data

login : EXAMPLE\u2
Password :
Login incorrect
/var/log/auth.log
May 18 10:44:38 chuong-ubuntu login[1765]: pam_unix(login:auth): check pass; user unknown
May 18 10:44:38 chuong-ubuntu login[1765]: pam_unix(login:auth): authentication failure; logname=LOGIN uid=0 euid=0 tty=/dev/tty1 ruser= rhost= 
May 18 10:44:38 chuong-ubuntu login[1765]: pam_ldap: error trying to bind (Invalid credentials)
May 18 10:44:40 chuong-ubuntu login[1765]: FAILED LOGIN (1) on '/dev/tty1' FOR 'UNKNOWN', Permission denied