Comment by cyberax

Ask IBM/RedHat. They did a lot of foundational work with SSSD (aka "too many 'S' D").

Kerberos is not a great protocol, though.