Has anyone ever made Kerberos work with AFP reliably?

Question

I've been working on this for a couple of weeks. And while I've figured a bunch of stuff out, I'm fairly certain at this point that it's literally impossible to make AFP work using Kerberos.
So it would be great if I could get some feedback that this is possible in any way?
My question is, has any person here ever successfully made AFP work with Kerberos, as defined by:
1. In Server Admin, under AFP > Settings > Access the Authentication setting is set to "Kerberos"
2. You have been able to run your server(s) with this setting for an extended period of time, greater than two months, and are still running this way.
Please only respond positively if you have literally done this, not if you have heard of it being done, or wish to do it, or have read in a manual somewhere that it can be done.
And if you have done it, and you have good resources we might not have found using google or the os x server manuals, feel free to point them out.
Sometimes questions are pulled off the site because they are not specific enough, so I want to make my question clear. Should I continue down the path of trying to make this work (as evidenced by other people having successfully made it work) or should I give up on it?
My hunch is that a lot of people think they have Kerberos working because Server Admin > Open Directory > Overview says it's working (as mine does) and they think they have SSO. But really they just checked the "remember my login" box when logging in to a share and Kerberos isn't doing a thing, their Mac just automates the login process every time they go to a share. If they set AFP to use only Kerberos their network would break just like anyone else who tries to do that.

Answer 1

Yes. This most certainly works.
The areas that you need to focus is DNS and time, likely in that order. Assuming DNS is set up properly and remains that way, then you may be running into the lazy mDNSResponder issues that are plaguing early releases of 10.6. If this is the case, then tools like nslookup and dig will return the proper lookup results, but when trying to resolve to a service, the connection fails as it is misdirected. This happens most frequently on split DNS installations and has improved dramatically with the release of 10.6.3.
Beyond that, make sure your time on all workstations agree with the time on the domain server. If you have Mac Pros, those Xeon chips like to drift. If you have a time skew then Kerberos auth with fail and you will be dropped back to standard auth or no auth if you only permit kerb. This can become more complicated if your domain server and your file server are different machines.
Hope that helps. This is doable and has been since the 10.4 days. Yes, 10.6 had some release pains, but so do all OS releases. 10.6.3 is now deployable in all but the most custom environments.