PAM-KRB5: account: unable to get host based service name for realm

Question

I want a custom service to authenticate via PAM with Microsoft Active Directory Services on Windows 2003. kinit appears to work:
Myserver% klist
Ticket cache: /tmp/krb5cc_200
Default principal: [email protected]
Valid starting Expires Service principal
Tue 01 Aug 2006 10:42:23 AM CDT Tue 01 Aug 2006 08:42:23 PM CDT krbtgt/[email protected]
renew until Tue 08 Aug 2006 10:42:23 AM CDT
Running a sample PAM consumer using 'winsamp' as its service name complains that Kerberos doesn't know the user. syslog reports: PAM-KRB5: account: unable to get host based service name for realm 'EXAMPLE.COM'.
I'm stuggling to get any additional logging out of either PAM or Kerberos. Any advice appreciated.
/etc/pam.conf:
winsamp auth required pam_krb5.so.1 debug
winsamp password required pam_krb5.so.1 debug
winsamp account required pam_krb5.so.1 debug
winsamp session required pam_krb5.so.1 debug
/etc/krb5/krb5.conf:
[libdefaults]
default_realm = EXAMPLE.COM
default_tkt_enctypes = des-cbc-md5 ; or des-cbc-crc
default_tgs_enctypes = des-cbc-md5 ; or des-cbc-crc
[realms]
EXAMPLE.COM = {
kdc = mykdc.example.com:88
admin_server = mykdc.example.com
default_domain = EXAMPLE.COM
[domain_realm]
.example.com = EXAMPLE.COM
[logging]
default = FILE:/var/krb5/kdc.log
kdc = FILE:/var/krb5/kdc.log
kdc_rotate = {
# How often to rotate kdc.log. Logs will get rotated no more
# often than the period, and less often if the KDC is not used
# frequently.
period = 1d
# how many versions of kdc.log to keep around (kdc.log.0, kdc.log.1, ...)
versions = 10
[appdefaults]
kinit = {
renewable = true
forwardable= true
PAM sample application synopsis:
pam_start("winsamp", "someuser", &conv, &pamh);
err = pam_authenticate(pamh, 0);
if (err == PAM_USER_UNKNOWN)
printf("don't know that user\n"); // <-- we always arrive here
logout();
}

Answer 1

Part of the problem was that the Sun server's domain was not an exact match for the ADS domain. One was XXXX.EXAMPLE.COM and the other was just EXAMPLE.COM. Adding the equiv. domains in krb5.conf improved that situation.
The sample PAM application still doesn't behave the way I want. When pam.conf is configured to authenticate against /etc/passwd, it works. Not when authenticating against ADS alone. I've come to the conclusion that PAM is for authenticating ONLY access to Solaris accounts.
My application does not need a Solaris account. Am I using the wrong authentication API?