In AD, when you join a machine to the domain, you get by default a bunch of aliases attached to the host key.

We should create a special "AD" mode in GSS-Proxy to allow specific services to use the host key in "alias mode".

Key things to do: set a null name in the gss_accept_sec_context().
Still check that the requesting service is passing it an acceptable service name, and (if possible) check what name the remote client used and match it.

The options should be something like:
[apache]
euid = 48
alias = HTTP # {perhaps even HTTP/fqdn}

The keytab it should point to is the host key (which is the default if not specified explicitly)

When alias is specified it means we want to try to use a key named differently.