- set PAM_USER using the user's parsed name, converted back to a local name
    - add account management service (checks for key expiration and krb5_kuserok())
    - handle account expiration errors