Winbind makes users who are members of a domain appear to be normal users, with the domain name frequently included as a prefix of the user name. Kerberos doesn't handle this perfectly. Specifically, for a user named tester in domain TEST and realm TEST.EXAMPLE.COM, we have two names. Kerberos principal name (userPrincipalName): tester@TEST.EXAMPLE.COM Winbind/POSIX user name: TEST\tester For certain internal functions (such as access control checking using a user's .k5login file), the library will need to convert a principal name to a user name. This is controlled by the 'auth_to_local_names' and 'auth_to_local' configuration settings for the default realm in /krb5.conf. One such mapping would look like: [libdefaults] default_relam = TEST.EXAMPLE.COM [realms] TEST.EXAMPLE.COM = { auth_to_local = RULE:[1:$0\$1](TEST\.EXAMPLE\.COM\\.*)s/TEST\.EXAMPLE\.COM/TEST/g auth_to_local = DEFAULT } The argument to RULE: is the concatentation of: * An optional input formulation "[" number-of-components ":" template "]" Where number-of-components is the number of instance parts + 1, and the template mixes literal text with portions of the principal name ($1 is the root part, $2 is the first instance, $3 the second, etc., $0 the realm in MIT krb5 1.3.4 and later). * An optional regex If specified, the formulated string must match this regexp for this rule to be applied. * An optional sed expression "s/" matchexp "/" output "/" ["g"] The DEFAULT rule more or less equates to RULE:[1:$1] and must be explicitly listed to benefit from its effects if any RULEs are specified. This solves one problem, but pam_krb5 needs some way to convert a user name which is provided by PAM into a principal name, and there is no configurable way to do this using the Kerberos libraries. To support this, pam_krb5 has a "mappings" configuration directive which can be used to map a user name to a principal name. The directive takes pairs of arguments (regexps and output specifiers). A specifier can refer to a substring matched in its regexp by specifying a "$" and the relative location of the substring in the regexp. [appdefaults] pam = { mappings = TEST\\(.*) $1@TEST.EXAMPLE.COM }