Edit: Reformatted this as Q&A. If anyone can change this from Community Wiki to a typical question, that's probably more appropriate as well.
How can I authenticate OpenBSD against Active Directory?
Authenticating against Active Directory with Kerberos is pretty simple on systems using PAM, but OpenBSD doesn't and makes it more difficult. From a tcpdump, it looks like the PAM systems are just doing pre-authentication while OpenBSD's bsd_auth system is using the whole Kerberos authentication process.
Anyway, this took me a while to figure out so hopefully some concise instructions will save you time.
A few quick notes before we begin:
These steps assume you are trying to authenticate email@example.com against the domain EXAMPLE.COM. The domain controller is pdc.EXAMPLE.COM.
That's all there is to it.
A couple useful sites:
An update to the instructions above as a few things have changed since then.
In OpenBSD 5.6, a decision was made to remove Heimdal from the base distribution due to concerns about code quality and nobody being willing to spend the time to audit it. In 5.7 it was made available as a package (For 5.6 you'll need to build from source or figure out how to re-enable it in source). So, before following the instructions above, the following additional steps will need to be completed:
-3. Install the
-1. If you intend to use the heimdal tools a lot, add