Debian(and thus Ubuntu) package OpenLDAP compiled against gnuTLS instead of OpenSSL. This is fine for playing around, but gnuTLS has been significantly slower on our network. I always rebuild the Ubuntu package compiled against OpenSSL.
Other distros may do the same or different.
Kerberos doesn't really seem useful in my environment(~200 linux workstations, ~40 macs, nfs servers, imap, smtp, web server). None of our common client applications support kerberos authentication(Firefox, Thunderbird). It would just be used on a host level for NFS and as a PAM module for authentication. I think SSL can do just as good a job at keeping passwords secret.
If you do use kerberos, you should use Heimdal for integration with the OpenLDAP smbk5pwd overlay.
The default library for nss from PADL is a bit bloated and troublesome. I recommend you try SSS or nss-pam-ldapd. They both work very well in my environment.
SSS does so much more than PADL's libraries. It includes caching, so you don't need nscd.
nss-pam-ldapd is a rewrite of the PADL libraries made to be much more efficient.
Managing your data
I am a big fan of phpLDAPAdmin. It makes it very easy to view your schemas and modify individual entries.
Other LDAP Servers
They may be slower, but they have more advanced features.
You might want to try ApacheDS since it has builtin kerberos.