It seems kind of unfortunate that you're combining these two modules. It seems that I'd really rather use PAM or pubcookie for my password auth and then GSS-based stuff for native Kerberos.