Problem using Kerberos for user authentication

[Braden McDaniel]

I'm trying to get off the ground setting up Kerberos on a Fedora 11 box.
I've attempted to follow the instructions here:

        http://aput.net/~jheiss/krbldap/howto.html

"kinit username/admin" appears to work.  But I can't get system logins
to work.  I've used the authconfig-tui utility to enable Kerberos for
authentication; /etc/pam.d/system-auth looks like this:

        #%PAM-1.0
        # This file is auto-generated.
        # User changes will be destroyed the next time authconfig is run.
        auth        required      pam_env.so
        auth        sufficient    pam_unix.so nullok try_first_pass
        auth        requisite     pam_succeed_if.so uid >= 500 quiet
        auth        sufficient    pam_krb5.so use_first_pass
        auth        required      pam_deny.so
        
        account     required      pam_unix.so broken_shadow
        account     sufficient    pam_localuser.so
        account     sufficient    pam_succeed_if.so uid < 500 quiet
        account     [default=bad success=ok user_unknown=ignore] pam_krb5.so
        account     required      pam_permit.so
        
        password    requisite     pam_cracklib.so try_first_pass retry=3
        password    sufficient    pam_unix.so md5 shadow nis nullok try_first_pass use_authtok
        password    sufficient    pam_krb5.so use_authtok
        password    required      pam_deny.so
        
        session     optional      pam_keyinit.so revoke
        session     required      pam_limits.so
        session     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uid
        session     required      pam_unix.so
        session     optional      pam_krb5.so

I've tried both changing the password field for the user in /etc/shadow
to "*K*" (as mentioned in the howto) and removing the user's entry
in /etc/shadow altogether--in both cases login fails.

Any ideas what the problem might be? Or where else I should be looking
to find out?

-- 
Braden McDaniel <braden at endoframe.com>