I suspect this is: http://krbdev.mit.edu/rt/Ticket/Display.html?id=6681&user=guest&pass=guest which should be fixed in the forthcoming krb5 1.8.1. If I'm correct, the pam_krb5 code could work around the bug, but I'm not sure if there's a configuration workaround.