pam_winbind expects "DOAMIN\name" for authentication, but pam_kerberos expects just "name". Is there a trick to stack them such that the pam_winbind modules are used for account information, but the kerberos modules do the authentication (with the result being that the user has a tgt after login).