I'm getting ever closer to having nfs4 working with the samba4 kdc. Currently I seem to be blocking on the error "PAC checksum type is not keyed" which is generated by the kdc when nfs sends a PA-TGS-REQ for nfs/foo.bar.com.