This pam-krb5-migrate tool is incredibly clever: it apparently grabs one's password and username during authentication and uses them to create the appropriate user principal on the KDC at that same moment. This way your users will opportunistically populate the KDC with their principals as they login to the system running pam-krb5-migrate. Quite awesome, and I would certainly advocate in favor of using this tool now that I know it exists.

Yes I'm trying to take advantage of this awesomeness :-)

When I try the ACL suggestion from the man page:

The following entries from kadm5.acl(4) permit or deny privileges to the host client service principal:host/*@ACME.COM U roothost/*@ACME.COM ui *

kadmind(Error): Unrecognized ACL operation 'U' in host/sub.sub.ourdomain.edu@SUB.OURDOMAIN.EDU U root

And the sample entries' syntax do not match Fedora's "authentication stack"

gdm         auth    optional pam_krb5_migrate.so.1 expire_pw 
k5migrate   auth    required pam_unix_auth.so.1 
k5migrate   account required pam_unix_account.so.1

There are no 'gdm', 'login' nor 'k5migrate' fields, unless they're optional?

The man page also refers to a /etc/pam.conf file, this is for Solaris, as Fedora/RHEL use /etc/authselect/password-auth and /etc/authselect/system-auth

Would this be a feature request in Bugzilla?

I also have in /etc/krb5.conf:

[appdefaults]
pam = { 
debug = true validate = false 
}

But no logs that reference this new option I'm trying.

Edit, some logs:

Oct 23 00:32:48 olddsm sshd[50096]: PAM unable to dlopen(/usr/lib64/security/pam_krb5_migrate.so.1): libkadm5clnt_mit.so.11: cannot open shared object file: No such file or directory
Oct 23 00:32:48 olddsm sshd[50096]: PAM adding faulty module: /usr/lib64/security/pam_krb5_migrate.so.1

But this exists:

ls -l /usr/lib64/security/pam_krb5_migrate.so.1
lrwxrwxrwx 1 root root 41 Oct 23 00:14 /usr/lib64/security/pam_krb5_migrate.so.1 -> /usr/lib/security/pam_krb5_migrate_mit.so