Like you mentioned, the first kind-of problem in doing this with OpenBSD is that Kerberos is gone as of April 25, 2014. From the commit ... :

The complexity and quality of kerberosV and the fact that almost nobody is using it doesn't justify to have it in base - disable and remove it. If the 2 two people who use it still want it, they can make a port or recompile OpenBSD on their own.

There is a quote in theo.c from August 2010: "basically, dung beetles fucking. that's what kerberosV + openssl is like".

Discussed with many. Tests by henning@ reyk@ and others. ok deraadt@ henning@

That said, there's nothing stopping you from building it yourself from source.

Essentially, you have three basic requirements here to accomplish this ... :

1. get ldap working ... maybe something like this
2. build kerberos client from source
3. build (if not available) msktutil and use that join an AD domain and get Kerberos data from AD

If you can get that sorted, the other things you'll want to look at are ... :

• prompting for Kerberos ticket renewal as required instead of just bombing out
• destroying Kerberos credentials on logout
• forwarding credentials via SSH (if you need that sort of thing)
• prompting for initial password change on first login
• being able to change your own AD password, in general, and noone elses ...
• Kerberos-backed NFSv4 ... you'll envy the dead while you find your way through this

Unfortunately, I've never done this with OpenLDAP. RHEL\Centos and Debian, all the time. So, my knowledge is limited at best.

Best of luck.