Comment # 5 on bug 1005669 from Josef M�llers

How about

"As this may completely lock you (and root!) out of your system if the Kerberos
service is not yet properly configured, in addition you may want to also run
the following command:
+-----------------------------------------------------------------------------+
| pam-config --add --krb5-ignore_unknown_principals                           |
+-----------------------------------------------------------------------------+
This will cause some errors to be ignored that would otherwise cause the
account phase to fail.
Note that this must come AFTER you have completed the step outlined above,
adding the pam_krb5 module to the existing PAM configuration files!"