<p>We are trying to bind a Linux machine (debian 4.0) to W2k3 AD.  We have configured kerberos properly so that we can get TGTs.  And users authenticate properly.  However, PAM seems to be the sticky wicket.  For example when we try to SSH to the linux machine as one of the AD users, the authentication succeeds (as per the auth.log) but I never get shell.  The default environment is configured properly and PAM even creates the Homedir properly.  As a reference we were loosely following:</p>

<p><a href="https://help.ubuntu.com/community/ActiveDirectoryHowto" rel="nofollow noreferrer">https://help.ubuntu.com/community/ActiveDirectoryHowto</a></p>

If you're confident everything but PAM works correctly, I suggest passing the debug option to pam_krb5.so to see if that gives a clue to what's happening.
I'd also suggest verifying that nss-ldap is set up correctly using
```
```
getent passwd avalidusername
```
```