We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556.
From my understanding of how Kerberos works, it doesn't actually send the password. So I'm wondering: How does public keys add to the security of Kerberos? Is it something I should be using?
As a side note: We have some Mac users in our office, and unfortunately pkinit is missing. I haven't been able to find much about why this is, other than this post on the Apple mailing list saying "we highly recommend against using this for any purpose". Is this because of the security of RFC4556, or the security of how the platform used that protocol?