OS X (Apple)

# sshd: auth account password session
auth       optional       pam_krb5.so use_kcminit
auth       optional       pam_ntlm.so try_first_pass
auth       optional       pam_mount.so try_first_pass
auth       required       pam_opendirectory.so try_first_pass
account    required       pam_nologin.so
account    required       pam_sacl.so sacl_service=ssh
account    required       pam_opendirectory.so
password   required       pam_opendirectory.so
session    required       pam_launchd.so
session    optional       pam_mount.so

# sshd: auth account password session
auth       sufficient     pam_krb5.so try_first_pass default_principal
auth       optional       pam_ntlm.so try_first_pass
auth       optional       pam_mount.so try_first_pass
auth       required       pam_opendirectory.so try_first_pass
account    required       pam_nologin.so
account    required       pam_sacl.so sacl_service=ssh
account    required       pam_opendirectory.so
password   required       pam_opendirectory.so
session    required       pam_launchd.so
session    optional       pam_mount.so

# sudo: auth account password session
auth       required       pam_opendirectory.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

# sudo: auth account password session
auth       sufficient     pam_krb5.so try_first_pass default_principal
auth       required       pam_opendirectory.so
account    required       pam_permit.so
password   required       pam_deny.so
session    required       pam_permit.so

GSSAPIAuthentication yes
GSSAPICleanupCredentials yes

UsePam yes

Dec  9 10:45:56 aria sudo[93207]: krb5_sendto_context is called on main thread, its a blocking api
Dec  9 10:45:56 aria sudo[93207]: in pam_sm_authenticate(): Kerberos 5 error

klist: krb5_cc_get_principal: No credentials cache file found