At my organization, we're required to use different kerberos principals when authenticating for sudo than for other types of auth, such as logging in.  For instance, my regular (login) principal might be called foobar@DOMAIN, whereas my sudo principal is called foobar/sudo@DOMAIN. In the past, we've met this requirement by building our own sudo with the --with-kerb5 and --enable-kerb5-instance=sudo flags set at build time.  This means that our version of sudo hooks directly into kerberos, never using the PAM stack at all.We're trying to see if we can meet the split-principal requirement without building and distributing our own build of sudo.  My question is: Is this possible, and if so, how?Using the standard RHEL 6/7 sudo package, I can't use the --with-kerb5 build-time option; I have to use PAM as my authentication stack.  That means I must use pam_krb5.  With pam_krb5, I've noticed that I can map usernames to principal names in /etc/krb5.conf using the appdefaults/pam/mappings configuration option.  This gets me partway there, as it enables me to map a username of foobar to a principal name of foobar/sudo.  However, from what I can tell, there's no way to set mappings per application (kerberos sees PAM as a single application, no matter which application is invoking the PAM stack), meaning the mapping applies to any applications that use pam_krb5 in their PAM configuration.  So I can get the system to use the sudo principals for both sudo and login, or login principals for both, but I can't get the system to use sudo principals for sudo and login principals for login.Any ideas?  Or am I stuck with having to build & distribute a custom sudo?
How can I use different kerberos principals for sudo than for system-auth?
rhel;sudo;pam;kerberos
This is not a complete answer, but I wonder if you could accomplish this using SSSD.The pam_sss module lets you restrict a service to only considering particular domains in /etc/sssd/sssd.conf. From pam_sss(8):domains Allows the administrator to restrict the domains a particular PAM  service is allowed to authenticate against. The format is a  comma-separated list of SSSD domain names, as specified in the  sssd.conf file.In theory, you could have two domains both pointing at the same upstream authentication environment, but with different rules for mapping users to principals.Unfortunately, it looks like SSSD only supports static mappings of usernames to principal names, which doesn't scale very well.UpdateIt also looks like more recent versions of the pam_krb5 module support an alt_auth_map option that does exactly what you want.  That is, in /etc/pam.d/sudo, I can do this:auth    required    pam_krb5.so alt_auth_map=%s/sudo only_alt_auth...and now sudo will always use the <username>/sudo principal for authentication.This version of pam-krb5 is distributed with Ubuntu, but presumably one could build an rpm and install it on your systems without too much fuss.