I read the MIT instruction in the past but to be sure I repeated the process:
local user and OpenDirectory user are identical
password local and password Open Directory are identical
The client is bound to open Directory without any errors in local or server logs
kinit at local machine from terminal is working with full username ( i.e. user@REALM.SERVER.DOMAIN),
kinit without parameter is not working ( it tries to identify at REALM user@WELLKNOWN:COM.APPLE.LKDC
changing /private/etc/pam.d/authorization doesn't change anything ( after reboot of the client )
Any ideas ?