Login to admin console
Create ldap userFederation provider with Kerberos enabled
Check that Kerberos authenticator was automatically switched to ALTERNATIVE .
Change Kerberos authenticator to REQUIRED
Go back to userFederation and update the LDAP provider. Kerberos authenticator was automatically changed from REQUIRED to ALTERNATIVE. That's not very good IMO.

I think the expected behaviour is, that during creation or update of UserFederationProvider is kerberos authenticator switched to ALTERNATIVE just if it was previously DISABLED.