It should be possible for users to authenticate for domain management using Kerberos.

Over the HTTP interface this will be SPNEGO, for the Native connection we use SASL so can use GSSAPI