I'm working on a project for a standardized Linux image for our organization. This image will be domain joined, and I've written a script to fire on boot that will guide the IST person doing the Linux machine setup through the join.
Pretty much every guide I have seen states that you must edit krb5.conf to reflect your AD domain's structure. However, there's not much information as to why this is necessary, and I've found that I am able to perform domain joins via net ads (instead of net rpc) without altering krb5.conf at all, in both Ubuntu 12.04/14.04 and CentOS 6.5. This has been true in both Samba 3 and Samba 4; our AD backend I believe is now entirely Server 2k8 and has been since before I started this project.
Further, I'm able to set pam_winbind with the krb5auth option, and it properly creates the kerberos ticket in /tmp; wbinfo -K also works fine and creates a Kerberos ticket. So, my question really is - what does krb5.conf do that I'm missing? What impact will there be if it's not configured? Is it just going to be that programs using Kerberos to authenticate will not be able to do so, or is there some other subtler point that I'm not aware of (such as winbind falling back to an insecure RPC based auth method if krb5.conf is not correct?)