I'm currently working on getting FreeIPA into Debian, and this is one of the semi-blocking things for getting AD trust support into it. FreeIPA has a hard requirement on MIT Kerberos, so I'd be keen on hearing if there's been any news on this. As I understand it, RODC is still not available (as are claims), which I understand would be a problem. Is there any chance we could build two packages, one with Heimdal and one with MIT? That would be beneficial for testing and an eventual transition, letting package maintainers and system administrators transition over in a controlled manner.
