Thanks Jiri! Works perfectly!
For the record we require a custom krb5.ini because we have a really complex AD infrastructure (5 different domains with strange trusts between them) that requires customizations in the [domain_realm] and [capaths] sections.