- don't ignore krb5realm command line option (#174838)
- read dns_lookup_realm and dns_lookup_kdc values correctly
- the PAM configuration is now written in system-auth-ac file which is then
symlinked from system-auth, the symlink is not overwritten so local PAM
configuration is now possible (#165342)