In the spare time I’ve had in Melbourne, I’ve written a small Ajax app called kpassweb to do Kerberos password changes. Configuration on the backend is pretty minimal. As it turned out, the backend PHP Pecl library kadm5 doesn’t work with current versions of Kerberos, so I’ve also written a patch to get that working.
It’s not quite finished, since compiling with the patch still produces a bunch of deprecated symbols from the Zend PHP interface, but it makes it usable.
As a side note, this was all done on my venerable Atom CPU netbook with a whole 8GB of storage, with connectivity snaffled from the Melbourne city library, McDonalds, and over an epically slow cellular connection. I really don’t recommend this.