In MIT 1.11 there is a new feature [1] that allows an application to obtain new credentials from a keytab without having to use krb5 low level calls to perform AS requests (kinit).

Currently 389ds has quite extensive code in ldaputil.c to deal with this problem that can be initially disabled and eventually removed if this feature is used instead.

Combining this feature with Credentials Store Extensions[2] also a new feature of MIT 1.11 could aslo allow to completely configure all credential caches and cleint keytab locations progrannmatically via entries in cn=config.

Note: combining the 2 features is actually broken in 1.11, but a patch has already been pushed upstream and will be availabel in 1.12
Using Keyutab Initiation with the system defaults is however valuable enough to consider implementing it without waiting for 1.12, the only annoyance being that a copy or a symlink of the ds keytab will have to be configured in a special place on the system.

[1] http://k5wiki.kerberos.org/wiki/Projects/Keytab_initiation
[2] http://k5wiki.kerberos.org/wiki/Projects/Credential_Store_extensions