Is it possible to enable kerberos on OS X 10.9 without joining the Active Directory domain?
Here is my partial success so far. I was able to setup Kerberos authentication but only on Firefox and Google Chrome, on Safari it doesn't work and it seems to be impossible to make it work without really joining the domain.

OS X Kerberos Setup

&gt;kinit username@EXAMPLE.COM

&gt;klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: user@EXAMPLE.COM
Valid starting     Expires            Service principal
06/05/14 11:36:00  06/05/14 21:36:06  krbtgt/EXAMPLE.COM@EXAMPLE.COM
        renew until 07/05/14 11:36:00


Now you can use /System/Library/CoreServices/Ticket Viewer.app to view the ticket, or to renew it when it expires.

CURL

 curl -v --negotiate -u : -b ~/cookiejar.txt -c ~/cookiejar.txt --output /dev/null http://example.com


Firefox

go to about:config and configure network.negotiate-auth.trusted-uris: .example.com

Chrome

defaults write com.google.Chrome AuthServerWhitelist "*.example.com"
defaults write com.google.Chrome AuthNegotiateDelegateWhitelist "*.example.com"


Safari [broken!]

Base on https://www.pingidentity.com/support/solutions/index.cfm/How-to-configure-supported-browsers-for-Kerberos-NTLM#safari it seems that Safari will use SPNEGO only when it is joined into the domain. Otherwise it will only try NTLM which is probably disabled as being insecure.

Any contributions are more than welcomed!