When a Fedora 41 or RHEL 9.5 system is joined to an Active Directory domain by using Winbind, realmd configures the pam_winbind library with a cache type = FILE instead of KCM.

Reproducible: Always

Steps to Reproduce:
1. Install a clean Fedora 41 or RHEL 9.5 system.
2. Configure hostname, DNS and chronyd correctly so you can join a domain
3. Install the required components to perform the domain join operation:

sudo dnf install \
realmd oddjob oddjob-mkhomedir samba-winbind-clients samba-winbind samba-common-tools samba-winbind-krb5-locator krb5-workstation

4. Join the system to the domain:

realm join --membership-software=samba --client-software=winbind --user=user domain.com

5. Reboot the system and verify you have a Kerberos ticket by running

klist

Actual Results:  
The list of tickets returned by klist is empty.

Expected Results:  
You have Kerberos Tickets.

The pam_winbind module is configured incorrectly by realmd with the line

krb5_ccache_type = FILE

in /etc/security/pam_winbind.conf file.

The Kerberos library will search for a Kerberos cache in SSSD-KCM by default both on RHEL 9.x and Fedora 40+ as specified in the /etc/krb5.conf.d/kcm_default_ccache file.

Simply modifying the /etc/security/pam_winbind.conf file with

krb5_ccache_type = KCM

fixes the issue, and then you are able to use the Winbind PAM modules cached tickets by using the system Kerberos library.
SSSD-KCM is installed by default and waits for a socket connection, no further configuration is required to have a working system.