...
Auth:
        [success=end default=ignore]    pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login try_first_pass required_membership_of=S-1-5-21-5555555555-555555555-5555555555-512
...