After reading a 3-part introduction to Kerberos in ix, I've decided to give it a try myself, on my desktop at work.
As I already log in to my machine every morning using winbind (which authenticates me against our ADS), I hoped that I'll be able to get my Kerberos-ticket directly from there.
After some (read: half an hour of) fruitless googling, I decided to read some manpages (winbindd, pam_winbind, smb.conf), and found the solution nearly instantly, and decided to share it with you:
First of all, let's assume you already have a working setup of winbind (if not, google:winbind, first hit)
In smb.conf I added winbind refresh tickets = yes winbind offline logon = yes
(the former is convenient when using Kerberos tickets from winbind, the latter has nothing to do with Kerberos at all, but it's nice anyway
Then I've modified the winbind-line in /etc/pam.d/common-auth to read