I've done something similar with NIS/Kerberos. It works fine, but gksu(do) does not work any more. Regular su(do) uses pam just fine. -- nocturn