KrbLocalUserMapping enables conversion to local users.

It uses auth_to_local rules in /etc/krb5.conf. By default it strips the
@REALM part. See krb5.conf(5) for details how to set up specific rules.

Without this directive set to On, after enabling mod_auth_kerb, users
will be logged in with username containing the @REALM which is different
account so they won't be able to see their data and applications.