Hybrid login: Kerberos with LDAP fallback