I just tried to following snippet and it seems work. Priority is 703 because libpam-krb5 has priority 704, so libpam_afs_session ends up after it in the session stack. libpam-heimdal unfortunately ships without a pam config for pam-auth-update. The one from libpam-krb5 should work for it without modifications, though.
Regards, Jakob Name: AFS session Default: yes Priority: 703 Session-Type: Additional Session: optional pam_afs_session.so -- ceterum censeo microsoftem esse delendam.
signature.asc
Description: PGP signature