When Kerberos authentication is enabled (either via Omniauth or
for passwordless Git HTTP) together with an LDAP that is Active
Directory (AD), we can automatically import Kerberos identities
from Active Directory for LDAP users. These users can then authenticate
to GitLab with Kerberos without having to attach their Kerberos
identity beforehand via the Omniauth provider.

This behavior is automatically enabled. It seems unlikely that
one would enable Kerberos in an Active Directory environament and not
want this behavior.